Data Processing Agreement

This Data Processing Agreement ("DPA") is part of the Spreelytics Terms of Service. It applies whenever we process personal data for you through Spreelytics, and it covers what Article 28 of the GDPR requires. You accept it when you accept the Terms, which you do when you create an account. There is nothing to sign.

It is between:

• Spreeflo Ltd, a company registered in England and Wales under company number 16068434, which provides Spreelytics ("Spreelytics", "we", "us"); and
• the customer that accepted the Terms ("you").

1. Definitions

1.1 Data Protection Law means, where it applies to the processing: (a) Regulation (EU) 2016/679 (the "EU GDPR"); (b) the UK GDPR, the Data Protection Act 2018 and the Data (Use and Access) Act 2025; (c) Directive 2002/58/EC and the Privacy and Electronic Communications Regulations 2003 ("PECR"); and (d) any other data protection or privacy law that applies, in each case as amended or replaced.

1.2 Customer Data means the data collected or held in Spreelytics for your audiences: what the tracking script, the SDKs and the API collect; what you import or connect, such as a CSV import, payments from a payment provider or Google Search Console data; and the questions your team asks Ask AI.

1.3 Customer Personal Data means the personal data in Customer Data that we process for you.

1.4 Services means Spreelytics: the app at app.spreelytics.com, the tracking script and SDKs, the API, Ask AI and the MCP server.

1.5 Sub-processor means a processor we engage to process Customer Personal Data.

1.6 EU SCCs means the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914. UK Addendum means the International Data Transfer Addendum to the EU SCCs, issued by the Information Commissioner under section 119A of the Data Protection Act 2018.

1.7 Controller, processor, data subject, personal data, personal data breach, processing and supervisory authority have the meanings given in the EU GDPR.

2. Who does what

2.1 For Customer Personal Data, you are the controller and we are your processor.

2.2 If you are yourself a processor for someone else, for example an agency running analytics for a client, you confirm that the controller has authorised you to accept this DPA and to instruct us. We are then your sub-processor, and where this DPA gives you a duty as controller, your duty is to get the same from your controller.

2.3 We are a controller, not your processor, for: your team members' account details; billing and payment details; support conversations with us; security and audit logs; and aggregated, de-identified statistics we use to run, secure and improve Spreelytics. Our Privacy Policy covers that processing, and this DPA does not.

2.4 Annex I describes the processing.

3. Your instructions

3.1 We process Customer Personal Data only on your documented instructions, including on transfers to another country, unless a law that applies to us requires otherwise. In that case we tell you before we process, unless that law forbids it on important grounds of public interest.

3.2 Your instructions are the Terms, this DPA (including Annex I), and how you set up and use Spreelytics, whether through the app, the API, the SDKs, Ask AI or the MCP server.

3.3 We tell you without undue delay if we think an instruction breaks Data Protection Law. We may hold off on it until you change or confirm it.

3.4 Your part. You will:

(a) comply with Data Protection Law as controller, including in how you collect data before it reaches us;

(b) have a lawful basis for the processing and, where it relies on consent, obtain consent that meets Articles 4(11) and 7 of the GDPR and that you can show;

(c) obtain any consent your visitors' law requires before the Spreelytics script stores or reads anything on their device. By default the script sets a first-party cookie. In cookieless mode it stores nothing in the browser. Cookieless tracking explains both;

(d) tell your visitors what Articles 13 and 14 of the GDPR require, for example in your own privacy policy; and

(e) not send us special category data (Article 9 GDPR), data about criminal convictions or offences (Article 10 GDPR), or data you know to be about children below the age of digital consent, without our written agreement. That includes event properties, the details you send when you identify someone, and page addresses. Don't send government ID numbers, payment card numbers or passwords either.

3.5 You are responsible for the accuracy, quality and lawfulness of Customer Personal Data, and for how you obtained it.

4. Confidentiality

4.1 Everyone we allow to process Customer Personal Data is bound by a duty of confidentiality, contractual or statutory, that lasts beyond their work for us.

4.2 Only the people who need access to provide the Services get it.

5. Security

5.1 Taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing, and the risk to data subjects, we maintain technical and organisational measures that give a level of security appropriate to the risk. Annex II describes them.

5.2 You are responsible for your side: keeping your team's passwords and API keys safe (MCP clients connect with those keys), giving team members the right roles, and removing people who no longer need access.

5.3 We may update the measures in Annex II, as long as the overall level of security does not go down.

6. Sub-processors

6.1 You give us general written authorisation to engage Sub-processors under this clause 6.

6.2 Our current Sub-processors are listed at spreelytics.com/legal/subprocessors, which forms Annex III.

6.3 We give you at least 30 days' notice before a new Sub-processor starts processing Customer Personal Data. We email the admins of every team and update that page.

6.4 You may object to a new Sub-processor on reasonable data protection grounds by writing to contact@spreelytics.com within the notice period. We will discuss it with you in good faith. If we can't resolve it, you may end the affected Services by written notice and get back, pro rata, any fees you paid in advance for the time after that. That is your only remedy.

6.5 We bind each Sub-processor by written contract to data protection obligations no less protective than those in this DPA. We stay fully liable to you for their performance.

6.6 Services you connect yourself. When you connect Spreelytics to another service with your own account or API key, that service is not our Sub-processor. This covers payment providers (Stripe, Paddle, Polar and Lemon Squeezy), Google Search Console, the Slack, Discord and webhook destinations you send notifications to, and AI apps you connect to our MCP server, such as Claude, ChatGPT or Cursor. Data moves between that service and Spreelytics on your instruction, under your own agreement with its provider. You are responsible for any data processing agreement and transfer mechanism that applies to it.

7. Helping with data subject requests

7.1 In the app you can find a person and see, on their profile, the data Spreelytics holds about them, and you can get it through the API. Use these first when you answer a request.

7.2 To have one of your visitors erased, email contact@spreelytics.com from the address of an admin of the team, with a link to their profile. Within 30 days we delete their events, visits and identifying details from your audience and tell you when it's done. Their payments stay in your revenue figures, without anything that shows who paid. Erasing doesn't reach your team's Ask AI chats, which you can delete in the app, and it doesn't stop tracking: if they visit again, they are counted as a new visitor.

7.3 Taking into account the nature of the processing, we help you, by appropriate technical and organisational measures and as far as possible, to meet your obligation to answer requests from data subjects under Chapter III of the GDPR.

7.4 If a data subject asks us directly about Customer Personal Data, we don't answer the substance of it. We point them to you and, if we can tell which customer it concerns, we tell you without undue delay.

8. Personal data breaches

8.1 We tell you without undue delay after we become aware of a personal data breach affecting Customer Personal Data.

8.2 We tell you what we know: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, what we have done or plan to do about it, and who to contact. If we don't know it all at once, we send it in stages without further undue delay.

8.3 We give you reasonable help with your obligations under Articles 33 and 34 of the GDPR.

8.4 Telling you about a breach, or responding to one, is not an admission of fault or liability.

9. Impact assessments

Taking into account the nature of the processing and the information we have, we give you reasonable help with data protection impact assessments (Article 35 GDPR) and prior consultations with supervisory authorities (Article 36 GDPR), in each case only for the processing of Customer Personal Data in Spreelytics. We may do this by sharing our security information, this DPA and our published policies.

10. International transfers

10.1 To us. We are established in the United Kingdom. Transfers of Customer Personal Data from the EEA to us rely on the European Commission's adequacy decision for the United Kingdom, renewed on 19 December 2025 and in force until 27 December 2031. While that decision stands, they need no other transfer mechanism.

10.2 Onward transfers. Where we transfer Customer Personal Data to a Sub-processor in a country without an adequacy decision, we make sure the transfer has an appropriate safeguard under Article 46 of the EU GDPR and, where it applies, Article 46 of the UK GDPR. We use one or more of: (a) the recipient's active certification under the EU-US Data Privacy Framework and, for UK data, its UK Extension; (b) the EU SCCs (Module Three, processor to processor) together with, for UK data, the UK Addendum; or (c) another lawful transfer mechanism.

10.3 If the adequacy decision ends. If the decision in clause 10.1 stops applying, you and we are deemed to have entered into the EU SCCs (Module Two, controller to processor) for transfers from the EEA to us. Annexes I, II and III of this DPA are their annexes; the optional docking clause applies; under Clause 9, option 2 applies with the notice period in clause 6.3; and Irish law and the courts of Ireland govern them. Accepting the Terms has the same effect as signing them, with no separate signature needed.

10.4 Annex III gives each Sub-processor's location.

10.5 We store Customer Personal Data in the United States, with Amazon Web Services in Ohio (us-east-2). We don't offer an EU storage region yet.

11. Audits

11.1 We make available the information reasonably needed to show that we meet Article 28 of the GDPR, and we allow for and contribute to audits, including inspections, by you or an auditor you appoint.

11.2 Start by asking us for that information. We'll answer your questions in writing and share this DPA, our security information and any audit reports or certifications we hold.

11.3 If that isn't enough to show compliance, you may ask for an audit:

• no more than once in any 12 months, unless a supervisory authority requires it or it follows a personal data breach;
• with at least 30 days' written notice;
• during normal business hours, without unreasonable disruption to us;
• by an auditor who isn't our competitor and is bound by confidentiality; and
• at your cost, including our reasonable costs.

11.4 Audits don't extend to other customers' data, systems or facilities, or to information we can't share without breaking obligations to others.

12. Retention and deletion

12.1 While you use Spreelytics. We keep analytics for as long as your plan allows: 13 months on Free and 5 years on Growth, or what we agree in writing for Enterprise. Each month we delete events and visits older than that. If you move to a plan that keeps less, we keep the older data for 60 days in case you move back, then delete it. Session recordings are kept for 30 days on every plan, then deleted. The rest, such as your audiences, settings, visitor and people records and payment records, is kept until you delete the audience or team, or ask us to erase a visitor (clause 7.2).

12.2 Deleting data yourself. You can delete an audience or a team in its settings, under Danger zone. You can also delete your account (Account, then Danger zone, then Delete account), which also deletes every team where you're the only member. If you use the same login for Spreeflo, the login and those teams stay for Spreeflo, and Delete account deletes all the analytics in those teams instead, including the web analytics Spreeflo shows from Spreelytics.

12.3 When we delete. When you delete an audience, a team or your account, we delete the Customer Personal Data in it from our live systems straight away, unless a law that applies to us requires us to keep it. The exception is Ask AI chats: they belong to the person who had them, and go when that person deletes them or their account. If you want a copy of your data first, export it through the API before you delete. Ask us if you need help.

13. Liability

13.1 Each party's liability under or in connection with this DPA is subject to the exclusions and limits of liability in the Terms.

13.2 Nothing in this DPA limits either party's liability to a data subject under Article 82 of the GDPR, or any liability that the law doesn't allow to be limited.

14. General

14.1 If these documents conflict, this order applies: (1) the EU SCCs or the UK Addendum, where they apply; (2) this DPA; (3) the Terms.

14.2 This DPA lasts for as long as we process Customer Personal Data for you. Clauses 4, 12 and 13 survive its end.

14.3 We may change this DPA on 30 days' notice, by email to the admins of every team, where Data Protection Law requires it, to reflect a change in the transfer mechanisms we rely on, or where the change doesn't materially reduce your protection. Any other change needs both parties' written agreement.

14.4 This DPA is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction, except where the EU SCCs apply and say otherwise.

14.5 If any part of this DPA is found invalid or unenforceable, the rest stays in force.

Signing

There is nothing to sign. This DPA binds both parties once you accept the Terms, and keeping it in electronic form meets Article 28(9) of the GDPR. If your own procedures need a countersigned copy, email contact@spreelytics.com and we'll send one. It doesn't change these terms.

Annex I: Description of the processing

A. Parties

Data exporter and controller: you, the customer that accepted the Terms. Contact: the admins of your team, as recorded in Spreelytics.

Data importer and processor: Spreeflo Ltd, registered in England and Wales under company number 16068434, at the registered office shown for it at Companies House. Contact: contact@spreelytics.com.

B. The processing

Data subjects

• Visitors to your websites and apps, whether or not you have identified them
• Your customers whose payments reach Spreelytics, from a payment provider you connect or from revenue events you send

Personal data

Special category data: none requested, and not allowed without our written agreement (clause 3.4(e)).

Frequency of transfer: continuous, for as long as you use Spreelytics.

Nature and purpose of the processing: collecting, storing and analysing web and product analytics for you, so you can see how people find and use your websites and apps. That includes dashboards, reports, funnels, goals, cohorts, revenue attribution, session replay, the notifications you set up, Ask AI, the MCP server, the API, and technical support.

Duration: for as long as the Terms apply, plus the deletion periods in clause 12.

Retention: as set out in clause 12.1.

C. Competent supervisory authority

For transfers under the EU SCCs, the supervisory authority of the EEA member state where you are established, or where your EU representative is established. For UK data, the Information Commissioner's Office.

Annex II: Technical and organisational measures

• Encryption. Data is encrypted in transit with TLS 1.2 or later, and at rest with AES-256.
• Access. In the app, access is by team, with roles. Our administrative and infrastructure accounts require multi-factor authentication, and production access is limited to named staff on a least-privilege basis.
• API keys. Each key belongs to one user and can be revoked in the app at any time. MCP clients connect with these keys.
• Minimisation. Visitors are recorded under a random id until you identify them. IP addresses aren't stored with analytics. In cookieless mode nothing is stored in the visitor's browser, and the id changes every day.
• Availability. Spreelytics runs on AWS. The databases that hold accounts, settings and people are backed up automatically, and analytics are copied every day to an encrypted archive in Amazon S3.
• Separation. Each team's and each audience's data is kept apart where it is read and written. Production is separate from development, and production personal data isn't used in development.
• Logs. Server logs are kept for 30 days on the servers that collect analytics, and for 90 days elsewhere.
• Changes. Every change goes through version control and an automated deployment pipeline.
• People. Everyone with access is bound by confidentiality, and loses access when they leave.
• Sub-processors. Each one is bound by written data protection terms. We publish the list and give notice of changes.
• Deletion. Deleting an audience, a team or an account deletes its analytics from our live systems. A monthly job deletes analytics older than the plan keeps. One visitor can be erased on request (clause 7.2).

Annex III: Sub-processors

The list at spreelytics.com/legal/subprocessors is this Annex. It gives each Sub-processor's name, what it does and where it processes data. We keep it up to date under clause 6.