Data processing agreement

• The customer, holder of a Takt organization, is the controller: they decide to measure the audience of their websites and set the purposes.
• VSK, publisher of Takt, is the processor: it performs the measurement on the customer’s behalf, following their instructions.

VSK processes the data only on the customer’s documented instructions. These instructions are: this agreement, the terms of use, and the settings the customer chooses in Takt (measured websites, script options, route redaction, exclusions, integrations, deletions). VSK immediately informs the customer if an instruction appears to infringe the GDPR. VSK never uses the customer’s data for its own purposes, never sells it and never combines it with any other source.

Only authorized VSK staff access the data, to the extent needed for operations and support, and each of them is bound by confidentiality. Support actions on an organization are logged.

VSK implements the following measures (GDPR article 32), which it may change without lowering their level:

• Pseudonymization at collection: visitor identifier computed with a daily key destroyed after 48 hours, IP address never stored.
• Encryption of traffic (HTTPS), secrets and backups.
• Two-factor authentication required to access the dashboard, role-based access control within organizations, audit log.
• Data partitioned by organization and website, read-only technical accounts for monitoring.
• Encrypted backups twice a day, kept for 7 days, with restore testing.
• Automatic erasure of data when its retention period ends.

The customer authorizes VSK to use the sub-processors listed on the subprocessors page. VSK binds them by contract to the same obligations as this agreement and remains liable for their performance.

VSK notifies the organization owners by e-mail at least 30 days before adding or replacing a sub-processor. The customer may object during that period, on data protection grounds. If no solution is found, they may terminate at no cost and be refunded for the paid and unused period.

The customer’s data is stored in the European Union. A transfer to a third country only happens through a listed sub-processor, on the basis of an adequacy decision or the European Commission’s standard contractual clauses.

• Data subject rights: VSK forwards to the customer, without delay, any request it receives from a person concerned by the customer’s statistics. The customer has the tools to answer: deletion of a website or of their organization, exclusions, export through the read API.
• Impact assessments and prior consultation: VSK provides the customer with the information it holds to carry out an impact assessment or consult the supervisory authority.
• Compliance: VSK makes available to the customer all information needed to demonstrate compliance with this agreement.

VSK notifies the customer of any personal data breach affecting them without undue delay, and no later than 48 hours after becoming aware of it. The notification describes the nature of the breach, the categories and approximate number of people and records concerned, its likely consequences and the measures taken or proposed. The customer can thus notify the authority within the 72 hours required by GDPR article 33.

Before leaving Takt, the customer can retrieve their statistics through the read API. Deleting a website, or the organization, erases all the corresponding statistics after a 90-day grace period. Backups still holding them disappear 7 days later. VSK keeps no copy, unless required by law.

The customer may verify compliance with this agreement, first on the basis of the information provided by VSK. If that is not enough, they may have an audit carried out, at most once a year, by themselves or by an independent auditor bound by confidentiality, with 30 days’ notice. The audit is at the customer’s expense and must not disrupt the service or compromise other customers’ data.

• Have a legal basis for measuring the audience of their websites and inform their visitors, for example with the template below.
• Not send Takt data that directly identifies a person (e-mail, name, phone number, account identifier) in page addresses, parameters or event properties, nor any sensitive data.
• Offer their visitors a way to opt out of measurement, for example with the opt-out feature of the Takt script.

The following text can be reused as is, replacing the items in brackets:

“We measure the audience of [website name] with Takt, a tool published by VSK and hosted in the European Union. Takt sets no cookie and does not store your IP address: it records the page viewed, the referring site, your country, region and city, your browser and device type, with an identifier that changes every day and cannot recognize you from one day to the next. These statistics are used only to understand our website’s traffic, on the basis of our legitimate interest, and are kept for 25 months. You can opt out of this measurement by turning on Do Not Track or Global Privacy Control in your browser, or [link to your opt-out button].”

This agreement applies for as long as VSK processes data on behalf of the customer. It is governed by French law.