Data Processing Agreement (GDPR)

Under Article 28 GDPR · Trackless service · version 1.3 · effective from 1 July 2026

Introductory provisions

This Data Processing Agreement (the "Agreement") governs processing of personal data under Article 28 of Regulation (EU) 2016/679 (GDPR) between:

Controller - the operator of a website or e-shop using a Trackless integration (in particular a PrestaShop module, WordPress/WooCommerce plugin, OpenCart, Magento 2, Shopware 6, Sylius or Joomla / VirtueMart module, the t.js tracking JavaScript or custom API integration) and submitting data to the Trackless analytics application;
Processor - Dominik Ulrich, Company ID 74729381, VAT ID CZ9005173595, registered office K Blahobytu 1699, 530 02 Pardubice, Czech Republic, operator of Trackless.cz and the analytics application available at trackless.cz (the "Application").

This Agreement becomes effective when the Controller accepts the Terms of Service or this Agreement and activates data transmission to the Application; at the latest upon the first successful submission of personal data to the Application. Submitting data through an integration or API is a documented instruction of the Controller.

1. Subject matter and purpose of processing

The Processor processes personal data solely for the Controller and solely for the purpose of providing web analytics: traffic measurement, traffic sources, visitor behaviour, content performance, orders, revenue, margin, campaigns and related reports. The Processor does not process the data for its own marketing, advertising or other independent purposes.

2. Nature and duration of processing

Nature: receiving data through an integration or API, request verification, storage, organisation, analysis, aggregation, display in the Application, export and technical backup.
Duration: data at the level of individual visits and events (IP address fingerprint, pseudonymous visitor identifier, device data and individual events) is erased automatically no later than 180 days after it is recorded; thereafter only aggregated statistics (daily summaries) remain, which do not identify specific persons and from which reports are compiled. Records of orders and revenue are retained for the duration of the Controller's use of the Service and further for the period necessary to fulfil accounting and tax obligations. After the Service ends, the procedure under Article 10 applies (export, erasure and expiry of technical backups).

3. Categories of data subjects

Website visitors, e-shop customers, registered e-shop users and persons whose activity or order is submitted by the Controller to the Application.

4. Categories of personal data

Pseudonymous and minimised data submitted by the Controller through an integration or API are processed, together with the necessary technical context of the incoming request. Where the t.js tracking JavaScript is deployed, the visitor's browser sends the data directly to the Application; the Application therefore processes the IP address and server geo headers when receiving the request, transiently, to derive a one-way fingerprint, protect the endpoint, exclude own traffic and determine the country. The IP address is not stored in analytics data in its original form. The data comprises in particular:

pseudonymous visitor identifier - a one-way fingerprint used to distinguish a visitor for measurement; typically rotates daily and is not intended to directly identify a person;
IP address fingerprint - a salted or otherwise pseudonymised hash of the IP address created by the integration or the Application; for server-side integrations the raw IP address is normally not submitted to the Application, while with the t.js tracking JavaScript it is part of the HTTP request to the Application and is processed only transiently; it is not stored in analytics data in its original form;
traffic source and attribution - referrer, UTM parameters, gclid/fbclid, landing URL, channel, source, medium, campaign, session and related attribution data;
device context - device type, browser, operating system, country, language and similar technical data; device type, browser and operating system are derived by the Application from the User-Agent header forwarded by the integration - it is normally used to derive these values and detect bots without long-term storage in its original form; during technical diagnostics of bot classification it may be stored briefly as a limited sample without IP address, URL, visitor ID or session ID, typically for no more than 14 days;
network behind server traffic - for visits assessed as coming from a datacentre, cloud or VPN, the numeric identifier of that network (ASN) is stored, so that such an assessment can be evidenced afterwards and any mistake corrected; it identifies the operator of a network rather than a person, and is coarser than the country the Application stores routinely. For visits from ordinary consumer and mobile networks it is not stored at all - those networks are excluded from the server-range database;
order data without direct identifiers - internal numeric order, customer or cart IDs, order status, amounts, currency, shipping, payment method, coupon, products, categories, references, quantities and wholesale prices used to calculate margin;
behaviour events - page, product and category views, cart actions, checkout, search, registration or login as event type, URL, referrer and other events submitted by the Controller.

The Controller must configure the integration so that it does not submit names, e-mails, phone numbers, postal or billing addresses, payment data, notes containing personal content, or special categories of personal data under Article 9 GDPR. This also applies to free-form fields, especially URLs, referrers, search queries, coupon codes, campaign names and custom events.

If the Controller submits a direct identifier or excessive data contrary to this Agreement or documentation, the Controller is responsible for that submission; the Processor processes it only as a technical recipient of the instruction and may require remediation, restrict such data intake or erase the data.

5. Controller's obligations

Determine the purpose and legal basis of processing, fulfil information duties towards data subjects and assess the processing in the context of the Controller's website, e-shop and other tools.
Submit only data necessary for web analytics and not submit direct identifiers or special categories of data.
Protect the API key, read-only tokens and Application access, and report suspected compromise without undue delay.
Ensure that persons with access to the Application are authorised to work with the Controller's data.

6. Processor's obligations (Article 28(3) GDPR)

The Processor:

a) processes personal data only on documented instructions from the Controller, including this Agreement, the Terms of Service, Application settings and data submitted via integrations or API;
b) informs the Controller if, in the Processor's opinion, an instruction infringes GDPR or other data protection law;
c) ensures that authorised persons are bound by confidentiality or a statutory duty of confidentiality;
d) implements appropriate technical and organisational measures under Article 32 GDPR - see Article 7;
e) engages subprocessors only under Article 8;
f) assists the Controller with data subject requests under Articles 12-23 GDPR to the extent possible given the pseudonymous nature of the data and available identifiers;
g) assists the Controller with compliance with obligations under Articles 32-36 GDPR, particularly regarding security, incident notification and impact assessment, where relevant given the processing;
h) erases or returns personal data after the end of the Service under Article 10;
i) provides information necessary to demonstrate compliance and enables reasonable inspection under Article 8.

7. Technical and organisational measures (Article 32 GDPR)

minimisation and pseudonymisation at the integration and API level; direct identifiers are not required for standard operation of the Service;
cookieless measurement - for server-side modules directly on the e-shop server, for hosted platforms via a lightweight browser snippet; in both cases Trackless does not store its own analytics cookies or similar measurement identifiers in the visitor's browser (incl. localStorage/sessionStorage) for analytics, nor does it read such identifiers from the browser;
encrypted transfer via HTTPS and HMAC-SHA256 signing of ingest batches using a shared key;
separation of Controller data in a multi-tenant application and access control through user accounts;
restricted access to production data to authorised persons and only to the extent necessary;
monitoring, logging, backup and recovery to support availability, integrity and resilience; operational, security and diagnostic records may contain IP address or User-Agent in a limited scope (for example server logs or the internal ingest audit log available to administrators), are separate from reporting analytics data and are used for operation, endpoint protection, diagnostics and incident handling;
processing in the EU and no transfer of analytics data outside the EU/EEA under Article 11.

8. Subprocessors, changes and audit

The Controller grants the Processor general authorisation to engage subprocessors necessary for operation of the Service. The server and database infrastructure, including operational backups, is provided by Hetzner Online GmbH as a subprocessor; the data is stored on servers in Germany within the EU. The Service and access to the Application continue to be managed by the Processor under the OpenServis brand. Any further subprocessors necessary for operation (e.g. backup or network services in the EU) and their current list are provided by the Processor to the Controller on request sent to info@trackless.cz. The optional AI audit feature sends aggregated data to an AI service chosen by the Controller (e.g. OpenAI, Anthropic, Google) on the Controller's instruction and under the Controller's own API key; this is a separate decision of the Controller, not a standard subprocessor engaged by the Processor. The Controller is responsible for the choice of AI service, the legal basis, the contractual arrangements with the chosen AI service, any transfer outside the EU/EEA, and for not entering into the feature or designating for sending any direct personal identifiers or data groups so small or specific that they would enable re-identification; this does not affect the Processor's obligations in the technical execution of the Controller's documented instruction under this Agreement.

The Processor ensures that subprocessors are bound by data protection obligations corresponding to this Agreement. If a subprocessor fails to fulfil its data protection obligations, the Processor remains fully liable to the Controller for the performance of that subprocessor's obligations (Article 28(4) GDPR). The Processor informs the Controller of intended material subprocessor changes by e-mail, in the Application or on the website and allows the Controller to object. If the parties do not resolve the objection, the Controller may terminate the affected use of the Service.

The Processor provides information necessary to demonstrate compliance and allows a reasonable audit generally no more than once per year; beyond that also in the event of a reasonable suspicion of a security incident concerning the Controller's data, a reasonable suspicion of a breach of this Agreement in the area of personal data protection, or on the basis of a documented request from a supervisory authority. The audit takes place with at least 14 days' prior notice (unless a shorter period is justified by a security incident or a supervisory authority request), during business hours and in a manner that does not disrupt the Service, security or data of other controllers. The Controller bears costs of a broader audit unless agreed otherwise.

9. Assistance and personal data breach

The Processor provides reasonable assistance with data subject requests, especially export, lookup or erasure based on available pseudonymous identifiers. Because the Service does not normally work with direct identifiers, some requests may be possible only with the Controller's assistance.

As soon as the Processor becomes aware of a personal data breach concerning the Controller's data, it notifies the Controller without undue delay. The notice includes the information available to the Processor at that time, in particular the nature of the incident, affected data, likely consequences and measures taken or proposed; if not all information is available at once, it may be provided in phases without further undue delay.

10. Termination, export and erasure

After the Service ends, the Processor returns personal data by available export or erases it according to the Controller's choice, usually within 30 days after termination, unless a legal obligation or legitimate need to protect rights prevents this. Operational backups may contain copies for the period necessary for recovery, usually no longer than 14 days, and are then overwritten.

Termination of this Agreement does not affect data for which the Processor (acting as the Provider under the Terms of Service) acts as an independent controller, especially billing, accounting, contractual and security records maintained for the Controller's account.

11. Place of processing and transfers to third countries

Personal data submitted to the Application is processed within the European Union. The Processor does not transfer analytics data outside the EU/EEA unless instructed by the Controller or required by law; in such case, appropriate GDPR mechanisms apply.

12. Liability and final provisions

This Agreement is governed by Czech law and GDPR.
Matters not regulated by this Agreement are governed by the Trackless.cz Terms of Service.
The Processor may reasonably amend this Agreement due to changes in the Service, legal requirements, security requirements or technical operation; the Controller will be informed of material changes in an appropriate manner.
Version 1.3, effective from 1 July 2026; revision of 3 July 2026 (clarifications without substantive reduction of the Controller's rights).