Data processing agreement.
Annex structure with the facts the product can state. The clauses that bind are marked for counsel and attach to the signed order.
Draft. Not legal advice. Structural text only. Each marked clause requires review before signature.
In plain terms
The customer runs the site and decides what is measured. FRIODA Tech holds the resulting traffic data and answers read and query calls made with the project key.
The signed order and its annexes are what bind.
Parties and roles
The customer is the controller of the traffic data collected on its sites. FRIODA Tech is the processor, scoped to each project key. The annex naming the parties, their addresses and the processing covered is completed by counsel. [TO BE COMPLETED BY COUNSEL]
Scope and processing details
Subject matter is web traffic and session data from the customer's sites. Duration is the retention window of the plan in the order, with a separate window for replay streams. Nature is collection, storage, query, replay and export. Data categories are the per-site visitor identifier, request fingerprints, event rows and the masked DOM stream.
Purpose limitation, the instructions the customer gives, and the wording that keeps processing inside them are completed by counsel. [TO BE COMPLETED BY COUNSEL]
Sub-processors
Hosting (provider to be named) and support tooling (provider to be named). Payment is in crypto: BTC, ETH, USDT or XMR, so no card processor sits in the chain. The current list is published with this agreement.
The sub-processor list, the notice period before a change, the objection right and the flow-down terms are completed by counsel. [TO BE COMPLETED BY COUNSEL]
International transfers
Collection, storage and support sit on infrastructure outside the EU and the US. There is no in-region deployment today, and the service is not self-hosted.
The transfer mechanism, the assessment attached to it, and the notices owed to the customer and to visitors are completed by counsel. [TO BE COMPLETED BY COUNSEL]
Security measures
Access to project data is by key. API and MCP access is read-only, transport is encrypted, and access to project data is logged.
The security annex, the certifications relied on, the incident controls and the review cadence are completed by counsel. [TO BE COMPLETED BY COUNSEL]
Breach notification
A suspected breach is investigated and, where it is confirmed to affect customer data, the customer is notified through the channel named in the order. The notice states what happened, which projects were affected and what containment was applied.
The notification deadline, the required content, the cooperation duties and the allocation of regulatory notices are completed by counsel. [TO BE COMPLETED BY COUNSEL]
Deletion and return
Raw export is available for the period stated in the order after termination. When that period ends, project data is deleted from the queryable store, and replay streams are deleted on their own window.
Deletion certification, backup expiry and the treatment of data restored from backup are completed by counsel. [TO BE COMPLETED BY COUNSEL]
Audit and assistance
Requests route through the contact form with the project key. Assistance with visitor requests, impact assessments and prior consultation follows the split set in the agreement.
Audit rights, their scope and frequency, the confidentiality terms and the assistance duties are completed by counsel. [TO BE COMPLETED BY COUNSEL]
Annexes and signature
Annex 1, parties and roles. Annex 2, processing details. Annex 3, sub-processors. Annex 4, security measures. Annex 5, transfer mechanism. Signature blocks, the order of precedence and the term of the agreement are completed by counsel. [TO BE COMPLETED BY COUNSEL]