When you use BobRay to measure your website, you are the data controller and BobRay is your data processor. This summary describes how we process data on your behalf. A full, signable Data Processing Agreement is available to all customers and is included by default on Scale and Enterprise plans.
BobRay processes only the aggregate, anonymous analytics data generated by our script. By design we do not process cookies, persistent identifiers, or directly identifying personal data. Processing is carried out solely to provide the analytics service you have subscribed to and according to your documented instructions.
We use a small number of vetted sub-processors for hosting and payments, each bound by data-protection terms equivalent to ours. We maintain a current list and will give notice of any intended change so you can object.
All analytics data is hosted and processed within the European Union. Where any limited transfer outside the EU is necessary (for example, customer-support tooling), we rely on appropriate safeguards such as Standard Contractual Clauses.
We protect data with encryption, access controls, and monitoring, and we will notify you without undue delay if we become aware of a personal-data breach affecting your data, with the information you need to meet your own obligations.
To receive a countersigned DPA, email privacy@bobray.com or contact our team. We'll return a signed copy promptly.