Use: any fleets customer subject to GDPR / UK GDPR / EU-equivalent rules who installs the fleets pixel on their site, where fleets becomes a Data Processor acting on the customer's instructions. This document is a template. To execute, both parties countersign with their legal names and the effective date.
1. Definitions
- Controller — the fleets customer who deploys the pixel.
- Processor — fleets.run, operated by Yoann Defay.
- Personal Data — has the meaning given in Regulation (EU) 2016/679 Art. 4(1).
- Sub-Processor — any third party engaged by fleets to assist with processing (see Section 7).
2. Subject matter
fleets processes pixel telemetry on behalf of the Controller for the sole purpose of producing aggregated traffic + bot-rate analytics.
3. Categories of data subjects
Visitors to the Controller's website.
4. Categories of personal data
- IP address
- TLS fingerprint (JA3 / JA4 hash)
- ASN, country (derived from IP)
- HTTP headers (User-Agent, Accept-Language, Referer)
- URL path
- Browser challenge results (canvas, WebGL, automation flags)
No special-category data (GDPR Art. 9) is processed.
5. Duration of processing
Raw events are retained for 90 days, aggregates for 18 months, unless the Controller terminates the agreement, in which case raw events are deleted within 30 days and aggregates within 90 days.
6. Processor obligations
- Process only on documented instructions of the Controller
- Ensure persons authorised to process are bound by confidentiality
- Implement Article 32 security measures (TLS, encryption at rest, access controls)
- Notify Controller of any personal-data breach within 72 hours
- Assist Controller with data subject requests within 14 days
- Delete or return personal data on termination
7. Sub-Processors
| processor | role | location | |---|---|---| | Cloudflare | edge ingest, TLS, fingerprint | global | | Google Cloud (us-central1) | storage, processing | USA |
The Controller may object to new Sub-Processors with 30 days written notice; absent objection, consent is deemed granted.
8. International transfers
EU-origin data may be transferred to the USA under the EU-U.S. Data Privacy Framework (Google Cloud, Cloudflare both certified). If the framework is invalidated, fleets and Controller will execute the EU Standard Contractual Clauses without delay.
9. Audit
Controller may request an audit no more than once per twelve months, with 30 days written notice. fleets will provide an industry-recognized attestation (e.g. SOC 2 Type II) in lieu of an on-site audit when available.
10. Liability
Each party's aggregate liability under this DPA is capped at fees paid by the Controller in the twelve months preceding the incident.
11. Governing law
Same as the main service agreement between the parties.
---
Controller: _____________________________ date: ________________
Processor (fleets.run): __________________ date: ________________