Data Processing Agreement

Last updated: 28 October 2026

This Data Processing Agreement ("DPA") is part of the Terms of Service between the Customer (controller) and TrackPilot (processor). It applies to personal data we process for the Customer through the Service, in line with the GDPR and similar laws.

1. Subject and duration

Processing of website and server events sent by the Customer, to forward them to the advertising platforms the Customer configures and to show logs and statistics, for as long as the Customer uses the Service.

2. Data and data subjects

• Data subjects: visitors and customers of the Customer's websites.
• Data: event details, URLs, IP address, user agent, advertising cookie IDs, purchase data, and hashed identifiers (email, phone, name, address, customer ID).
• No special categories of data may be sent.

3. Processor obligations

• Process only on the Customer's documented instructions (the Service configuration counts as instructions).
• Ensure staff with access are bound to confidentiality.
• Apply appropriate security: TLS, encryption of secrets and tokens at rest, hashing of identifiers on arrival, access control with 2FA for administrators, logging.
• Help the Customer answer data-subject requests and with security and impact assessments, as far as reasonable.
• Notify the Customer without undue delay (target 72 hours) after becoming aware of a personal data breach.
• Delete event logs after 7 days and all Customer data after the account ends (backups within 30 days), unless law requires otherwise.
• Make available information needed to show compliance with this DPA.

4. Sub-processors

The Customer authorises: our hosting provider (servers in the EU), email delivery and payment providers, and the destination platforms the Customer configures (e.g. Meta Platforms Ireland Ltd., which receives the data as the Customer's chosen recipient under Meta's own terms). We will announce new sub-processors on this page; the Customer may object and terminate if we cannot accommodate the objection.

5. Transfers

Where data leaves the EEA, the parties rely on adequacy decisions or the EU Standard Contractual Clauses, which are incorporated by reference.

6. Customer obligations

The Customer has a legal basis for the data it sends, gives visitors the required notices, collects consent where required (the Service supports a consent flag), and sends no data it is not allowed to share.

Contact

TrackPilot, Dhaka, Bangladesh · [email protected] · contact form