Skip to content
30% off forever with FOUNDER30 →
Lienks

Data Processing Agreement under Art. 28 GDPR

Version: 1.0
Last updated: October 8, 2026

This English version is provided for convenience. In case of any discrepancy, the German version prevails.

between

the customer named during the ordering process or in the Lienks account
– hereinafter “Controller” –

and

Philip Knüppelholtz
Lienks Analytics
Klaus-Groth-Straße 28
23769 Fehmarn
Germany
Email: philip@lienks.com
– hereinafter “Processor” or “Lienks” –

the following data processing agreement (“DPA”) is concluded.

1. Subject matter and scope

  1. This DPA governs the processing of personal data by Lienks on behalf of the Controller in providing the Lienks web analytics service.
  2. It supplements the Terms of Service agreed between the parties. In the event of any conflict regarding the processing of personal data, this DPA prevails.
  3. The processing of account, contract, billing and support data, for which Lienks itself is the controller, is not covered by this DPA. The Lienks privacy policy applies to that processing.
  4. The details of the processing are set out in Annex 1. The technical and organisational measures are described in Annex 2. The approved sub-processors are listed in Annex 3.

2. Term

  1. This DPA applies from registration or the start of use of Lienks and for as long as Lienks processes personal data on behalf of the Controller.
  2. Its term generally corresponds to the term of the underlying user relationship. Obligations that by their nature continue beyond its end, in particular confidentiality, deletion and documentation obligations, survive termination.

3. Responsibility and instructions

  1. The Controller determines the purposes and essential means of the processing. In particular, the Controller is responsible for ensuring that the collection and transfer of data to Lienks is lawful and that data subjects are properly informed.
  2. Lienks processes personal data only on documented instructions from the Controller, unless required to do otherwise by law. In that case, Lienks informs the Controller of the legal requirement before processing, unless the law prohibits this.
  3. Use and configuration of the service in accordance with this DPA, the service description and the account settings constitute documented instructions.
  4. Further instructions can be given in text form to philip@lienks.com. If an instruction causes effort beyond the contractually agreed service, Lienks may charge reasonable compensation after prior agreement.
  5. If Lienks considers an instruction to infringe data protection law, Lienks informs the Controller without undue delay and may suspend its execution until it is clarified.

4. Obligations of Lienks

In particular, Lienks undertakes

  1. to process personal data only within the scope of this DPA and the documented instructions;
  2. to ensure that all persons authorised to process the data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
  3. to maintain the technical and organisational measures described in Annex 2 and to develop them appropriately in line with the risk and the state of the art;
  4. to assist the Controller, taking into account the nature of the processing and insofar as possible, in fulfilling data subject rights;
  5. to assist the Controller, taking into account the information available, in complying with its obligations under Art. 32 to 36 GDPR;
  6. to maintain a record of categories of processing activities where required by law;
  7. to cooperate with the competent supervisory authority to the extent required by law;
  8. not to use the data for its own advertising purposes, profiling or sale to third parties.

5. Obligations of the Controller

  1. The Controller ensures that the processing is lawful and has an appropriate legal basis for using Lienks.
  2. The Controller informs data subjects transparently about the processing and fulfils any applicable consent and objection requirements.
  3. The Controller configures Lienks in line with its legal requirements and does not transmit data that is not necessary for the agreed analytics purpose.
  4. The Controller must not transmit, via URL paths or freely chosen event names, any special categories of personal data under Art. 9 GDPR, data relating to criminal convictions and offences under Art. 10 GDPR, login credentials, payment data or directly identifying information.
  5. The Controller informs Lienks without undue delay if it detects errors or irregularities in the processing.

6. Data subject rights

  1. Requests from data subjects that reach Lienks directly and clearly concern the Controller’s data are forwarded to the Controller without being handled on their merits, unless Lienks is legally required to handle them itself.
  2. Within the scope of the available functions and information, Lienks assists the Controller with access, rectification, erasure, restriction, data portability and objection.
  3. The Controller remains responsible for reviewing and responding to data subject requests.

7. Security of processing

  1. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, Lienks implements appropriate technical and organisational measures in accordance with Art. 32 GDPR.
  2. The Controller confirms that the measures described in Annex 2 are appropriate for the risk associated with its use. The Controller informs Lienks if its specific use case involves higher requirements.
  3. Lienks may change individual measures, provided the agreed level of security is not reduced.

8. Personal data breach notification

  1. Lienks informs the Controller without undue delay after becoming aware of a personal data breach affecting data processed on the Controller’s behalf.
  2. The notification contains, where available, a description of the nature of the breach, the data and persons concerned, the likely consequences and the measures taken or proposed.
  3. Lienks assists the Controller to a reasonable extent with its obligations under Art. 33 and 34 GDPR. The decision whether to notify the supervisory authority or data subjects lies with the Controller.

9. Sub-processors

  1. The Controller grants Lienks general authorisation to engage the sub-processors listed in Annex 3.
  2. Lienks informs the Controller before adding or replacing a sub-processor. The Controller may object on objectively justified data protection grounds within 14 days of being informed.
  3. If the parties cannot reasonably resolve the objection, the Controller may terminate the service affected by the change as of the date the change takes effect.
  4. Lienks contractually binds sub-processors to data protection obligations that essentially correspond to those in this DPA. Lienks remains responsible to the Controller for the fulfilment of these obligations.

10. Processing outside the European Economic Area

  1. Under the current technical setup, the analytics data described in Annex 1 is processed in Germany.
  2. Processing in a third country only takes place on documented instructions from the Controller or if the requirements of Art. 44 et seq. GDPR are met.

11. Deletion and return

  1. During the term, the Controller can delete websites and analytics data using the functions provided. The data is removed from the active systems without undue delay and cannot be restored there.
  2. After the end of the processing, Lienks deletes or returns the personal data processed on the Controller’s behalf, at the Controller’s choice, unless there is a legal obligation to retain it. Unless instructed otherwise, Lienks deletes the data from the active systems no later than 30 days after the underlying account has ended.
  3. Deleted data may remain in encrypted backups for up to 30 days. Backups are used solely for recovery after technical failures, are not used for ongoing operations and are overwritten on a regular schedule.
  4. Statutory retention requirements remain unaffected. The data concerned is blocked for other purposes.

12. Documentation and audits

  1. On request, Lienks provides the Controller with the information necessary to demonstrate compliance with Art. 28 GDPR.
  2. The Controller may carry out reasonable audits itself or through an auditor bound to confidentiality. Audits must generally be announced at least 14 days in advance, carried out during normal business hours and limited to what is necessary.
  3. To protect other customers, trade secrets and system security, Lienks may primarily provide suitable documentation, information or existing audit reports. Direct access to systems or data of other customers is excluded.
  4. Additional effort for audits may be charged at a reasonable rate after prior agreement, unless the audit reveals a material breach for which Lienks is responsible.

13. Liability

The liability of the parties is governed by Art. 82 GDPR, other statutory provisions and the provisions of the underlying contract. The rights of data subjects are not limited by this.

14. Final provisions

  1. Amendments and additions to this DPA must be made in text form. This also applies to any change to this text form requirement.
  2. Should any provision be or become invalid, the validity of the remaining provisions remains unaffected.
  3. To the extent permitted, German law applies.
  4. This DPA is concluded electronically. Details are set out in Section 16.

15. Changes to this DPA

  1. Lienks may amend this DPA if this is necessary due to a change in the law, the sub-processors or the scope of the service. The agreed level of protection is not reduced by this.
  2. Lienks informs the Controller of changes by email at least 30 days before they take effect. Section 9 applies to sub-processors.
  3. If the Controller does not agree with a change, it may object to the change and terminate the contract as of the date the change takes effect. The current version is available on lienks.com.

16. Acceptance and contact

  1. This DPA is effective as of October 8, 2026 and replaces any previously agreed data processing arrangements between the Controller and Lienks.
  2. By registering for or using Lienks, this DPA becomes part of the contract between the Controller and Lienks. No separate signature is required.
  3. If the Controller has questions about this DPA, it can contact Lienks at philip@lienks.com.

Annex 1 – Description of the processing

1. Subject matter and purpose

Provision of a web analytics service to collect, store, aggregate and display the usage of the websites integrated by the Controller.

2. Nature of the processing

Collecting or receiving, transmitting, temporary processing, pseudonymising, organising, storing, aggregating, analysing, displaying and deleting analytics data.

3. Categories of data subjects

  • Visitors and users of the Controller’s websites
  • Where applicable, employees, customers or prospects of the Controller, insofar as they use its websites

4. Categories of personal data

  • Timestamp and visited website, page or URL path
  • Referrer domain
  • Browser, operating system and device information
  • Approximate geographic location, in particular country
  • Session, entry, exit and interaction information
  • Custom event names defined by the Controller
  • Daily rotating pseudonymous visitor ID
  • Flag for detected bot traffic
  • IP address and technical browser information solely for short-term technical processing and for creating the pseudonymous visitor ID; the IP address is not permanently stored as analytics data

Special categories of personal data under Art. 9 GDPR and data under Art. 10 GDPR are not part of the agreed processing.

5. Duration and deletion periods

  • Analytics data is generally stored for as long as the account or the corresponding website exists and the Controller does not request deletion.
  • Deletion triggered by the Controller removes the data from the active systems without undue delay.
  • Backups are overwritten within 30 days at the latest.
  • After the end of the processing, the provisions of Section 11 apply.

6. Place of processing

Hetzner data centre in Falkenstein, Germany.

Annex 2 – Technical and organisational measures

1. Physical access and security

  • Servers operated in a data centre of Hetzner Online GmbH in Falkenstein, Germany
  • Physical security measures of the data centre provided by Hetzner
  • No physical access by Lienks to the data centre infrastructure

2. System access control

  • Administrative server access exclusively via SSH keys
  • Administrative access restricted to approved IP addresses
  • No direct administrative login as root; a separate user account is used
  • Access to the production system exclusively by the operator of Lienks
  • Multi-factor authentication for Hetzner, Firebase and Stripe
  • No sharing of administrative credentials

3. Data access control and tenant separation

  • Role- and permission-based access within the application
  • Logical separation of data by workspace and website
  • Access restricted to the data required to perform the task
  • Protection of the last administrative workspace access against accidental removal

4. Transmission control

  • Encrypted transmission for publicly accessible services via TLS/HTTPS
  • Encrypted administrative connections via SSH
  • No permanent storage of full IP addresses as analytics data

5. Storage and pseudonymisation

  • Production data stored in PostgreSQL and ClickHouse on servers in Falkenstein, Germany
  • Daily rotating pseudonymous visitor ID in the default cookieless mode
  • Short-term processing of IP address and browser information to create the visitor ID, without permanently storing the IP address as analytics data

6. Availability and recoverability

  • Daily encrypted backups on a Hetzner Storage Box in Germany
  • Retention of seven daily and four weekly backups
  • Overwritten on a regular schedule; deleted customer data remains in backups for no more than 30 days
  • Backups are used solely for recovery after technical failures
  • Regular security and system updates as part of operations

7. Integrity and input control

  • Validation of incoming analytics data and assignment to a website
  • Logging of security- and operations-relevant events, insofar as necessary for operation, troubleshooting and abuse detection
  • Custom events limited to event names; no freely transmittable event properties within the agreed scope

8. Organisational control

  • Access to personal data only insofar as necessary for operation, support, security or troubleshooting
  • Confidential handling of all data processed on behalf of the Controller
  • Documented process for security incidents and notifications
  • Regular review and adjustment of the measures as needed

Annex 3 – Approved sub-processors

Sub-processorAddress / locationServicePlace of processing
Hetzner Online GmbHIndustriestr. 25, 91710 Gunzenhausen, GermanyServer hosting, data centre infrastructure and encrypted backups via Storage BoxFalkenstein, Germany

Under the current setup, Firebase/Google for account authentication, Stripe for payments, netcup for the email inbox and Brevo for transactional messages do not process any analytics data of website visitors on behalf of the customer. These separate processing activities involving account, contract, payment or communication data are therefore not part of this DPA and are described in the Lienks privacy policy.