Data processing agreement

Draft for legal review. This page is not yet in force and may change before VCTR launches. Text in [brackets] is still to be completed.

This data processing agreement ("DPA") forms part of the terms of service between the customer that owns a VCTR Workspace ("you", the controller) and Crobox Services B.V., trading as Crobox, Kloveniersburgwal 131H, 1011 KD Amsterdam, the Netherlands, registered with the Dutch Chamber of Commerce under number 80401120 ("we", the processor). It applies to personal data we process on your behalf when people follow your Links or scan your QR Codes, as required by Article 28 of the GDPR.

1. Subject matter and duration

We process personal data to redirect visitors to your Destinations and to give you analytics on those redirects (Hits), for as long as you use VCTR and as set out in section 7.

2. Data subjects and personal data

• Data subjects: people who follow your Links or scan your QR Codes ("visitors").
• Received with each request: IP address, user agent, preferred languages, referrer and time.
• Stored: the time, the Link and Destination; country, region, city and time zone; coordinates rounded to two decimals (about one kilometre); device type, operating system, browser and bot flag; primary language; referrer host and channel; and a daily visitor hash.
• Not stored: IP addresses. The IP address is used only to derive the location and the daily visitor hash, and is then dropped. Before that, it is held in an internal processing queue for at most 7 days.
• No cookies: the redirect sets no cookies and stores nothing on visitors' devices.
• Daily visitor hash: a SHA-256 hash of a salt that changes every UTC day, the IP address and the user agent, truncated to 8 bytes. The salt is derived from a secret and the date, so the hash recognises a visitor within one day only and cannot be reversed without that secret.
• Special categories: none are intended. [Your obligations if your Destinations or Link names reveal special categories.]

3. Your instructions

We process the data only to provide VCTR as described in the terms and the app's settings, which are your documented instructions, unless the law requires otherwise; in that case we tell you first where the law allows.

4. Security

• Data minimisation by design: no IP addresses stored, no cookies, visitors recognised for one day at most.
• Encryption in transit (HTTPS) for every request, Link and API call.
• Access limited to your Workspace's members, by role, and to API keys you create; staff access only for operations and abuse handling.
• [Encryption at rest, backups, access logging and other measures.]

5. Confidentiality

Everyone at Crobox who can access the data is bound to confidentiality.

6. Sub-processors

You authorise us to use Hetzner Online GmbH, in its Falkenstein data centre in Germany for hosting. Location, device and referrer lookups run on Crobox's own services. We will tell you before adding or replacing a sub-processor, and you may object [notice period and objection procedure].

7. Retention and deletion

• Hits are kept for up to 3 years, and shown to you according to your plan.
• When you delete a Workspace, its Links stop after 30 days. [Deletion of Hits and personal data in Link records after that, and certification of deletion.]
• You can export your data as CSV or JSON at any time before then.

8. Assistance, breaches and audits

• We help you answer data subject requests. Note that because IP addresses are not stored and visitors are not recognised across days, Hits generally cannot be attributed to one person.
• We tell you without undue delay, and within [hours], after becoming aware of a personal data breach affecting your data.
• We make available the information you need to show compliance, and allow audits [audit terms].

9. International transfers

[Where data is processed, and transfer mechanisms if any data leaves the EEA.]