Data Processing Agreement

This Data Processing Agreement ("DPA") is part of the agreement under which Varly provides its service to you, such as our terms of service or a signed order (the "Agreement").

It is made between you, the customer that uses Varly ("you", the controller), and [Company legal name], trading as Varly, registered with the Dutch Chamber of Commerce (KvK) under number [KvK number], [Registered address] ("Varly", "we", the processor).

You accept this DPA by creating a Varly account or by using Varly. You don't need to sign anything. If your organization needs a signed copy, email us at [Privacy contact email].

1. Definitions

Words such as personal data, processing, controller, processor, data subject and personal data breach have the meaning they have in the General Data Protection Regulation (EU) 2016/679 ("GDPR").

• Customer Personal Data is personal data that Varly processes on your behalf while providing the service.
• Sub-processor is a company that Varly engages to process Customer Personal Data.
• The service is Varly: analytics, heatmaps, session recordings, surveys, A/B tests, linking orders to tests, reports and the AI features, as available in your account.

2. Roles

You are the controller of Customer Personal Data and Varly is your processor.

If you are an agency that uses Varly for your clients, your client is usually the controller and you are their processor. Varly is then your sub-processor. You confirm that your clients allow you to engage Varly on these terms.

Varly is a separate controller for the data it needs to run its own business, such as logins, service emails and support. Our Privacy Policy describes that processing.

3. Subject matter and duration

Varly processes Customer Personal Data to provide the service to you. This DPA applies for as long as Varly processes Customer Personal Data for you: during the Agreement, and after it until the data is deleted as described in section 13.

4. Nature and purpose of the processing

Varly collects, stores, analyzes and shows data about how visitors use your websites, so that you can understand and improve them. In particular, Varly processes Customer Personal Data to:

• measure visits, pages, clicks and scrolling, and show them as reports and heatmaps;
• record and replay sessions, with text hidden as you set it;
• show your surveys and store the answers;
• run A/B tests and report their results;
• link orders from your shop to visits and tests, to measure revenue;
• send the emails and notifications your team chooses;
• provide the AI features (Oran) with the AI key you add, as described in section 10.

Varly processes Customer Personal Data only for these purposes, never for its own purposes, and never sells it. Data of one customer is never used for another customer.

5. Data subjects

• Visitors to your websites who allowed analytics in your cookie banner. Varly measures nothing before a visitor gives that consent, unless you turn on privacy mode (next point). This includes visitors who place an order in your shop.
• Visitors to your websites who haven't given consent, only if you turn on privacy mode for a site under Settings → Tracking & privacy. They take part in your A/B tests anonymously, as described in section 6. Visitors whose browser sends Do Not Track or Global Privacy Control are never included. Privacy mode is off by default; whether you may use it without consent is your decision as controller.
• Visitors who answer your surveys.
• Your team members and the people your team invites, such as colleagues and the reviewers you ask to approve a report.

6. Categories of personal data

What Varly does not store:

• IP addresses. Varly uses a visitor's IP address only for a moment, to apply your list of excluded IP addresses and to block floods of requests. It is never saved.
• What visitors type into form fields on your website.
• Names, email addresses and postal addresses of your shop's customers.
• Anything from pages on your "Never track these pages" list, such as your checkout and cart. Varly does nothing on those pages.

Varly is not designed to process special categories of personal data (such as health data). You agree not to send such data to Varly, for example in custom events or survey questions.

7. Your instructions

Varly processes Customer Personal Data only on your documented instructions. Your instructions are this DPA, the Agreement, and the settings and actions you and your team choose in Varly, such as what to record, what to hide, and when to delete data.

Varly may also process Customer Personal Data where EU or Dutch law requires it. In that case, Varly tells you before processing, unless that law forbids it.

Varly tells you without delay if it believes an instruction breaks the GDPR or other data protection law.

8. Your responsibilities

You are responsible for:

• having a lawful basis for the processing, and asking your visitors for consent where it is needed. Varly connects to your cookie banner and only measures after consent, but the banner and its settings are yours;
• telling your visitors about Varly in your privacy policy;
• choosing settings that suit your website, such as how much text is hidden in recordings and which pages are never tracked;
• the lawfulness of the data your site sends to Varly, for example in custom events.

9. Confidentiality

Varly allows only people who need access to Customer Personal Data to do their job to access it. Everyone with access is bound by a duty of confidentiality.

10. Security

Varly takes appropriate technical and organizational measures to protect Customer Personal Data, taking into account the state of the art, the costs, and the risks for data subjects. Annex 1 describes these measures. Varly may improve them over time, but never in a way that lowers the overall level of protection.

When a team member adds an AI key for your organization, Oran sends the research data of the site it works on to the provider of that key, on your instruction. That provider processes the data under your own agreement with them. Oran never sees data from your other clients or sites.

11. Sub-processors

You give Varly general written authorization to engage sub-processors. The current list is at varly.ai/legal/subprocessors.

• Varly imposes the same data protection obligations on each sub-processor by contract as this DPA imposes on Varly, and remains responsible to you for its sub-processors.
• Varly tells you about a new or replaced sub-processor at least 30 days before it starts processing Customer Personal Data, by updating the list and emailing the owners of your organization.
• You can object to the change on reasonable data protection grounds by emailing [Privacy contact email] within those 30 days. We will then look for a solution with you in good faith. If we can't find one, you may end the Agreement before the change takes effect.

Services that you choose to connect yourself, such as your own AI provider, your Google Analytics property, your shop platform, or a Slack or webhook address for notifications, are not Varly's sub-processors. Data goes there because you asked for it, under your own agreement with that provider.

12. Assistance

Requests from data subjects. Varly helps you answer requests from data subjects, such as requests for access or deletion. You can delete a recording, a site or your organization yourself in Varly. Because Varly stores no names or contact details of visitors, it usually can't link a request to a person. If you can give us the visitor ID from the visitor's browser, we help you find and delete the data linked to it. If a data subject contacts Varly directly about Customer Personal Data, we refer them to you and don't answer the request ourselves.

Impact assessments. Varly gives you the information you reasonably need for a data protection impact assessment, and for a prior consultation with a supervisory authority, about the processing Varly does for you.

Personal data breaches. Varly tells you without undue delay after becoming aware of a personal data breach that affects Customer Personal Data, and aims to do so within 48 hours. We email the owners of your organization and include, as far as we know them: what happened, the categories and approximate number of data subjects and records involved, the likely consequences, and the measures taken or proposed. When we don't know everything yet, we share what we know and add the rest as soon as we can. Varly helps you meet your own obligation to report the breach to the supervisory authority and to the people involved.

13. Deletion and return

During the Agreement, Varly deletes Customer Personal Data automatically after these periods:

Your team can delete data sooner: a single recording, a whole site, or your whole organization. Deleted data is removed from Varly's live systems right away.

When the Agreement ends, Varly deletes Customer Personal Data within 30 days, unless EU or Dutch law requires us to keep it. Before that, you can export what Varly offers in the app, such as survey answers and reports. If you need another export, ask us before the end of the Agreement and we will help where we reasonably can.

Backup copies are not changed when data is deleted. They are overwritten on a fixed schedule, and the oldest copy is at most 8 weeks old. Until then, backups are only used to restore Varly after a failure.

14. Audits

Varly makes available to you the information you need to demonstrate compliance with Article 28 of the GDPR. Please send your questions to [Privacy contact email] first; we answer them in writing.

If our answers are not enough, you, or an independent auditor you appoint who is bound by confidentiality, may audit Varly once a year, with at least 30 days' written notice, during business hours, and without disrupting the service or access to other customers' data. You bear the costs of the audit. Varly may also audit more often if a supervisory authority requires it or after a personal data breach that affects you.

15. Transfers outside the EU

Varly stores Customer Personal Data in the European Union, on servers in Germany.

Some sub-processors are companies based in the United States, or handle requests at data centers close to the visitor, which can be outside the European Economic Area. Where Customer Personal Data is transferred outside the European Economic Area, Varly makes sure the transfer is covered by an adequacy decision of the European Commission (such as the EU-U.S. Data Privacy Framework, for companies certified under it) or by the Standard Contractual Clauses adopted by the European Commission. The list of sub-processors shows the safeguard for each.

16. Liability

Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Agreement.

17. Order of precedence and changes

If this DPA conflicts with the Agreement, this DPA wins on matters of data protection.

Varly may update this DPA, for example when the law or the service changes. We email the owners of every organization at least 30 days before a material change takes effect. The current version is always at varly.ai/legal/dpa, with its version number and date at the top. Earlier versions are available on request.

18. Governing law

This DPA is governed by the laws of the Netherlands. Disputes are handled by the competent court as set out in the Agreement, or, if the Agreement doesn't say, by the competent court in the Netherlands.

Annex 1: Technical and organizational measures

These are the measures Varly has in place today.

Where data is kept

• Varly's application, databases and backups run on a server at Hetzner in Germany.
• The databases (PostgreSQL and ClickHouse) can only be reached from inside that server. The one exception is an endpoint for Varly's own edge service, which can only add events and can't read anything.
• Off-server copies of the backups are stored in Cloudflare R2 in the European Union jurisdiction.

Collecting less data

• Nothing is measured before a visitor gives consent in your cookie banner, unless you turn on privacy mode for a site. Then visitors without consent only take part in A/B tests, with an anonymous ID in local storage and only their test version and test goals. When consent is withdrawn, measuring stops and the visitor ID is removed from the browser.
• IP addresses are never stored. Varly keeps only the country.
• Text in recordings and click labels is hidden in the visitor's browser, before anything is sent, as you set it. Form fields are always hidden.
• Pages on your "Never track these pages" list, by default including checkout and cart, are never measured or recorded.
• Recordings store page addresses without the part after ? or #. Email addresses and long numbers are removed from error messages.
• Speech that your team speaks into Varly is turned into text on Varly's own server and is not kept.

Encryption

• All connections to Varly use HTTPS (TLS), with HTTP Strict Transport Security.
• AI keys and shop connection secrets are encrypted in the database with AES-256-GCM. Passwords and order API keys are stored only as hashes. Invitation, review and access links are stored as hashes or encrypted, never as plain text.

Access

• Each customer's data is kept separate. Every request is checked against the organization, client and site the person has access to, and Oran only ever sees the data of the site it works on.
• Your owners decide who is on your team and their role (Owner, Editor, Contributor or Viewer), and in an agency account which clients each person can see.
• Passwords must be at least 10 characters. Password reset links work for 1 hour and only once. Team members can see where they are logged in and log out other devices.
• Owners receive an email whenever the AI key of their organization is added, replaced or removed.
• Varly staff use a separate admin system with its own accounts. Signing in requires a password and a code from an authenticator app. Every admin action is written to an audit log that can only be added to and that shows if a line was changed or removed.
• Access to the server is only possible with SSH keys. Password logins are switched off, and a firewall only allows web traffic and SSH.

Isolation

• The browser Varly uses to take screenshots of web pages runs in a separate, locked-down container without access to the internet, the databases or any secrets.

Availability and backups

• The databases are backed up every night, with weekly copies kept for 8 weeks, and the backups are checked after they are made. Copies are also stored off the server.
• A watchdog checks Varly every minute and alerts the team when something fails.
• If Varly's server is briefly unreachable, incoming events wait in a queue and are delivered when it is back.
• Security updates for the server's operating system are installed automatically.

Deletion and logging

• Data is deleted automatically after the retention periods in section 13. Server error reports are kept for 60 days and store page paths without the part after ?.
• Server logs are limited in size and overwritten automatically.

Changes to Varly

• Every change to Varly's code is tracked in version control and passes automated tests before it is deployed.

History