Parties and subject matter
This Data Processing Agreement (DPA) applies to all services delivered by Govanalytics B.V. (hereafter: Processor) to its customers (hereafter: Controller). The DPA forms an integral part of the service agreement and takes effect when you start using Govanalytics services.
Subject matter and duration
The Processor processes personal data solely for the purpose of delivering the agreed analytics services. Processing takes place for the duration of the service agreement. After termination, personal data will be deleted or returned within 30 days, at the Controller's choice.
Govanalytics is designed to minimise the processing of personal data. In the default configuration, the web analytics functionality processes no personal data: no cookies are set and visitors cannot be identified as individuals.
Nature and purpose of processing
The processing consists of measuring and analysing website usage on behalf of the Controller. The categories of data subjects are visitors to the website(s) the Controller measures with Govanalytics. The data processed consists exclusively of pseudonymised or aggregated measurement data, unless the Controller introduces additional personal data through configuration.
Obligations of the Processor
Govanalytics commits to the following:
- Processing personal data solely on the basis of documented instructions from the Controller.
- Ensuring confidentiality for all staff members with access to personal data.
- Implementing appropriate technical and organisational measures to secure personal data.
- Notifying the Controller without undue delay (within 48 hours) of any security incident or data breach affecting the processed personal data.
- Providing full cooperation for audits and inspections by or on behalf of the Controller.
- Deleting or returning all personal data upon termination of the service agreement.
Sub-processors
Govanalytics uses the following sub-processors. The Controller will be informed in advance before any new sub-processor is engaged and has the right to object.
| Party | Role | Country of establishment | Data location |
|---|---|---|---|
| UpCloud Ltd. | Managed hosting (infrastructure) | Finland | Amsterdam, Netherlands (EU) |
| d8a.tech B.V. | Technical platform and measurement infrastructure | Netherlands | Netherlands (EU) |
| Vallonic B.V. (Consent Studio) | Consent management platform | Netherlands | EU |
Written agreements have been concluded with all sub-processors that impose obligations at least equivalent to those in this DPA.
Technical and organisational measures
Govanalytics implements the following measures to secure personal data:
- Encryption of data in transit (TLS 1.2 or higher) and at rest (AES-256).
- Access control based on the need-to-know principle, with multi-factor authentication for administrators.
- Regular backups with encrypted storage within the EU.
- Security incident monitoring and documented incident response procedures.
- Annual security assessment of infrastructure and applications.
- Physical security of server locations through UpCloud's measures (ISO 27001-certified data centre).
Transfers outside the EU
Govanalytics does not transfer personal data outside the European Economic Area, unless explicitly instructed by the Controller and a valid legal basis exists for such transfer. All measurement data is stored and processed on servers in the Netherlands.
Data subject rights
For requests from data subjects (access, rectification, erasure), Govanalytics provides full cooperation to the Controller. Requests are handled within 5 working days. Govanalytics will not communicate directly with data subjects unless instructed to do so by the Controller.
Liability
Govanalytics's liability as Processor is limited to direct damages resulting from attributable failures to comply with this DPA, up to a maximum equal to the fees paid to Govanalytics in the twelve months preceding the incident that caused the damage.
Governing law and jurisdiction
This Data Processing Agreement is governed by Dutch law. Disputes will be submitted to the competent court in the district of Rotterdam.
Contact
For questions about the Data Processing Agreement or to request a signed copy:
Govanalytics B.V.
Bergsingel 124, 3037 GM Rotterdam
Netherlands
Chamber of Commerce: 42091943
privacy@govanalytics.nl