Data Processing Agreement
Last updated: February 17, 2026
1. Introduction
This Data Processing Agreement ("DPA") forms part of the agreement between you ("Data Controller" or "Customer") and Annalytick ("Data Processor" or "we") for the provision of the Annalytick platform services. This DPA applies to the extent that Annalytick processes personal data on behalf of the Customer in the course of providing the Service.
2. Definitions
- Personal Data: Any information relating to an identified or identifiable natural person, as defined by applicable data protection laws
- Processing: Any operation performed on personal data, including collection, storage, retrieval, use, disclosure, and deletion
- Sub-processor: Any third party engaged by Annalytick to process personal data on behalf of the Customer
- Data Subject: An identified or identifiable natural person whose personal data is processed
3. Scope of Processing
Annalytick processes personal data solely for the purpose of providing the Service as described in our Terms of Service. The types of personal data processed may include:
- Customer account information (name, email, organization details)
- Data collected by Customer's web scraping actors, which may contain personal data depending on the Customer's use case
- Usage logs and metadata related to the Service
4. Obligations of the Data Processor
Annalytick shall:
- Process personal data only on documented instructions from the Customer
- Ensure that persons authorized to process personal data are bound by confidentiality obligations
- Implement appropriate technical and organizational security measures
- Assist the Customer in responding to data subject requests (access, rectification, erasure, portability)
- Notify the Customer without undue delay (within 72 hours) upon becoming aware of a personal data breach
- Delete or return all personal data upon termination of the Service, at the Customer's choice
- Make available all information necessary to demonstrate compliance with this DPA
5. Sub-processors
Annalytick uses the following categories of sub-processors:
- Cloud Infrastructure: For hosting and data storage
- Email Services: For transactional email delivery (Mailgun)
- Payment Processing: For subscription billing (Polar)
- Apify: For executing web scraping actors as directed by the Customer
We will notify the Customer before adding or replacing any sub-processor, giving the Customer the opportunity to object. All sub-processors are bound by data processing agreements with equivalent protections.
6. Data Transfers
If personal data is transferred outside the European Economic Area (EEA), Annalytick ensures that appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission, or other legally recognized transfer mechanisms.
7. Security Measures
Annalytick implements the following technical and organizational measures:
- Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
- Access controls and role-based permissions
- Regular security assessments and vulnerability scanning
- Secure API key management with encryption and expiration support
- Automated backups with point-in-time recovery
- Incident response procedures and breach notification processes
For more details, see our Security page.
8. Audits
The Customer may request an audit of Annalytick's data processing practices, subject to reasonable notice and scope. Annalytick will cooperate with such audits and provide necessary documentation. Audits shall be conducted during normal business hours and shall not unreasonably disrupt Annalytick's operations.
9. Duration and Termination
This DPA remains in effect for the duration of the Service agreement. Upon termination, Annalytick will delete all personal data within 30 days unless retention is required by applicable law. The Customer may request a copy of their data in a machine-readable format before deletion.
10. Contact
For questions about this DPA or to request a signed copy, contact us at dpa@annalytick.com or through our contact form.