Legal

Data Processing Agreement

Last updated: 29 September 2026

This Data Processing Agreement (the "DPA") forms part of, and is incorporated into, the Tellmetric Terms of Service. By creating an account and accepting our Terms of Service, you accept this DPA. Where the Customer requires a counter-signed copy, please ask through the contact form or write to info@tellmetric.com.

1. Parties

This DPA is entered into between:

Tellmetric, the operator of the Tellmetric service (the "Processor"); and
the customer who has registered for and is using the Tellmetric service (the "Controller" or "Customer").

Each a "Party" and together the "Parties".

Company: Tellmetric
Responsible person: Volodymyr Yurkov
Address: Naritaweg 165, 1043 BW Amsterdam, Netherlands
KvK (Dutch Chamber of Commerce) number: 99455242
VAT identification number: NL005387124B49
Email: info@tellmetric.com · contact form

2. Background and purpose

The Customer has subscribed to the Tellmetric service (the "Service"), which provides marketing analytics, conversion tracking and ad attribution for the Customer's website visitors and Telegram audience, and delivers conversion events to the ad platforms the Customer connects. In providing the Service, the Processor processes Personal Data on behalf of the Customer. This DPA sets out the terms governing that processing in accordance with Article 28 of the EU General Data Protection Regulation 2016/679 ("GDPR") and, where applicable, the UK GDPR.

In the event of conflict between this DPA and the Terms of Service, this DPA prevails for matters of data protection.

3. Definitions

Capitalised terms not defined here have the meaning given in the GDPR. "Personal Data", "Processing", "Controller", "Processor", "Sub-processor", "Data Subject" and "Personal Data Breach" have the meanings given in Articles 4 and 28 GDPR.

4. Subject matter, duration, nature and purpose of the Processing

Item	Details
Subject matter	Processing of Personal Data necessary to provide the Service.
Duration	The term of the Customer's subscription to the Service, plus the retention and deletion periods set out in Section 12.
Nature and purpose	Collection, storage, organisation, retrieval, transmission and deletion of visit, click, Telegram interaction and conversion data for the purpose of providing marketing analytics, ad attribution and conversion delivery to the ad platforms and endpoints the Customer configures.
Categories of Data Subjects	Visitors to the Customer's websites and landing pages; people who click the Customer's tracking links; members and users of the Telegram channels, groups, bots and Mini Apps the Customer has connected to the Service; people whose conversions the Customer reports to the Service.
Categories of Personal Data	Pseudonymous visitor and click identifiers; IP address (removed after 30 days); country code at country-level granularity; browser user-agent (removed after 30 days); referrer URL; page URL; UTM and placement parameters; ad click identifiers (fbclid, fbc, fbp, ttclid, gclid, gbraid, wbraid); Telegram user id, username and first name; email address, phone number or name voluntarily shared in a message, form, Mini App or conversion report (hashed before delivery to an ad platform); event metadata such as group joins and leaves, message events, link clicks, sign-ups, leads, deposit and payment events with value and currency; timestamps.
Special categories	None intended. The Customer shall not submit special-category data (Art. 9 GDPR) or data of children to the Service.

5. Roles of the Parties

The Customer is the controller of the Personal Data processed via the Service. The Processor is a processor acting on behalf of the Customer and shall process Personal Data only on the Customer's documented instructions, including those set out in this DPA, the Terms of Service, and the Customer's configuration of the Service (the platforms connected, the events enabled, the endpoints set and the data reported).

The Processor shall immediately inform the Customer if, in its opinion, an instruction infringes the GDPR or other applicable data-protection law.

The ad platforms to which the Processor delivers conversion events on the Customer's instruction (Meta, TikTok, Google) act as independent controllers of the data they receive, under the Customer's direct agreements with them.

6. Customer's obligations

The Customer represents and warrants that it has a valid legal basis (including, where required, valid consent) for the Processing of Personal Data through the Service. The Customer is responsible for:

providing all required notices to Data Subjects (for example in its privacy policy and cookie or consent banner);
collecting and managing any required consents;
the accuracy and lawfulness of the conversion data it reports to the Service;
accepting the customer-data terms each ad platform requires before hashed identifiers are delivered;
responding to Data Subject requests, except for the Processor's assistance obligations under Section 10; and
ensuring that its use of the Service complies with applicable law.

7. Processor's obligations

The Processor shall:

process Personal Data only on the Customer's documented instructions, except where required to do so by Union or Member-State law (in which case the Processor shall inform the Customer of that legal requirement before Processing, unless prohibited by law);
ensure that persons authorised to process Personal Data are bound by confidentiality obligations of a comparable standard to this DPA;
implement appropriate technical and organisational measures as set out in Annex II ("TOMs") to ensure a level of security appropriate to the risk;
assist the Customer, taking into account the nature of the Processing, with appropriate technical and organisational measures, in fulfilling its obligations to respond to Data Subject requests and to comply with Articles 32 to 36 GDPR;
at the choice of the Customer, delete or return all Personal Data after the end of the provision of the Service, in accordance with Section 12; and
make available to the Customer all information necessary to demonstrate compliance with Article 28 GDPR.

8. Sub-processors

The Customer grants the Processor general written authorisation to engage Sub-processors for the provision of the Service. The list of current Sub-processors is set out in Annex III below.

The Processor shall:

impose written contractual obligations on each Sub-processor that are no less protective than those in this DPA;
remain fully liable to the Customer for the performance of each Sub-processor's data-protection obligations; and
notify the Customer in advance of any intended addition or replacement of a Sub-processor, giving the Customer at least thirty (30) days to object on reasonable data-protection grounds. If the Customer objects and the Parties cannot agree a resolution, the Customer may terminate the affected portion of the Service.

9. International transfers

The Processor shall not transfer Personal Data outside the European Economic Area or the United Kingdom unless an appropriate transfer mechanism is in place, including:

an adequacy decision under Article 45 GDPR;
the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) and, for UK transfers, the UK International Data Transfer Addendum, which are incorporated into this DPA by reference and apply automatically to any such transfer; or
another lawful transfer mechanism under Chapter V GDPR.

Where the EU SCCs apply, the Parties agree that Module Two (Controller-to-Processor) applies between the Parties; Module Three (Processor-to-Sub-processor) applies between the Processor and any non-EEA Sub-processor; the optional docking clause is included; Clause 7 governs disputes; Clause 11(a) independent dispute resolution is not included; and the Annexes to the SCCs are completed by reference to Annexes I to III of this DPA.

Deliveries of conversion events to Meta, TikTok and Google are transfers instructed by the Customer to independent controllers, governed by the Customer's own agreements with those platforms.

10. Assistance with Data Subject requests, DPIAs and authority enquiries

Taking into account the nature of the Processing, the Processor shall provide reasonable assistance to the Customer, by appropriate technical and organisational measures, to fulfil the Customer's obligations to respond to requests from Data Subjects exercising their rights under Chapter III GDPR (including access, rectification, erasure, restriction, portability and objection). The dashboard's exports and record details, and deletion of links, forms and workspaces, are available to the Customer directly.

The Processor shall, on request and where strictly necessary, assist the Customer with:

data-protection impact assessments (Art. 35 GDPR);
prior consultations with supervisory authorities (Art. 36 GDPR); and
responses to requests or investigations by supervisory authorities.

The Processor may charge a reasonable fee for assistance that exceeds standard support, except where the assistance is required because of the Processor's own non-compliance.

11. Personal Data Breaches

The Processor shall notify the Customer of a confirmed Personal Data Breach affecting the Customer's Personal Data without undue delay and in any event within seventy-two (72) hours of becoming aware of it.

The notification shall include, to the extent then known: the nature of the Breach; the categories and approximate number of Data Subjects and records affected; the likely consequences; and the measures taken or proposed to address the Breach and mitigate its effects. The Processor shall reasonably cooperate with the Customer in investigating and remediating the Breach.

12. Return or deletion of data

Upon termination or expiry of the Service, the Processor shall, at the Customer's choice, delete or return all Personal Data processed on behalf of the Customer, and delete existing copies, unless Union or Member-State law requires storage of the Personal Data. Return is provided as CSV exports of the Customer's events, links, forms, members and activity log, available from the dashboard until deletion.

Unless the Customer instructs otherwise, the Processor shall delete the Customer's Personal Data within thirty (30) days of termination. Backup copies will be deleted in accordance with the Processor's standard backup-rotation cycle, not exceeding thirty-five (35) days thereafter.

During the Service, the Processor applies the following automatic limits: raw IP addresses and user-agent strings are removed from events after 30 days; landing-page visits are deleted after 90 days; the activity log is kept for 12 months.

13. Audits

The Processor shall make available to the Customer all information reasonably necessary to demonstrate compliance with Article 28 GDPR.

The Customer may, no more than once per twelve (12) month period (and at any time following a Personal Data Breach affecting the Customer), audit the Processor's compliance with this DPA. The Processor may satisfy this obligation by providing:

up-to-date third-party certifications or audit reports of its hosting and payment Sub-processors; or
responses to a reasonable written security questionnaire.

An on-site audit, where strictly necessary and not satisfied by the above, shall be conducted on at least thirty (30) days' written notice; at the Customer's expense; by the Customer or an independent auditor (not a competitor of the Processor) bound by confidentiality; and carried out so as not to disrupt the Processor's operations or compromise the confidentiality of other customers' data.

14. Liability

The liability of each Party under this DPA shall be subject to the limitations and exclusions of liability set out in the Tellmetric Terms of Service. Nothing in this DPA limits liability that cannot be limited under applicable law.

15. Term and termination

This DPA takes effect when the Customer accepts the Terms of Service and continues for as long as the Processor processes Personal Data on behalf of the Customer. Sections 12 (deletion and return), 13 (audits) and any other provisions intended to survive termination shall survive.

16. Governing law and order of precedence

This DPA is governed by the same law and jurisdiction as the Tellmetric Terms of Service, without prejudice to any mandatory rights of Data Subjects under the GDPR.

In the event of conflict between (i) the EU SCCs, (ii) this DPA, and (iii) the Terms of Service, the order of precedence is: (i) over (ii) over (iii).

17. Contact

Questions, deletion requests, sub-processor objections and requests for a counter-signed copy of this DPA should be sent to info@tellmetric.com or through the contact form.

Annex I — Description of the Processing

A. Parties

As set out in Section 1.

B. Description of Transfer

Categories of Data Subjects: visitors to the Customer's websites and landing pages; people who click the Customer's tracking links; users of the Customer's Telegram channels, groups, bots and Mini Apps connected to the Service; people whose conversions the Customer reports.
Categories of Personal Data: pseudonymous visitor and click identifiers; IP address; country code at country-level granularity; browser user-agent; referrer; page URL; UTM and placement parameters; ad click ids (fbclid, fbc, fbp, ttclid, gclid, gbraid, wbraid); Telegram user id, username and first name; email address, phone number or name voluntarily shared; event metadata (joins, leaves, message events, link clicks, sign-ups, leads, deposit and payment events with value and currency); timestamps.
Special-category data: none.
Frequency of transfer: continuous, for the duration of the Service.
Nature of Processing: collection, storage, structuring, retrieval, analysis, transmission and deletion to provide marketing analytics, ad attribution and conversion delivery.
Purpose: provision of the Service to the Customer.
Retention period: for the duration of the Service plus the deletion period in Section 12, subject to the automatic limits stated there.
Onward transfers: to Sub-processors listed in Annex III, under the safeguards in Section 9; and, on the Customer's instruction, to the ad platforms and endpoints the Customer connects.

C. Competent Supervisory Authority

The supervisory authority of the EEA Member State in which the Customer is established, or, where the Customer is not established in the EEA, the supervisory authority of the EEA Member State chosen in accordance with Clause 13 of the SCCs. For the Processor, the Autoriteit Persoonsgegevens (Netherlands).

Annex II — Technical and Organisational Measures (TOMs)

The Processor implements at least the following measures:

Access control: role-based access to workspaces (owner, admin, editor, viewer); operator access to customer data is limited, re-authenticated and logged; least-privilege access to production systems with key-based authentication.
Encryption: TLS 1.2+ for data in transit; encryption at rest for the production database and backups; customer-supplied credentials (bot tokens, access tokens, OAuth grants) encrypted with authenticated symmetric encryption; API keys stored as hashes; passwords stored as bcrypt hashes; email addresses and phone numbers hashed with SHA-256 before delivery to ad platforms.
Network and application security: segregated production environment behind a reverse proxy with automatic TLS; strict Content Security Policy, CSRF protection and signed session cookies; rate limiting and input validation on public endpoints; outbound requests restricted from private networks; protection against the OWASP Top 10 risks.
Logging and monitoring: application and access logs with request ids, retained 14 days; a workspace activity log of every change; heartbeat monitoring of the delivery worker; alerting on failures.
Backups and resilience: automated daily database backups with documented retention and periodic restore testing; migrations that keep an older release deployable.
Data minimisation and pseudonymisation: visitors are identified by a randomly generated pseudonymous identifier; raw IP addresses and user agents are removed after 30 days; landing-page URLs keep only campaign and click parameters.
Confidentiality: staff and contractors bound by written confidentiality obligations.
Sub-processor management: written contracts with all Sub-processors; due-diligence review before engagement.
Incident response: documented breach-response procedure with the notification timeline in Section 11.
Deletion: self-service deletion of links, forms, workspaces and accounts; documented procedures for deletion on termination or on Data Subject request.

The Processor reviews these measures regularly and may update them, provided the level of protection is not reduced.

Annex III — Approved Sub-processors

The Customer authorises the following Sub-processors as of the Effective Date. The Processor will publish updates to this list on this page.

Sub-processor	Service provided	Location of Processing
Hetzner Online GmbH	Application and database hosting, backups	European Union (Germany / Finland)
Stripe Payments Europe Ltd.	Payment processing and invoicing for Customer subscriptions (customer account data only)	Ireland (EU) / United States under SCCs
Telegram Messenger Inc.	Bot API through which group, bot, Mini App and payment interactions are received	Per Telegram's published terms
Transactional email provider (named here once contracted)	Account, billing and contact-form emails to Customers	European Union / United States under SCCs

Note: Meta, TikTok, Google and similar advertising platforms to which the Customer transmits conversion events via their server-side APIs are independent controllers of that data, not Sub-processors of Tellmetric. Their handling of that data is governed by the Customer's direct relationship with each platform. The same applies to any tracker or server the Customer sets as an outbound postback destination.

For any questions about this DPA, contact info@tellmetric.com.