Data processing agreement

Agreement on processing on behalf under Art. 28 GDPR for the analytics service Pulselytics · Version November 2026

This is a translation for convenience. Only the German version is legally binding.

1. Parties and conclusion

  1. This agreement applies between the customer of Pulselytics as controller ("controller") and CAN DO IT, Andre Oestreich, Hannoversche Straße 6, 27243 Harpstedt, Germany, as processor ("processor").
  2. It forms part of the contract for the use of Pulselytics under our terms and conditions ("main contract") and is concluded together with it, including for the free trial. No signature is required; the agreement is concluded electronically (Art. 28 (9) GDPR).
  3. In the event of conflicts, this agreement takes precedence over the main contract with regard to the protection of personal data.

2. Subject, duration and nature of processing

  1. On behalf of the controller, the processor measures the use of the websites into which the controller has added the Pulselytics script, analyses the visits and provides the results in the dashboard, through the API and the MCP server, and in reports and notifications.
  2. Processing lasts as long as the main contract and ends with the deletion of the data under clause 10.
  3. Annex 1 describes the nature, purpose, types of data and data subjects.

3. Instructions

  1. The processor processes the data only on documented instructions from the controller, unless required to do so by EU or member state law. In that case, the processor informs the controller of this requirement beforehand, unless the law prohibits this.
  2. The instructions are set out conclusively in the main contract, in this agreement and in the settings the controller makes in the dashboard. The controller gives further instructions in text form, for example by email.
  3. If the processor considers an instruction to be unlawful, they inform the controller without delay. They may suspend its execution until the controller confirms or changes it.

4. Obligations of the processor

  1. The processor processes the data only to provide the services under the main contract. They do not use it for their own purposes and do not pass it on to third parties, except to subprocessors under clause 6.
  2. Persons with access to the data are bound to confidentiality or are subject to a statutory obligation of secrecy.
  3. The processor implements the technical and organisational measures under Art. 32 GDPR described in Annex 2. They may develop these further as long as the level of protection does not decrease.
  4. The processor assists the controller with appropriate measures in responding to requests from data subjects (Art. 12 to 22 GDPR) and with the controller's obligations under Art. 32 to 36 GDPR, in particular notifications of personal data breaches and data protection impact assessments. If a data subject contacts the processor directly, the processor forwards the request to the controller.
  5. If the processor becomes aware of a breach of the security of the controller's data, they inform the controller without undue delay, where possible within 48 hours, and provide the information under Art. 33 (3) GDPR as far as it is available to them.
  6. The processor is not legally required to appoint a data protection officer. The contact for data protection is Andre Oestreich, info@can-do.it.

5. Obligations of the controller

  1. The controller is responsible for the lawfulness of the processing, in particular for the legal basis of the measurement on their websites and for informing visitors in their privacy policy.
  2. The controller does not transmit any data beyond Annex 1. In particular, they do not write names, email addresses or other directly identifying information into events, page addresses or campaign parameters.
  3. The controller informs the processor without delay if they notice errors or irregularities in the processing.

6. Subprocessors

  1. The controller agrees to the use of the subprocessors listed in Annex 3.
  2. The processor may engage additional subprocessors or replace existing ones. They inform the controller by email at least four weeks in advance. The controller may object to the change for an important reason under data protection law until it takes effect. If the parties cannot agree, the controller may terminate the main contract as of the date the change takes effect.
  3. The processor contractually binds each subprocessor to a level of protection that corresponds to this agreement.
  4. Queries through the API or the MCP server using services the controller selects and connects themselves, such as Claude, ChatGPT or Cursor, are not subprocessing. The controller alone is responsible for this; the data goes to the respective provider at the controller's initiative.

7. Place of processing

The data is processed exclusively in data centres in Germany. Processing outside the EU or EEA only takes place with the controller's prior consent and subject to the conditions of Art. 44 et seq. GDPR.

8. Audits

  1. On request, the processor provides the controller with the information necessary to demonstrate compliance with this agreement.
  2. The controller may carry out audits, including on site, themselves or through an auditor bound to confidentiality. They announce audits with reasonable notice, usually two weeks, and take the processor's operations into account. On-site audits take place at most once a year unless there is a specific reason.
  3. The controller bears the costs of an on-site audit unless it reveals a significant breach by the processor.

9. Liability

Art. 82 GDPR applies to liability. Otherwise, the liability provisions of the main contract apply.

10. Deletion and return

  1. After the main contract ends, the processor keeps the data for another 30 days. During this time, the controller can request an export or continue the contract. After that, the processor deletes all of the controller's data unless there is a legal obligation to retain it.
  2. Copies in backups are overwritten as part of the regular backup cycle.
  3. On request, the processor confirms the deletion in text form.

Annex 1: Subject of processing

Purpose: Measuring reach and analysing the use of the controller's websites.

Data subjects: Visitors to the controller's websites; users to whom the controller gives access to the dashboard, insofar as their data is processed as part of the service.

Types of data:

  • Pages viewed and page titles, source (referrer without query parameters, campaign parameters), time, time on page, scroll depth, triggered events and load times
  • Device type, browser, operating system, screen width and language
  • Country and region (e.g. federal state), determined in memory from the IP address; the city is never determined
  • A hash of the IP address, browser identifier and a daily changing random value, used to group the visits of one day

Not stored: IP addresses, full browser identifiers, cookies or any other identifiers in the browser. The random value is deleted after one day, so visits cannot be linked across days.

Annex 2: Technical and organisational measures

Data minimisation: Measurement works without cookies, without storage in the browser and without recognition across days. IP addresses are only processed in memory and discarded.

Physical access control: The servers are located in data centres of Hetzner Online GmbH in Germany, certified to ISO/IEC 27001, with access control, video surveillance and security staff.

System access control: Only the processor has administrative access to the servers, exclusively over encrypted connections. Dashboard passwords are only stored as hashes; sign-in optionally with passkeys and two-factor authentication.

Data access control: Roles and permissions in the dashboard; users only see the websites of their organisation. Databases are not publicly reachable. Only the processor has access to production data.

Separation: Each controller's data is logically separated and assigned via their organisation and websites. Test and production environments are separate.

Transmission control: All connections to the dashboard, the measurement, the API and the MCP server are encrypted with TLS. Access to the API and MCP server only with a personal key that can be revoked at any time.

Input control: Active sign-ins are stored with time and device; users see them in their settings and can end them. Individual measurement data cannot be edited in the dashboard.

Availability: Regular backups, monitoring of the services and software updates with security patches.

Review: The measures are reviewed and adjusted regularly and whenever the system changes.

Annex 3: Subprocessors

  • Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany: hosting of servers, databases and measurement data
  • ALL-INKL.COM – Neue Medien Münnich, owner René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany: sending emails, such as reports and notifications