Data Processing Addendum
Last updated: October 3, 2026
This Data Processing Addendum (“DPA”) forms part of the Terms of Service between Outcomes By Page (“Provider”) and the customer named in the account (“Customer”). It applies to the extent Provider processes personal data on Customer’s behalf that is subject to the GDPR, the UK GDPR, the Swiss FADP, or a U.S. state privacy law that regulates processors or service providers. Capitalised terms have the meaning given in the Terms.
1. Roles
For personal data of visitors to Customer Sites collected through the Measurement Script, and for Customer Site content and connected Google Analytics and Search Console data, Customer is the controller (or business) and Provider is the processor (or service provider). Customer determines whether the Measurement Script is installed, on which pages, with or without a consent platform, and for which audiences; Provider does not.
Provider is an independent controller for Customer account, billing, authentication, security, and support data, as described in the Privacy Policy.
2. Documented instruction
Customer’s complete instruction to Provider is Schedule A of the Terms, Customer’s configuration in the dashboard, and this DPA. Provider will process Customer personal data only on those documented instructions, unless required to do otherwise by law, in which case Provider will inform Customer before processing unless that law prohibits it. Provider will inform Customer if, in Provider’s opinion, an instruction infringes applicable data-protection law. Provider is not obliged to review Customer Sites or conduct a legal analysis of Customer’s deployment in order to form that opinion.
3. Nature, purpose, and scope of processing
| Subject matter | Measurement and analysis of visitor interaction with pages Customer selects on Customer Sites. |
|---|---|
| Duration | The subscription term, plus the deletion period in Section 9. |
| Nature | Collection by JavaScript on Customer Sites, aggregation into hourly counters, per-visit event sequencing, retrieval of Customer Site content and connected Google data, AI-assisted classification of page content, and reporting to Customer. |
| Purpose | To report to Customer which pages and page elements produce measured outcomes, and to derive aggregated statistics as instructed in Schedule A(4). |
| Data subjects | Visitors to Customer Sites; Customer’s Authorized Users. |
| Categories of personal data | Page path, coarse interaction event, hour, coarse device class, per-tab session reference, observed consent state. IP address is processed transiently to deliver the response and is not stored with event data. No names, contact details, form contents, keystrokes, or content typed by visitors. |
| Special categories | None intended. Customer will not direct the Measurement Script at pages whose path or content would reveal special-category data without Provider’s written agreement. |
4. Consent and lawful basis
Customer is responsible for the lawful basis of every collection it directs, including any consent required before the Measurement Script runs for a visitor. Provider does not supply a consent interface. The Measurement Script follows Consent Signals present on the Customer Site and, where none is present, runs for every visitor; Customer’s deployment in that state is Customer’s election under Terms Section 9. Provider will honour a Consent Signal that denies analytics by recording nothing for that visit. The Measurement Script does not load, configure, or send events to Google Analytics or Search Console; Customer’s own Google implementation remains wholly responsible for Google measurement, and Provider reads Google data only through the authorized Google APIs described in Section 3.
5. Provider’s obligations
- Confidentiality. Persons authorised to process Customer personal data are bound by confidentiality obligations. Provider’s administrative access to Customer Data is limited to account identity, contact, configuration, and the controls needed to operate or terminate the account.
- Security. Provider maintains the technical and organisational measures described in Annex 1, appropriate to the risk of the processing.
- Sub-processors. Provider engages only the sub-processors listed in Annex 2 under written terms no less protective than this DPA, and will give Customer at least [30] days’ notice of any intended addition or replacement, during which Customer may object on reasonable data-protection grounds.
- Assistance. Taking into account the nature of the processing, Provider will assist Customer in responding to data-subject requests and in meeting Customer’s obligations regarding security, breach notification, impact assessments, and prior consultation, insofar as the information is available to Provider.
- Personal data breach. Provider will notify Customer without undue delay, and in any event within [48] hours, after becoming aware of a personal data breach affecting Customer personal data, and will provide the information reasonably needed for Customer to meet its own notification obligations.
- Deletion and return. On termination, Provider will delete or return Customer personal data as described in Section 9, unless retention is required by law.
- Audit. Provider will make available the information necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including inspections, conducted by Customer or an auditor mandated by Customer, no more than once per year on reasonable notice, at Customer’s cost, subject to confidentiality.
- Records. Provider maintains a record of processing activities carried out on behalf of Customer.
6. Customer’s obligations
Customer warrants that it has, and will maintain, a lawful basis for every processing operation it instructs; that its privacy notice describes the Measurement Script in substance as suggested in Annex 3; that it will deploy a consent mechanism where the law applicable to its visitors requires one; that it will honour data-subject rights; and that it will not instruct Provider to process data in a manner that infringes applicable law.
7. Aggregated statistics
Customer instructs Provider to derive aggregated statistical information from Customer Data (Schedule A(4)). Provider will apply minimum-aggregation thresholds so that no output used outside Customer’s own reporting identifies a visitor or, unless Customer has opted in, a Customer Site; will not attempt to reidentify any individual from that output; will contractually prohibit reidentification by any recipient; and will publicly commit to the same. To the extent the derivation step is itself processing of personal data, Provider relies on this instruction and, as controller for that step where applicable law so characterises it, on its legitimate interest in statistical analysis under Article 6(1)(f) GDPR and Article 89 GDPR. Information received from Google APIs and data derived from it is excluded from this instruction and is used only to provide or improve user-facing features of the Service for Customer, in accordance with the Google API Services User Data Policy, including the Limited Use requirements.
8. International transfers
Provider is established in the United States and hosts the Service on DigitalOcean in the United States. For personal data subject to the GDPR, UK GDPR, or Swiss FADP, transfers to Provider are made [under the EU–U.S. Data Privacy Framework, its UK Extension, and the Swiss–U.S. Data Privacy Framework, Provider’s certification to be confirmed] or [under the Standard Contractual Clauses (Module Three, processor to processor, and Module Two, controller to processor, as applicable) and the UK International Data Transfer Addendum, incorporated by reference]. Onward transfers to sub-processors are made under the mechanism stated in Annex 2.
9. Retention and deletion
| Data | Retention |
|---|---|
| Hourly measurement aggregates | 100 days, then purged |
| Per-visit session events | 30 days, then purged |
| Diagnostic events | 90 days, then purged |
| Customer Site content and analyses | Subscription term; deleted with the site |
| Google OAuth refresh tokens | Encrypted at rest; revoked on disconnection or cancellation |
| All Customer Data after cancellation | Recoverable 30 days, then deleted or anonymised |
10. Liability
Each party’s liability under this DPA is subject to the limitations in the Terms, except that nothing limits a party’s liability to data subjects under Article 82 GDPR or equivalent law. Provider is liable for damage caused by processing only where it has not complied with obligations of applicable law specifically directed to processors or has acted outside or contrary to Customer’s lawful instructions.
Annex 1 — Technical and organisational measures
- TLS for every connection; HSTS on the production origin.
- Row-level security in the database confines every tenant query to its own account; it fails closed.
- Google OAuth refresh tokens envelope-encrypted with AES-256-GCM; access tokens held in memory only.
- No visitor IP address or user-agent string stored with event data; only a coarse device class.
- No cookies or persistent identifiers set by the Measurement Script; a per-tab session reference only.
- Operator console gated by two-factor authentication; operator actions audited; operators never use customer credentials.
- Content Security Policy on every first-party page; outbound fetches to Customer Sites through a hardened client.
- Daily automated retention purge with audited counts; encrypted managed database with automated backups.
- Rate limiting on public endpoints; uniform responses on the collector so that probing reveals nothing.
Annex 2 — Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| DigitalOcean, LLC | Hosting and managed PostgreSQL | United States |
| OpenAI, L.L.C. | Classification of Customer Site content (API terms; no training on inputs) | United States |
| Google LLC | Google Analytics and Search Console APIs, at Customer’s direction | United States / global |
| Resend, Inc. | Transactional email to Authorized Users | United States |
| Stripe, Inc. | Billing | United States |
Annex 3 — Suggested visitor-notice language
Customer’s privacy notice should describe the Measurement Script in substance. The following is offered as a starting point, not as legal advice, and should be adapted to Customer’s site and consent configuration.
Site measurement. We use Outcomes By Page to understand which pages and links on this site lead to the outcomes we care about, such as a form being completed. On the pages we have chosen to measure, it records the page you requested, coarse actions (a page loaded, a listed link or button clicked, a form attempted or completed, how far you scrolled), the hour, and whether you are on a phone, tablet, or desktop. For the life of your browser tab it keeps a random reference so that the order of your actions on this site can be reported; that reference is not stored in a cookie, is not linked to you, and disappears when you close the tab. It does not record what you type. Your IP address is not stored with this data.
[If a consent platform is installed:] This measurement runs only if you allow analytics in our cookie settings, and stops if you later decline. [If not:] This measurement runs for every visitor to the measured pages.
If your browser sends the Global Privacy Control signal, nothing is recorded. Outcomes By Page processes this data on our behalf and may produce aggregated statistics that do not identify anyone. Its privacy policy is at outcomesbypage.com/privacy.