Data processing agreement

This agreement (the “DPA”) forms part of the terms of service between you, the customer, and Sena Studio, LLC (“we”). It applies whenever Lissoss processes personal data about the visitors to your websites, and you accept it with the terms: there is nothing to sign. If you need a countersigned copy, write to hello@pleurat.com.

Data about you and your team as our customers (your account, billing and use of Lissoss) is not covered here; we handle it as a controller, as our privacy policy explains.

1. Words used here

“Personal data”, “processing”, “controller”, “processor”, “data subject”, “personal data breach” and “supervisory authority” mean what they mean in the EU General Data Protection Regulation (Regulation (EU) 2016/679, the “GDPR”), and in the UK GDPR where it applies. “Visitor data” is the personal data described in Annex 1.

2. Roles

For visitor data, you are the controller and we are your processor. Annex 1 describes the processing: what it is for, what data it covers and how long it lasts.

3. Your instructions

We process visitor data only on your documented instructions. Those are the terms, this DPA, and what you set in Lissoss: which sites are tracked, how visitors give consent, what is excluded, and what you ask us to delete. If we are required by law to do otherwise, we will tell you first, unless the law forbids it. If we think an instruction breaks data protection law, we will tell you.

4. Your part

• You have a lawful basis for the tracking, and collect your visitors' consent where it is needed. Lissoss's consent box, or your own cookie tool connected to it, is how that answer reaches us.
• You tell your visitors about it in your privacy notice. Lissoss can generate wording from your settings as a starting point.
• You don't use Lissoss to collect special categories of personal data (such as health, beliefs or sexuality), or put personal data where the snippet will read it on purpose.

5. Confidentiality

Everyone we authorise to process visitor data is bound by a duty of confidentiality.

6. Security

We keep visitor data secure with the technical and organisational measures in Annex 2, and keep them appropriate to the risk as the service changes.

7. Subprocessors

You authorise us to use the subprocessors listed in Annex 3. Before we add or replace one, we will tell your workspace's admins by email and update this page at least 30 days in advance. If you have a reasonable data protection objection, tell us within that time; if we can't resolve it, you may end the agreement for the affected service before the change. Each subprocessor is bound by data protection terms that protect visitor data as this DPA does, and we remain responsible to you for its work.

8. Transfers outside the EEA and the UK

Sena Studio, LLC and some of our subprocessors are in the United States. Where visitor data moves from the European Economic Area to a country without an adequacy decision, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 apply, Module Two (controller to processor), and are incorporated into this DPA by reference. For them: the annexes of this DPA are their annexes; under clause 9(a), option 2 applies with the notice period in section 7; clause 11's optional wording does not apply; under clause 13, the supervisory authority is the one competent for you; under clause 17, option 1 applies with the law of Ireland; and under clause 18, the courts of Ireland. For data from the United Kingdom, the International Data Transfer Addendum issued by the UK Information Commissioner applies alongside them, with its tables completed from this DPA and neither party able to end it early. For data from Switzerland, references to the GDPR include the Swiss Federal Act on Data Protection, and the Swiss Federal Data Protection and Information Commissioner is a competent authority. Our subprocessors' own transfers rely on the EU–US Data Privacy Framework where they are certified under it, and on the Standard Contractual Clauses where they are not.

9. Helping you answer visitors

Lissoss lets you delete a visitor's data in one step and export your sessions. Where a visitor's request needs more than that, we will help, taking into account what we can reasonably do. If a visitor contacts us directly, we will pass the request on to you.

10. Helping with your other duties

We will help you meet your obligations on security, breach notification, data protection impact assessments and prior consultation with a supervisory authority (GDPR Articles 32 to 36), taking into account the nature of the processing and the information we have.

11. Personal data breaches

If we become aware of a personal data breach affecting visitor data, we will tell you without undue delay, and in any case within 48 hours. We will share what we know about its nature, the data and visitors affected, its likely consequences and what we are doing about it, and add to it as we learn more.

12. When the processing ends

When you delete a site or close your workspace, we delete its visitor data from our own systems within 30 days, unless the law requires us to keep it; the copy held by our event collection provider is deleted when its retention period ends. You can export your sessions before that. While the agreement runs, our copy of visitor events is also deleted automatically once it is older than the retention window (365 days).

13. Showing that we comply

We will give you the information you reasonably need to show that this DPA is being met, starting with this page, our privacy policy and answers to your written questions, once a year or after a breach. If that is not enough, or a supervisory authority requires it, you may audit us, with 30 days' notice, at your cost, during working hours, and in a way that protects other customers' data and our security.

14. Liability and order of precedence

Each party's liability under this DPA is subject to the limits in the terms, except where the law or the Standard Contractual Clauses do not allow a limit. If this DPA and the terms conflict on data protection, this DPA prevails; if the Standard Contractual Clauses conflict with either, the Clauses prevail.

15. How long it lasts

This DPA lasts as long as we process visitor data for you, and its duties on deletion and confidentiality continue until that data is gone.

Annex 1: the processing

• Subject matter and nature: collecting, storing and analysing how visitors use your websites, including summaries analysed by an AI model, so that Lissoss can show you where visitors get lost and what to change.
• Purpose: providing Lissoss to you.
• Data subjects: visitors to the websites you connect, once they have agreed to analytics under your consent setting.
• Personal data: random identifiers for the visitor and the visit; the pages viewed, time on page and scroll depth; clicks and the visible text of what was clicked; signs of frustration such as repeated clicks; the referring site and campaign tags; browser, operating system and device type; approximate location (country, region and city) worked out from the IP address; and errors on the page. Sign-in, reset and access codes and email addresses are removed from addresses, referrers, error messages and clicked text before they are sent. What visitors type into forms is not collected, and screens are never recorded.
• Special categories: none.
• Frequency: continuous, whenever a consenting visitor uses your site.
• Retention: 365 days for our copy of visitor events, deleted automatically every night; the event collection provider keeps its copy under its retention setting for our project.

Annex 2: security measures

• In transit: everything travels encrypted over HTTPS.
• At rest: our database and file storage provider encrypts stored data.
• Separation: each workspace reads only its own data, checked on the server for every request, and a request that isn't bound to a workspace reads nothing. Automated tests cover these rules.
• Access: database tables are reachable only by our server, never straight from a browser. Inside a workspace, roles (admin, manager, viewer) limit who can change settings, run AI analyses and manage the team.
• Keys: API keys are stored only as one-way hashes; keys you give us for other services are never sent back to the browser; our own secrets live in our hosting provider's environment settings.
• Less data from the start: by default nothing is collected until the visitor agrees; codes, tokens and email addresses are removed in the browser and again on our server; client IP addresses are discarded by the event collection provider after approximate location is worked out; and IP addresses are never sent to the AI model.
• Deletion: visitor events are deleted automatically after the retention window, and one visitor can be erased in one step.
• Changes: every change runs an automated test suite that includes these separation and data rules, and security-sensitive code is reviewed against them.

Annex 3: subprocessors

Visitor data reaches the providers that host, store, collect and analyse it. Billing and email providers handle data about you as our customer, not your visitors.

Contact

Sena Studio, LLC · hello@pleurat.com