Parties and subject matter
The customer acts as CONTROLLER of the data collected from visitors to its sites. Miranda Network, S.L., tax ID B-75866194, acts as PROCESSOR and handles that data solely to provide the service.
This annex forms part of the Terms of Service and applies automatically to every customer, with no separate signature required.
Subject matter, duration and nature
Subject matter: web audience measurement and revenue attribution. Nature: collection, storage, aggregation and querying.
Duration: for as long as the service contract is in force.
Categories of data subjects: visitors to the customer’s websites.
Types of data
Pseudonymised navigation data: page path, referring host, campaign parameters, country/region/city, device type, browser and operating system, and a pseudonymous identifier regenerated daily at 00:00 UTC.
No special categories of data are processed. Neither the visitor’s IP address nor the full user-agent string is stored.
If the customer enables revenue attribution, a payment-provider customer identifier is also processed and, optionally, a hash of the billing email — never the address itself.
Processor obligations
Process the data only on the controller’s documented instructions, including as regards international transfers.
Ensure that authorised personnel are bound by confidentiality.
Apply the Article 32 measures: encryption in transit and at rest, per-organisation isolation through row-level security policies enforced in the database itself, additional encryption of third-party credentials under a managed key, and platform-level API access logging.
Assist the controller in responding to data subject requests and in impact assessments.
Notify any personal data breach without undue delay after becoming aware of it.
On termination, delete or return the data at the controller’s choice. Both are available without our involvement from the billing screen: a full JSON export, and permanent deletion of the account and its data.
Sub-processors
The controller gives general authorisation for the sub-processors published on the sub-processors page, which is kept up to date.
Any addition is announced with reasonable notice and the customer may object; if they do, they may terminate without penalty.
International transfers
Standard Contractual Clauses (Implementing Decision (EU) 2021/914) with sub-processors established outside the European Economic Area.
Audit
The controller may request the information necessary to demonstrate compliance with this annex, and may audit with reasonable notice and without affecting the security of other customers.