TagAudit

Data Processing Agreement

Last updated 5 August 2026 · Forms part of the Terms of Service

1. Roles

When you submit a website for scanning, you instruct us to capture what that site transmits. Whatever personal data the site leaks into its tracking belongs to that site's visitors. For that data, you are the controller and Edwin OÜ is your processor. You are responsible for having a lawful basis to have the site audited; that is why our Terms require you to own the site or have the owner's permission.

2. What processing this covers

• Subject matter: capturing and reporting what a website transmits during an automated audit scan.
• Duration: for as long as you have an account with us, plus the deletion periods in section 8.
• Nature and purpose: loading the site in a browser, recording network requests, cookies, dataLayer events and page markup, detecting personal data exposed in tracking payloads, masking it, and presenting the findings in your report. Nothing else.
• Types of personal data: whatever the scanned site happens to transmit — typically identifiers in tracking payloads such as email addresses, names, user IDs, IP addresses.
• Categories of data subjects: visitors of the websites you scan.

3. Your instructions

We process this data only on your documented instructions. Submitting a scan is the instruction. We will not use the data for anything except producing your report — not analysis, not enrichment, not training, not sale. If we ever believe an instruction of yours breaks data protection law, we will tell you.

4. Confidentiality

Everyone who works on TagAudit and could access this data is bound by confidentiality obligations.

5. Security

We protect the data with measures appropriate to the risk (Article 32), including: masking identifying values before storage (see our Privacy Policy, section 3), encryption in transit, access controls, and automatic deletion of raw scan artefacts after 30 days. We treat masked evidence as personal data and protect it accordingly.

6. Sub-processors

You give us general written authorisation to use the sub-processors below. We will tell account holders by email at least 30 days before adding or replacing a sub-processor for this data; if you object on reasonable data protection grounds, you may close your account before the change takes effect.

Sub-processor	What for	Where	Scan-artefact data?
Hetzner	Hosting and running the service	EU (Germany)	Yes — hosts everything
Anthropic	Classifying what kind of business a site is and naming page types	United States	No. Receives only page title, headline, meta description, language, currency, detected tool names and the URL — never page HTML, never captured tracking payloads or the personal data described in section 2
Neo	Sending sign-in emails	EU	No — account email only (controller-side; listed for completeness)

Paddle (our merchant of record) processes billing data as described in our Privacy Policy and is not a sub-processor of scan data.

7. Helping you with your obligations

• Data subject requests. If a visitor of a scanned site exercises a GDPR right against you, we will help you respond, taking into account that raw data is deleted after 30 days and stored evidence is masked. Forward the request to privacy@analyticsdom.com.
• Breaches. If we become aware of a personal data breach affecting this data, we will notify you without undue delay, with enough detail for your own Article 33/34 obligations.
• Security, DPIAs, consultations. We will provide reasonable assistance with your Article 32–36 obligations, using the information in this agreement and our Privacy Policy first.

8. Deletion and return

• Raw scan artefacts are deleted automatically after 30 days.
• Masked evidence in a report is deleted when you ask us to delete the report or close your account.
• When your account closes, we delete remaining scan data within 30 days, unless EU or Estonian law requires us to keep something — in which case we will keep only that, only for as long as required.
• Ask before your account closes and we will give you your reports in a portable format, at no charge.

9. Showing you we comply

We will make available the information reasonably necessary to demonstrate compliance with this agreement — starting with this document, our Privacy Policy, and our processor list. If that is genuinely not enough, we will allow an audit, conducted reasonably: on notice, during business hours, no more than once a year, under confidentiality, and at your cost unless it uncovers a material breach.

10. International transfers

Where a sub-processor is outside the EEA, transfers rely on the European Commission's Standard Contractual Clauses.

11. Liability and precedence

Liability under this agreement follows section 11 of our Terms of Service. If this agreement and the Terms conflict about the processing it covers, this agreement wins. If this agreement conflicts with mandatory data protection law, the law wins.

12. Duration and law

This agreement applies for as long as we process scan data for you, and is governed by the law of Estonia, like our Terms.

Edwin OÜ, Jüri tee 18f, Karla küla, Rae vald, Harjumaa 75326, Estonia · Registry code 14178279 · privacy@analyticsdom.com