Data Processing Agreement

For the data you collect on your own websites, you are the data controller and GO TO AGENCY (GTA), a French simplified joint-stock company (SAS) with a share capital of €1,000, RCS Dijon 944 980 762, 9 rue Jean-Jacques Rousseau, 21000 Dijon, France, which publishes Datalenk, is your processor.

Purpose: measuring the traffic of your sites, tying visits to your sales, and running what you turn on (Persistent layer, identify, replay, A/B tests, public sharing, links between tools). Duration: that of your account, plus the deletion periods in section 4. Data subjects: the visitors of your sites, your paying customers, and the people you identify.

For your own account data (your email, your billing), we are the controller: the privacy policy covers it.

We only process this data on your written instructions: the terms of service, this agreement, and your settings in Datalenk (the snippet you install, the features you turn on). We never use it for ourselves: no sale, no advertising, no profile built across sites, no use of one customer's data for another.

If an instruction seems to us to infringe the GDPR, we inform you immediately.

By default nothing is stored on the visitor's device; the script reads standard browser information (language, screen size, referrer) and sends it with each event. Before your visitors' consent, the script runs Simple measurement (with data-consent="simple", and also without that attribute), or sends nothing (data-consent="wait"). Simple measurement means: the page, the referring domain, the device, browser, operating system, language, the country, region and city derived from the IP address, and a session key for the day (a hash of the date, a secret, the site, the IP and the browser). The IP address is used in memory, then discarded: it is never written.

With your visitors' consent: the full referrer, campaign parameters (UTM) and click ids (gclid, fbclid, the Lenkli marker), the marking of links to Stripe and Calenkli, and the return of a Stripe payment to the visit. Your visitors accept these three purposes together or one by one: sources and sales (with the Persistent layer if you turn it on), A/B tests, replay. A refusal, or a withdrawal, cuts them in every mode: the identifier is deleted and marked links get their address back.

• Persistent layer (if you turn it on): a random, pseudonymous identifier on the visitor's device (localStorage and a first-party cookie), which lives 90 days from its first deposit and is never extended. It holds no name and no address, but it is personal data, because it recognises a returning visitor.
• identify() (if your code calls it): the email address is hashed server-side (HMAC, with a secret), then discarded; it is never kept in clear text.
• Replay (if you turn it on): pointer, scroll and click positions, as percentages of the page, with timing; never page content, form input or keystrokes.
• A/B tests (if you run them): each exposure (the test, the version shown, the session of the day, the page reference) and the conversions that follow. The version is drawn on the session of the day, or on the identifier your server sends ("account" draw).
• Payments and attribution registry: amounts, currency, Stripe payment and customer ids, a hashed card fingerprint (to recognise the same payer), an email fingerprint, and the traits you send (internal id, plan, company, monthly revenue).
• Without any visitor identifier: clicks aggregated by page (click maps), page speed, JavaScript errors (truncated message), and, with consent, the list of third-party tools loaded (their domains, never the addresses).
• Datalenk's banner (if you turn it on): the visitor's choice, kept 6 months on their device in a cookie that holds nothing else (datalenk_consent). Objection: if they object to measurement, a datalenk_optout cookie ("1"), kept 13 months.

These options require your visitors' prior consent. The script waits for it, in every mode: without consent, nothing is stored, no link is marked, identify() sends nothing and A/B tests show the normal version without counting the visitor.

Servers and databases in the European Union (Hetzner). We run our own database engines. Only the AI analysis (when you click it) and the matching of world events, when these features are on, send aggregated figures to Anthropic, in the United States, with no email address and no visitor identifier (see the sub-processors list).

• Events: 3 years at most with the Pro plan (and the former Starter plan) or without a paid plan (trial, complimentary account), 5 years at most with Business and the LenKore pack (and the former Growth and Scale plans). Leads: the same duration, counted from the event each one comes from. Attribution registry (the link between a paying customer and the channel that brought them): the same duration, counted from their last payment. Beyond that, they are deleted.
• Events received without the visitor's consent (Simple measurement): 25 months at most, whatever the plan. They only feed your statistics: no journey, no visitor profile, no lead, no individual live view, no matching with a payment. A lead drawn from them before this rule is hidden, and kept 25 months at most too.
• Persistent identifier: 90 days from its first deposit, on the visitor's device.
• Replay: 30 days. JavaScript errors: 90 days. Third-party tools: 120 days. Click maps and page speed: 180 days.
• A site or an account you delete goes to a 30-day bin (a mistake stays reversible), then everything is erased: events, aggregates, registry, email logs. Only accounting records are kept 10 years, as the law requires.

The named list is on the sub-processors page, with each one's role, data, country and safeguard. You authorize those listed there. We contractually impose on each sub-processor the same obligations as those of this agreement.

We tell you by email 30 days before adding or replacing a sub-processor. You can object: you can then terminate without penalty and export all your data.

The people authorized to process your data have committed to confidentiality.

Encryption in transit (TLS). Access to production is limited to the people who run it, with keys. The credentials you give us (a restricted Stripe key, a Search Console token…) are encrypted with AES-256-GCM using a dedicated key, never in plain text. Passwords are hashed with scrypt. Our administration console requires a secret link, a password and a TOTP code, and every action there is written to an audit log.

We assist you, with the information available to us, with security, data breaches, impact assessments and prior consultation of the CNIL. A template impact assessment of Datalenk (description, necessity, risks, measures already in place) is available on request.

Data subject rights: you export your raw events (CSV or JSON) from the dashboard or the API, without asking us. If one of your visitors exercises their rights with you, send us the identifier concerned: we remove their data from our stores.

Data breach: if a breach affects your data, we tell you without undue delay after becoming aware of it, with what we know (nature, data and people concerned, measures taken), so you can report it to the CNIL within 72 hours if it presents a risk. Every incident is recorded in our register.

Audits. We give you the information needed to demonstrate compliance with this agreement. We allow audits, including on-site inspections, by you or an auditor you appoint, at most once a year (except after a data breach), with 30 days' notice, at your expense and under a confidentiality undertaking. We answer first by questionnaire and documents.

Links between tools. When you use several LenKore tools with the same account, you ask us to pass from one tool to another, for your account only, the data these features need: Calenkli bookings and payments, clicks and emails collected by Lenkli (addresses replaced by a fingerprint), to your Datalenk sales; purchases seen by Datalenk, to your Calenkli guests. This data never leaves your account and only serves you. You can turn off each link in the tool's settings.

Connecting a third-party assistant is an instruction from you; you choose its publisher. What the assistant reads in Datalenk is sent to its publisher (Anthropic for Claude, OpenAI for ChatGPT…), which processes it under its own terms, sometimes outside the European Union. You can revoke its access at any time.

1. For the measurement of your site, you are the data controller; Datalenk is your processor, under this agreement.
2. Simple measurement writes nothing on your visitors' devices: still describe it in your privacy policy and add our "Stop measuring me" link.
3. Everything else needs your visitors' consent before it turns on: revenue by channel and by campaign, UTM parameters and click ids (Lenkli, Google, Meta), the link with Calenkli and Stripe, identify(), the Persistent layer, A/B tests, replay. In your banner, "Refuse" must be as easy as "Accept", and your visitors must be able to change their mind at any time.
4. Keep a dated record of your settings and of your banner: it is up to you to be able to show that you follow these rules.
5. Datalenk is neither "validated" nor "certified" by the CNIL: do not write that it is.

When the contract ends, you export your data (raw events, as CSV or through the API), then we delete it within the periods of section 4. This agreement lasts as long as we process your data.

A data processing agreement is not a compliance certificate, and no tool can make you compliant on its own. This document gives you a clear, written description of what we do with your data. If the product ever does something other than what is written here, that is a defect and we want to hear about it: hello@datalenk.com.