Data Processing Agreement

In short. You decide what happens with the data of your visitors; we process it only to provide Nvivio to you. The data stays in the EU, our subprocessors are listed and announced in advance, we report a breach within 48 hours, and when you delete a site or your organisation, its events and daily totals are gone within 24 hours.

1. Parties and how this agreement applies

1.1. This Data Processing Agreement (“DPA”) is between the customer that uses Nvivio (“you”, the controller) and Monto Bleu BV, [registered office to be added], enterprise number 0543.842.970 (“we”, the processor).

1.2. It is part of the Terms of Service and applies automatically from the moment you accept them, without a signature. If you need a signed copy for your records, write to support@nvivio.com with the name and address of your organisation; we send you this DPA signed by us.

1.3. For everything about personal data, this DPA prevails over the Terms of Service. Terms used here have the meaning they have in the General Data Protection Regulation (EU) 2016/679 (“GDPR”), such as personal data, processing, controller, processor, data subject and personal data breach.

1.4. This DPA covers the personal data that we process on your behalf when we provide Nvivio: the data about the visitors of your sites (“Visitor Data”), described in Annex 1. It does not cover the data we process as a controller ourselves, such as your account and billing data; that is in our Privacy Policy.

2. Your instructions

2.1. We process Visitor Data only on your documented instructions. Your instructions are: the agreement (the Terms of Service and this DPA), the settings you choose in Nvivio (such as privacy or cookie mode, excluded IP addresses, retention and sharing) and what you or your users do in the dashboard and through the API. You may give further instructions in writing, as long as they fit the Service; an instruction that requires extra work we may charge for, after telling you.

2.2. We process Visitor Data outside your instructions only when EU or Belgian law requires it. We then tell you first, unless that law forbids it.

2.3. If we believe an instruction breaks the GDPR or other data protection law, we tell you at once and may wait to follow it until you confirm or change it.

2.4. We do not use Visitor Data for our own purposes. We do not sell it, use it for advertising or to train AI models, combine it with data of other customers or try to identify visitors.

3. Your responsibilities

3.1. You are responsible for the lawfulness of the processing: you have a legal basis for measuring your visitors, you inform them in your privacy notice, and you ask for consent where the law requires it, in particular before setting the cookie of cookie mode (see Do I need a cookie banner?).

3.2. You send Nvivio only the data it is meant for. Do not send data that identifies a visitor directly (such as a name, email address, phone number or customer number), special categories of personal data (article 9 GDPR) or data about criminal convictions in events, properties, page addresses, page titles, labels or notes, unless you have a legal basis for it and it is necessary. Nvivio removes unknown parameters from addresses and email addresses from paths, but that is a safety net, not a licence. The Acceptable Use Policy has the details.

4. Confidentiality

Everyone at Nvivio who can access Visitor Data is bound to confidentiality by contract or by law, has access only when needed for their work, and knows how to handle personal data.

5. Security

5.1. We take appropriate technical and organisational measures to protect Visitor Data, as article 32 GDPR requires. They are described in Annex 2 and on Security.

5.2. We may update the measures to keep up with technology and risks, as long as the overall level of protection does not go down.

6. Subprocessors

6.1. You give us general authorisation to engage subprocessors. The current subprocessors are listed in Annex 3 and on Subprocessors.

6.2. We tell you at least 30 days before we add or replace a subprocessor, by email to the owners of your organisation and on the Subprocessors page. You may object within those 30 days, by email, on reasonable grounds related to data protection. We then look for a solution with you in good faith. If we find none, you may end the agreement before the change takes effect, and we refund the prepaid fees for the period after the end. If you do not object, the new subprocessor is authorised.

6.3. In an emergency, for example when a subprocessor stops its service or a security problem forces us to switch at once, we may replace a subprocessor sooner. We then tell you as soon as possible, and your right to object and end the agreement still applies.

6.4. We impose on each subprocessor, by contract, the same data protection obligations as in this DPA, in particular sufficient guarantees for appropriate security measures. We remain fully responsible to you for the subprocessors we engage.

6.5. Services you connect yourself are not our subprocessors: an AI assistant connected through the MCP server, a tool that reads the API with your key, a cookie banner, or anyone you share a dashboard or a report with. What they receive, you decide.

7. Where the data is processed

7.1. Visitor Data is stored and processed in the European Economic Area. The database is in Frankfurt (Germany); the queue, the configuration and the files are stored at Cloudflare under EU jurisdiction.

7.2. A request from a visitor first arrives at the Cloudflare data centre closest to them, which for visitors outside the EU can be outside the EU; the IP address is used there in memory only and is never stored. Some subprocessors are established outside the EEA (see Annex 3). Any transfer outside the EEA takes place only with a safeguard of chapter V GDPR: an adequacy decision, such as the EU-US Data Privacy Framework for certified companies, or the European Commission’s standard contractual clauses, with additional measures where needed.

7.3. If you are established outside the EEA and the GDPR applies to the transfer of Visitor Data from us to you, the standard contractual clauses (Commission Implementing Decision (EU) 2021/914, module 4, processor to controller) apply between us and are incorporated in this DPA by reference.

8. Helping you

8.1. Rights of data subjects. Nvivio lets you handle requests yourself: you can export or delete all data of one visitor from the dashboard or the API, in a minute. If a visitor contacts us directly, we pass the request on to you without undue delay and do not answer it ourselves, unless you ask us to. Where a request needs more than the dashboard offers, we help you within a reasonable time.

8.2. Other obligations. We help you, taking into account the nature of the processing and the information we have, with your obligations under articles 32 to 36 GDPR: security, notification of breaches, data protection impact assessments and prior consultation of a supervisory authority. This page, Security and Do I need a cookie banner? contain the information most customers need for this.

9. Personal data breaches

9.1. If we become aware of a personal data breach affecting Visitor Data, we notify you without undue delay and in any case within 48 hours, by email to the owners of your organisation.

9.2. The notification describes, as far as we know at that time: what happened, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures we took or propose, and a contact for more information. What we do not know yet, we send as soon as we know it.

9.3. We take the necessary measures at once to limit the breach and its consequences, keep a record of every breach, and help you notify the supervisory authority and the data subjects where required. Notifying them is your decision; we do not do it in your name unless you ask us to.

10. Deleting the data

10.1. During the agreement. Visits, events and their details are deleted automatically when they become older than the retention of your plan or of the site (see the pricing page and Settings in the dashboard). Daily totals contain counts only, without anything that links them to a visitor or a visit; they are kept as long as your plan allows. You can delete the data of one visitor, all data of a site, or a site, at any time.

10.2. Deleting a site or the organisation. When you delete a site or your organisation, we delete all its events and daily totals within 24 hours and confirm this by email.

10.3. At the end of the agreement. When the agreement ends, we delete all Visitor Data within 24 hours of the deletion of your organisation, unless EU or Belgian law requires us to keep it. Before that, you can export your data with the export functions and the API. Encrypted backups of our database provider expire within 7 days; until then, deleted data remains in them, protected and unused.

11. Audits

11.1. We make available to you the information you need to demonstrate compliance with article 28 GDPR: this DPA, the description of our measures, the list of subprocessors and, on request, written answers to reasonable questions.

11.2. If that is not enough, or a supervisory authority requires it, you may have an audit carried out, at most once a year, by yourself or by an independent auditor bound to confidentiality. Tell us at least 30 days in advance and agree the scope with us. The audit takes place during working days, without disturbing our operations or the security and confidentiality of other customers’ data. You bear its costs, unless it shows that we seriously breached this DPA. Audits at our subprocessors take place through the reports and certifications they publish.

12. Requests from authorities

If an authority asks us for Visitor Data, we refer it to you where possible. We tell you about the request unless the law forbids it, and we only disclose what we are obliged to after checking that the request is lawful. Where we have good reason to believe a request is unlawful, we challenge it.

13. Liability and duration

13.1. Each party’s liability under this DPA is subject to the limits in article 13 of the Terms of Service, except where article 82 GDPR provides otherwise towards data subjects. Each party bears the fines imposed on it.

13.2. This DPA applies for as long as we process Visitor Data on your behalf, and ends automatically once all of it has been deleted. Obligations that by their nature continue after that, such as confidentiality, continue to apply.

13.3. We may change this DPA in the same way as the Terms of Service (article 16), and only to improve the protection of the data, to follow the law or to reflect a change in the Service. Changes to the subprocessors follow article 6.

13.4. Belgian law applies to this DPA, and the courts named in article 18 of the Terms of Service have jurisdiction.

Annex 1: description of the processing

Subject matter	Web analytics: measuring visits to the customer’s websites and apps and showing them as statistics, visits, reports and answers.
Nature of the processing	Collecting, cleaning, storing, combining into visits and daily totals, analysing, showing, exporting and deleting.
Purpose	Providing Nvivio to the customer, including its security, the bot filter and support.
Duration	For the duration of the agreement; each record for the retention of the customer’s plan or site, or until the customer deletes it.
Data subjects	Visitors of the customer’s websites and apps. Where the customer adds labels or notes to visits: the persons those labels or notes are about.
Categories of personal data	Page address (path and only known campaign and search parameters), page title, referring website and its type, campaign tags; a visitor code: in privacy mode a hash of a daily key, the site, the IP address and the browser, changing every day; in cookie mode the random identifier from the _nvivio_sid cookie; country, region and city derived from the IP address; network name (in privacy mode only of large providers and relays); browser, operating system and type of device, browser language and screen width; time on the page and scroll depth; time of each event, custom events and their properties sent by the customer; labels and notes the customer adds to a visitor. The IP address is used in memory only and never stored; the full user agent is not stored.
Special categories	None. The customer does not send them (article 3.2).
Retention	As set by the customer’s plan or the site’s own retention, shown on the pricing page and in Settings. Deletion of a site or an organisation: within 24 hours.

Annex 2: technical and organisational measures

The measures are described in full on Security. In summary:

• Data minimisation by design: the IP address is never stored; the visitor code changes daily and the daily key is deleted after 26 hours; the full user agent is not stored; unknown URL parameters are removed and email addresses in paths replaced; in privacy mode, only names of large networks are kept; Global Privacy Control is honoured.
• Location: storage in the EU (Frankfurt, and Cloudflare under EU jurisdiction); the dashboard and API run next to the database in Frankfurt; no query results are cached; no request logs are kept.
• Encryption: the script, the collection of events, the dashboard and the API over HTTPS (TLS); data encrypted at rest by our providers.
• Access control: roles per organisation and per site; login with a one-time link by email, without passwords; API keys stored as a hash only; the database cannot be reached from the internet through REST or GraphQL, and every table has row-level security.
• Our own access: our administration is behind Cloudflare Access, checked again by our own code against a list of named people; every change requires a reason and is logged; staff do not see the statistics of a customer.
• Reliability: every event has a unique identifier so it counts once; a queue with retries and a dead-letter queue; daily backups by the database provider.
• Incidents: notification within 48 hours (article 9); a record of every incident.
• Development: automated tests on every change; production only deployed from the main branch.

Annex 3: subprocessors

The current list, with what each subprocessor does, where and with which safeguard, is on Subprocessors, which forms part of this annex. On the date of this version:

Subprocessor	What for	Where the data is
Cloudflare, Inc. (USA)	Network and protection, delivering the script, collecting events, queue, configuration, sending email	EU (storage under EU jurisdiction); requests at the data centre closest to the visitor
Supabase, Inc. (USA), on Amazon Web Services	Database	Frankfurt, Germany
Amazon Web Services EMEA SARL (Luxembourg)	Language model for “Ask Nvivio” (Amazon Bedrock), once switched on	Frankfurt, Germany

Versions

• 1.0, 25 October 2026: first version.