Last updated: [date of publishing]
This agreement applies when an agency (“you”) uses Statblaze to process personal data on behalf of its own clients. It forms part of our Terms of service, and meets the requirements of Article 28 of the UK GDPR. You don’t need to sign it: it applies automatically.
1. Roles
You are the controller of your clients’ data that you connect to Statblaze. [Legal name], trading as Statblaze, is your processor.
2. What is processed
| Item | Details |
|---|---|
| Subject matter | Showing your clients’ Google Analytics and Search Console reports in dashboards and embeds |
| Duration | While your account is open, then deletion as in section 8 |
| Types of data | Aggregated website statistics, page addresses and search terms, which can occasionally contain personal data |
| Data subjects | Visitors to your clients’ websites, and people searching on Google |
| Special category data | None intended. Don’t configure Google Analytics to collect it |
3. Our commitments
We will:
- process the data only on your documented instructions, which are these terms and how you set up Statblaze, unless the law requires otherwise (and we’ll tell you if so, where allowed);
- make sure anyone with access is bound to keep it confidential;
- keep appropriate security in place, including encryption in transit, encrypted Google tokens, and strict separation between accounts;
- help you answer requests from individuals and meet your security, breach and impact-assessment duties, as far as is reasonable;
- tell you without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting your data;
- give you the information you reasonably need to show compliance, and allow an audit by you or an auditor you choose, at your cost, with 30 days’ notice and no more than once a year (unless a regulator requires it).
4. Sub-processors
You authorise us to use the sub-processors listed in our Privacy policy (section 6). We’ll give you 30 days’ notice before adding or replacing one, and you can object or close your account if you have a reasonable concern. Each sub-processor is bound by data protection terms at least as protective as these, and we remain responsible for them.
5. International transfers
Where data leaves the UK, we use a valid transfer mechanism: the UK Extension to the EU-US Data Privacy Framework, or the UK International Data Transfer Agreement or Addendum.
6. Your commitments
You confirm that you have a lawful basis, and your clients’ permission, to connect their Google properties to Statblaze, and that your instructions to us comply with data protection law.
7. Embeds
You decide who receives embed links. We act on your settings: domain locks, expiry dates and revoking.
8. Deletion
When you remove a website, or delete your account, we delete the related data from our database straight away. Backups roll off within 7 days. Deleting your account also revokes our access to your Google accounts.
9. Liability
The liability terms in our Terms of service apply to this agreement.