Data Processing Agreement

Version: 3.0 · Effective: November 5, 2026

This Data Processing Agreement ("DPA") is part of the Plerdy Terms of Service ("Terms") between Plerdy and the client that uses the Plerdy service ("Client"). It sets out how Plerdy processes personal data on the Client's behalf, as required by Article 28 of the EU General Data Protection Regulation 2016/679 ("GDPR") and other applicable data protection laws.

1. How this DPA applies

1.1. This DPA applies automatically to every Client who accepts the Terms, from the moment of acceptance. No signature is needed. Article 28(9) GDPR allows the agreement to be in electronic form.

1.2. This DPA is the same for all plans and payment methods: the free plan, monthly and annual subscriptions, invoices and AppSumo packages. It covers all websites connected to the Client's Plerdy account.

1.3. Plerdy does not negotiate or sign individual versions of this DPA. On request to [email protected], Plerdy sends a PDF of this DPA signed by Plerdy. The signed copy has the same text and the same effect as this page.

2. Roles and definitions

2.1. For the personal data of visitors of the Client's websites collected by the Plerdy code ("Client Personal Data"), the Client is the controller and Plerdy is the processor. For Client account data, Plerdy is the controller, as described in the Privacy Policy; this DPA does not apply to it.

2.2. "Plerdy" means Andrii Chornyi, individual entrepreneur (FOP), Ukraine. Terms such as "controller", "processor", "personal data", "processing", "data subject", "personal data breach" and "supervisory authority" have the meaning given in the GDPR.

3. Instructions

3.1. Plerdy processes Client Personal Data only on the Client's documented instructions, including for transfers to third countries, unless the law requires otherwise. In that case Plerdy informs the Client before processing, unless the law forbids it.

3.2. The Terms, this DPA and the settings the Client chooses in its Plerdy account (for example which tools are on, masking, retention and connected integrations) are the Client's complete instructions. Other instructions must be sent in writing to [email protected]. If an instruction cannot be followed, Plerdy tells the Client, and the Client may stop using the service.

3.3. Plerdy informs the Client if, in its opinion, an instruction breaks data protection law.

3.4. The Client is responsible for the lawfulness of the processing, including informing visitors and obtaining consent where the law requires it.

4. Confidentiality

Plerdy gives access to Client Personal Data only to people who need it to provide, support and secure the service. All of them are bound by confidentiality.

5. Security

Plerdy implements the technical and organisational measures described in Annex 2 and in the Security Policy, in line with Article 32 GDPR. Plerdy may update the measures as long as the overall level of protection does not decrease.

6. Subprocessors

6.1. The Client gives Plerdy general authorisation to use subprocessors. The current subprocessors are listed in Annex 3.

6.2. Plerdy informs the Client by email to the account owner at least 14 days before adding or replacing a subprocessor. The Client may object on reasonable data protection grounds within that period by writing to [email protected]. If the parties do not find a solution, the Client may stop using the affected part of the service or delete its account.

6.3. Plerdy imposes on each subprocessor data protection obligations equivalent to this DPA and remains responsible for it.

6.4. Integrations that the Client connects itself (for example email-marketing, CRM, Google Sheets, Slack or Telegram) receive data on the Client's instruction. They are the Client's own providers, not Plerdy's subprocessors.

7. Assistance to the Client

7.1. Taking into account the nature of the processing, Plerdy helps the Client answer data subject requests (access, deletion, correction, objection and others). Plerdy forwards to the Client any request it receives directly from a visitor and does not answer it without the Client's instruction.

7.2. Plerdy deletes the data of a specific visitor on the Client's request within 30 days. The Client can also delete the data of a website or its whole account in the Plerdy account at any time.

7.3. Plerdy gives the Client the information it reasonably needs for data protection impact assessments and prior consultations with supervisory authorities.

8. Personal data breaches

Plerdy notifies the Client without undue delay and, where feasible, within 48 hours after becoming aware of a personal data breach affecting Client Personal Data. The notice describes what is known at the time: the nature of the breach, the categories and approximate number of people and records concerned, the likely consequences and the measures taken. Plerdy adds information as it becomes available and takes steps to limit the breach.

9. Deletion at the end of the service

9.1. During the service, Client Personal Data is deleted automatically after the data history period of the Client's plan and according to the retention settings the Client chooses.

9.2. When the Client deletes a website or its account, Plerdy deletes the related Client Personal Data within 30 days, unless the law requires Plerdy to keep it. Before deleting, the Client can export its data with the tools available in the account.

10. Information and audits

10.1. Plerdy makes available to the Client the information necessary to show compliance with Article 28 GDPR: this DPA, the Security Policy and written answers to a reasonable security questionnaire, once every 12 months.

10.2. If this information is not enough, the Client may carry out an audit, itself or through an independent auditor bound by confidentiality, once every 12 months, with 30 days' written notice, during business hours, without disrupting the service and at the Client's cost. These limits do not apply when a supervisory authority requires the audit or after a personal data breach affecting the Client.

11. International transfers

11.1. Client Personal Data is stored on servers in Germany. Plerdy's team works from Ukraine and may access the data from there to provide support and maintain the service. Some subprocessors in Annex 3 are located outside the European Economic Area.

11.2. Where the Client is subject to the GDPR and data is transferred to Plerdy outside the European Economic Area, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 ("SCC"), Module Two (controller to processor), are incorporated into this DPA by reference, with these choices: clause 7 (docking clause) applies; clause 9(a), option 2 (general authorisation), with the notice period in section 6.2; the optional wording in clause 11 does not apply; clause 13: the supervisory authority competent for the Client; clause 17: the law of Germany; clause 18: the courts of Germany. Annexes I, II and III of the SCC are Annexes 1, 2 and 3 of this DPA.

11.3. For transfers subject to UK data protection law, the International Data Transfer Addendum issued by the UK Information Commissioner applies together with the SCC. For transfers subject to Swiss law, the SCC apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection, and the Swiss Federal Data Protection and Information Commissioner is the competent authority.

11.4. Plerdy transfers Client Personal Data to subprocessors outside the European Economic Area only under the SCC or another transfer mechanism allowed by the GDPR.

12. Liability

Each party's liability under this DPA is subject to the limitations in the Terms, to the extent the law allows. Nothing in this DPA limits the rights of data subjects under the GDPR or the SCC.

13. Term, priority and changes

13.1. This DPA applies for as long as Plerdy processes Client Personal Data.

13.2. If there is a conflict, the SCC prevail over this DPA, and this DPA prevails over the Terms in matters of personal data.

13.3. Plerdy may update this DPA to reflect changes in law or in the service. Plerdy informs Clients about material changes by email at least 14 days in advance. Changes do not reduce the level of protection of Client Personal Data.

13.4. This DPA is governed by the law that governs the Terms, except the SCC, which are governed as stated in section 11.2.

Annex 1. Description of the processing

Data exporter (controller)	The Client, as identified in its Plerdy account. Activity: operating a website and analysing its use.
Data importer (processor)	Andrii Chornyi, individual entrepreneur (FOP), Ukraine. Contact: [email protected]. Activity: providing the Plerdy website analytics service.
Data subjects	Visitors of the Client's websites; people who submit popup forms or write in the chat on those websites.
Categories of personal data	Pseudonymous visitor ID generated from technical characteristics of the browser and kept in local storage; browser, operating system, device type, screen size, country; pages viewed, referrer, campaign tags and advertising click IDs (not stored if the browser sends Global Privacy Control or Do Not Track); clicks, scrolling, mouse movement, time on page, page errors; session recordings as a reconstruction of the page and actions, with typed values masked in the browser; which form fields were used, without their content; order ID, value and products reported by the website; data the visitor submits in popups and chat, such as name, email, phone and message.
IP addresses	Processed only at the moment of the request, to determine the country and to apply the Client's list of excluded IP addresses. Not stored with clicks, scrolling, traffic data or session recordings.
Sensitive data	Not intended. The Client must not send special categories of data (Article 9 GDPR) to Plerdy and should mark such page elements as `data-sensitive` so that they are not recorded.
Frequency	Continuous, while the Plerdy code is installed on the Client's website.
Nature and purpose	Collection, storage, analysis and display of website usage data to the Client: heatmaps, session recordings, form analytics, popups and chat, events, funnels, traffic sources, sales performance, SEO tools and alerts. Plerdy does not use the data for its own purposes and does not sell it.
Retention	The data history period of the Client's plan; session recordings according to the Client's settings. Deleted within 30 days after the Client deletes the website or the account.
Transfers to subprocessors	As listed in Annex 3, for the purposes stated there, for the duration of the service.

Annex 2. Technical and organisational measures

Hosting: servers, databases and session-recording storage in Germany, in ISO/IEC 27001-certified data centres.
Encryption in transit: TLS for all traffic; a content delivery network with protection against attacks.
Data minimisation in the browser: values typed into form fields are masked before sending; password, email, phone, name and address fields are always masked; elements marked data-sensitive, data-payment or data-private are not recorded; session recordings are not video or screenshots.
IP addresses: not stored in tracking data (see Annex 1).
Privacy signals: no data is collected from browsers that send Global Privacy Control or Do Not Track.
Separation: data of each Client is kept separately and is not combined with data of other Clients.
Access control: access to production systems and data only for authorised team members who need it; personal accounts; client passwords stored as salted one-way hashes (bcrypt); optional two-step login with a one-time code by email; limits on repeated failed logins.
Code integrity: the tracking script is built automatically from version-controlled source code and is not edited by hand on servers.
Retention: automatic deletion of session recordings according to the Client's settings; automatic deletion of other visitor data after the data history period of the plan.
People: confidentiality obligations; training on phishing and incident reporting.
Incidents: a documented process to contain, investigate and fix incidents and to notify Clients as described in section 8.

Annex 3. Subprocessors

Subprocessor	Purpose	Location
Hetzner Online GmbH	Servers, databases and storage of session recordings	Germany
Cloudflare, Inc.	Content delivery, encryption and protection against attacks for all traffic	Global network; USA
Google (Google Ireland Limited / Google LLC)	Sending service emails, including popup and chat submissions sent to the Client	Ireland; USA
OpenAI, L.L.C.	AI features, only when the Client uses them	USA

Payments are processed by Paddle as merchant of record and AppSumo for AppSumo packages. They receive only Client account and billing data, not Client Personal Data.