Back to home
Thank you for choosing Litlyx Analytics! We are dedicated to maintaining the privacy, security,
and integrity of your data in accordance with the most stringent data protection regulations,
including the General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA),
and Privacy and Electronic Communications Regulations (PECR).
This DPA serves as an addendum to the Terms of Service between Litlyx Analytics and you, the customer, and outlines our mutual responsibilities for processing personal and non-personal data in relation to the use of our analytics service. By using our services, you agree to the terms outlined in this DPA.
To ensure clarity, this DPA defines several key terms:
• “Customer” or “Controller” refers to the organization, company, or individual that subscribes to Litlyx Analytics services and controls the data.
• “Litlyx Analytics” or “Processor” refers to the service provider responsible for processing data on behalf of the customer.
• “Data Protection Legislation” refers to all applicable laws governing data protection and privacy, including the GDPR, CCPA, PECR, and any other relevant jurisdiction-specific laws.
• “Personal Data” means any information relating to an identified or identifiable natural person.
• “Processing” refers to any operation performed on data, whether automated or not, including collecting, storing, organizing, altering, or erasing such data.
• “Subprocessor” refers to any third-party service provider used by Litlyx Analytics to assist with processing data on behalf of the customer.
• “Data Breach” refers to any breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data.
This DPA governs the processing of all data (whether personal or non-personal) collected and processed by Litlyx Analytics on behalf of the customer as part of providing analytics services. This agreement is effective for the entire period the customer uses Litlyx Analytics services, and it automatically terminates upon the cessation of service unless explicitly stated otherwise.
Litlyx Analytics is designed as a privacy-conscious analytics platform. As such, we intentionally avoid the collection of personal data whenever possible, focusing instead on anonymous and aggregated data to deliver valuable insights about website traffic. The primary purpose of processing this data is to provide you with analytics that help monitor website performance, user behavior, and general trends.
The types of data we process include, but are not limited to:
• Page URLs: We track the specific pages visited on your website to determine page popularity and user behavior.
• HTTP Referrers: This helps identify the source of your website traffic by noting the referring website.
• Browser and Operating System Information: Basic details on visitors' browser and OS help assess how visitors interact with your site, ensuring compatibility and performance optimization.
• Device Type: We categorize whether a visitor uses a desktop, mobile, or tablet device.
• Geolocation: We identify only the country or region of visitors based on their IP address, which is anonymized immediately upon collection.
Importantly, Litlyx Analytics does not collect personal data, persistent identifiers, or cookies. All data processed is anonymized and aggregated, ensuring that no data can be linked to an identifiable individual.
• Customer (Data Controller): As the data controller, the customer is responsible for determining the purpose and legal basis for collecting and processing data. The customer must ensure compliance with applicable data protection laws, including providing the necessary disclosures and obtaining any required consents from data subjects.
• Litlyx Analytics (Data Processor): As the data processor, Litlyx Analytics processes data solely according to the customer’s instructions, as outlined in this DPA and the Terms of Service. We commit to ensuring that all data processing activities are carried out in compliance with GDPR and other applicable regulations, prioritizing the privacy and security of the data processed on behalf of the customer.
At Litlyx Analytics, we employ rigorous security measures to protect the data entrusted to us. These measures include:
• Data Encryption: All data is encrypted both in transit (using HTTPS) and at rest, preventing unauthorized access during transmission and storage.
• Data Anonymization and Minimization: We use hashing techniques to anonymize sensitive data points, such as IP addresses and User-Agent strings. No raw IP addresses are stored. We apply a daily salt to ensure data cannot be linked across sessions or days, further protecting visitor privacy.
• Secure Hosting Environment: All data is securely hosted on Hetzner servers located in Nuremberg, Germany. These servers are powered by 100% renewable energy and comply with strict European Union data protection laws.
• Access Controls: Access to customer data is restricted to authorized personnel only, all of whom are trained in data protection protocols. We implement role-based access controls and ensure that sensitive data can only be accessed by individuals who need it to provide support or maintain the service.
• Backups and Data Replication: Regular backups are taken to ensure data availability in case of a disaster. These backups are encrypted and stored securely within the European Union.
Litlyx Analytics uses a limited number of subprocessors to facilitate the delivery of our services. These subprocessors are subject to rigorous data protection assessments and are bound by contractual agreements that enforce the same level of privacy protection as outlined in this DPA. The key subprocessors we work with include:
• Hetzner Online GmbH (Germany): Provides secure server hosting for all data, ensuring compliance with EU data protection laws.
• MongoDB, Inc. (United States): Provides secure database hosting and management. MongoDB adheres to strict data protection standards, with data stored in compliance with relevant privacy regulations. We use our self-hosted version of MongoDB hosted on hetzner servers.
• Stripe, Inc. (United States): Handles payment processing for Litlyx Analytics. Stripe is GDPR-compliant and ensures secure transactions and fraud prevention.
• Google LLC (United States): Manages authentication services through Google Auth, allowing secure user login. Google Auth follows stringent data protection standards, including GDPR compliance.
• Brevo SAS (formerly Sendinblue) (France): Manages email communication services. Brevo ensures that all data processing for email campaigns adheres to GDPR and other privacy regulations.
We will inform you of any changes to our subprocessors and provide you with the option to object if necessary. Any objection must be based on legitimate grounds relating to data protection.
In the event that Litlyx Analytics becomes aware of a data breach involving customer data, we will notify you without undue delay and, in any event, within 48 hours of becoming aware of the breach. This notification will include:
• A detailed description of the breach and its nature.
• The likely consequences of the breach.
• The measures we have taken or plan to take to mitigate the breach and prevent future occurrences.
We will provide ongoing updates as more information becomes available, and we will assist you in meeting any legal obligations related to the breach, including notification to relevant supervisory authorities and data subjects where required.
As the data controller, the customer is responsible for addressing data subject requests (e.g., access, correction, deletion). However, Litlyx Analytics is committed to assisting you in responding to such requests whenever applicable. Although we do not process personal data directly, we will support you in ensuring compliance with GDPR, CCPA, or other applicable data protection laws by ensuring data is handled securely and anonymized effectively.
Data processed by Litlyx Analytics is retained for as long as necessary to provide the services specified in the agreement. Once your account is terminated or you issue a request for data deletion, we will follow the data deletion procedures outlined below:
• Account Deletion: All data, including backups, will be permanently deleted from our servers within 60 days.
• Deletion of Specific Data: If you request the deletion of specific data, we will execute this request in compliance with GDPR or applicable regulations.
Once deleted, the data cannot be recovered, as we do not store any backup copies beyond this retention period.
The customer, as the data controller, agrees to:
• Comply with all applicable data protection laws, including the obligation to provide adequate privacy notices to data subjects and obtain any necessary consents where required.
• Ensure that any data provided to Litlyx Analytics is lawfully obtained and processed.
• Ensure that its use of Litlyx Analytics services does not violate any applicable laws or regulations.
The customer is solely responsible for determining the lawful basis for processing visitor data, whether that basis is consent, legitimate interest, or other grounds under applicable laws.
Both parties agree to indemnify and hold each other harmless from any claims, damages, or losses arising from a breach of this DPA. Litlyx Analytics shall not be liable for any indirect or consequential damages, including loss of profits, resulting from the processing of customer data, except where required by law.
This DPA will automatically terminate upon the end of the customer’s relationship with Litlyx Analytics, either through account deletion or termination of services. Upon termination, all customer data will be permanently deleted in accordance with the data retention policy specified in this DPA.
This DPA is governed by the laws of the European Union and any relevant Member State laws. Any disputes arising under this agreement shall be subject to the exclusive jurisdiction of the courts of the European Union or the applicable national courts of the Member State in question.
If you have any questions, concerns, or requests related to this DPA, data protection, or the services provided by Litlyx Analytics, please contact privacy@litlyx.com.
Last updated: September 25, 2024
