Data Processing Agreement

This agreement between you (the customer, controller) and Bilgesam LLC (processor) forms part of the Terms of Service. We process analytics data collected on your websites only on your documented instructions to provide the service (GDPR Art. 28, UK GDPR, KVKK md. 12, and as a service provider under US state privacy laws).

Page address, referrer host, UTM parameters, country, device, browser and operating system, custom event names and properties you send, and a daily-rotating visitor hash; for the live map only, the approximate city (rounded to about 10 km), kept in the live view and not stored. No IP addresses, no cookies, no cross-site identifiers. Duration: the term of your subscription plus the retention period.

Confidentiality of personnel; security measures (tenant isolation on every query, encryption in transit, secrets encrypted at rest, role-based access, two-step verification for administrators); assistance with data subject requests and impact assessments; notification of a personal data breach without undue delay and in any case within 72 hours of becoming aware of it.

EU hosting and database provider and our transactional email provider; api14.com only for AI analysis you initiate with your own account, receiving aggregated numbers only. We notify you of new sub-processors at least 30 days in advance; you may object and terminate if we cannot accommodate the objection.

Bilgesam LLC is a US company. Where personal data from the EEA, the UK or Switzerland is accessed from or transferred to a country without an adequacy decision, the EU Standard Contractual Clauses (Module 2, controller to processor; Module 3 where you are a processor) are incorporated by reference, with the UK Addendum where applicable; the clauses are governed by the law of Ireland. For Türkiye, transfers rely on KVKK md. 9 safeguards.

We make available the information necessary to demonstrate compliance and answer reasonable written audit questionnaires once a year, or after a breach.

Data is deleted automatically at the end of your plan’s retention period, immediately when you delete a site’s data, and with your workspace. Before deletion you can export it with Export CSV or the stats API.

Cookieless tracking does not remove your own transparency duties: describe the measurement in your privacy notice and assess whether consent is required in your jurisdiction.