smartwa.
Start free

Data Processing Addendum

Last updated: October 2026

This Data Processing Addendum (“DPA”) forms part of the Terms and conditions between SmartWA (“we”, the Processor) and the customer who uses SmartWA (“you”, the Controller). It applies where we process personal data on your behalf and the EU GDPR, UK GDPR, Swiss FADP, India’s DPDP Act 2023, or a similar data protection law applies. It is accepted when you accept the Terms and needs no separate signature.

1. Subject matter, duration and purpose

We process personal data to provide SmartWA to you: website analytics, WhatsApp click measurement, smart-link redirects and click analytics, and forms you build. Processing lasts for as long as your account is active and until the data is deleted under section 9.

2. Types of data and data subjects

  • Data subjects: visitors to your websites, people who click your smart links, and people who submit your forms.
  • Data: pseudonymous visitor and session identifiers, page URLs, referrers, campaign (UTM) parameters, device, browser, operating system, screen size, language, time zone, approximate location (country, region, city), a truncated IP address (smart links only), engagement and scroll measurements, WhatsApp click and return-timing signals, and any content visitors type into your forms.
  • We do not intentionally process special-category data and you must not use SmartWA to collect it (see the Terms).

3. Your instructions

We process the data only on your documented instructions, which are these Terms, this DPA and your use of the settings and features of SmartWA, unless the law requires otherwise (in which case we tell you first, unless the law forbids it). If we think an instruction breaks data protection law we will tell you.

4. Your responsibilities as Controller

  • You decide the purposes and legal basis, and you are responsible for notices to your visitors and for obtaining any consent the law requires. SmartWA’s tracker waits for consent by default (built-in banner or your own consent tool through SmartWA.consent()); if you switch this off with consent=off you take responsibility for that choice.
  • You must keep a privacy policy on your website that mentions SmartWA analytics and smart links.
  • You must not send us data you have no right to share.

5. Confidentiality and staff

People who can access personal data are bound by confidentiality and access it only as needed to run and support the service.

6. Security

We apply measures appropriate to the risk, including: HTTPS with HSTS; visitor identifiers stored only as keyed hashes (HMAC-SHA-256); IP addresses truncated before storage and never sent to third-party geolocation services; password hashing with Argon2id; CSRF protection, rate limiting and role-based access; restricted access to storage and configuration files; and automatic deletion of raw analytics data after 400 days. No system is perfectly secure; we will keep these measures under review.

7. Sub-processors

You give general authorisation for the sub-processors below. We bind each to data protection terms no less protective than this DPA and remain responsible for them. We will tell you (by email or on this page) before adding or replacing one, so you can object on reasonable data protection grounds.

  • Hosting and infrastructure provider (the provider of the server SmartWA runs on): stores all data.
  • Dodo Payments: payment processing for plan purchases. It receives billing details, not visitor analytics.
  • Google LLC: only if you choose “Sign in with Google” (receives your sign-in request; we receive your name, email and Google ID).
  • Email delivery through the hosting provider’s mail service: account and password-reset emails.
  • Visitor IP addresses are looked up in a local GeoIP database file; no third party receives them for geolocation.

8. Helping you with data subject requests and compliance

We will assist you, taking account of the nature of the processing, to answer requests from visitors who exercise their rights, including through our privacy request page and tooling to find, export and delete a visitor’s records. If a data subject contacts us directly about data we hold for you, we will refer them to you unless the law requires us to answer. We will also give reasonable help with security, breach notification, impact assessments and consultations with authorities.

9. Personal data breaches, deletion and return

  • We will tell you without undue delay, and where feasible within 48 hours, after becoming aware of a personal data breach affecting your data, with the information we have to help you meet your own notification duties.
  • Raw analytics and click data is deleted automatically after 400 days. You can delete a website or link at any time, which removes its associated data.
  • When your account ends we will, at your choice and on request, return (export) or delete your data within 30 days, except where the law requires us to keep it (for example billing records). Backups are overwritten in the normal cycle.

10. Audits

On reasonable written notice, and no more than once a year (unless a regulator requires otherwise or after a breach), we will provide information needed to show we meet this DPA. You may use an independent auditor bound by confidentiality, during business hours and without disrupting the service or exposing other customers’ data.

11. International transfers

Where processing involves transfers of personal data out of the EEA, the UK or Switzerland to a country without an adequacy decision, the Standard Contractual Clauses (Module 2, controller to processor, and Module 3 where you are a processor) adopted by the European Commission, with the UK International Data Transfer Addendum and Swiss amendments where relevant, are incorporated by reference. Clause 7 (docking) applies; the option in Clause 11 is not used; Clause 17 and 18 refer to the law and courts of Ireland (or as the Terms state for non-EU parties); Annex I and II are completed by sections 1–2 and 6 of this DPA; Annex III by section 7. Transfers out of India follow the DPDP Act and any notified restrictions.

12. Liability and order of precedence

Liability under this DPA is subject to the limits in the Terms, to the extent the law allows. If this DPA conflicts with the Terms on the processing of personal data, this DPA prevails. A signed copy is available on request.

13. Contact

Data protection contact: hello@smartwa.link.