Skip to main content
Urlify

Legal

Data Processing Agreement (DPA)

Between
Controller: Customer of the “URLIFY” service
Processor: Byteman UG (haftungsbeschränkt), Platzl 1a, 80331 Munich, Germany

Effective date: 28 Oct 2026

1. Subject matter, duration, nature and purpose of processing

1.1 Subject matter: Processing of personal data in the context of URL shortening, redirection and analytics (click/usage data), as well as account and billing management.
1.2 Duration: For the term of the contract as per the Terms, including post‑termination periods for backups/logs in line with deletion periods.
1.3 Nature & purpose: Collection, storage, organization, analysis, transmission/redirection and logging — to the extent necessary to provide the service, ensure security, billing and support.

2. Categories of data subjects and data types

2.1 Data subjects: End users (clickers), customers and their users (admins/teams), communication partners.
2.2 Data types (typical): IP address, timestamps, requested short URL and target URL, referrer, user agent, device/browser information, approximate geolocation (derived from IP), UTM parameters/tags, internal IDs, log data, account/contract data, payment metadata (no full payment data — handled via Stripe), support content.
2.3 Special categories: Not intentionally processed; the Controller undertakes not to collect such data via the service, or only with an appropriate legal basis and safeguards.

3. Instructions

Processing only on documented instructions from the Controller (Terms, this DPA, admin functions, tickets).

4. Confidentiality

Persons authorised to process personal data are bound by confidentiality and are adequately trained.

5. Technical and organisational measures (TOMs)

The Processor implements and maintains, inter alia: access controls (MFA, roles, least privilege), encryption in transit (TLS) and at rest, separated environments (prod/staging), firewalls/WAF, DDoS protection, rate limiting, monitoring/alerting, regular backups and restore tests, security/access logging, privacy by design (pseudonymisation/minimisation), processes for deletion/anonymisation and export, and supply‑chain controls (DPAs/SCCs). A detailed TOM overview is provided in Annex 2.

6. Subprocessors

Permitted where a data processing agreement under Art. 28(4) GDPR is in place and equivalent obligations are imposed. The current list (including purpose and location) is published at urlify.eu/subprocessors; material changes are announced in advance with reasonable notice. The Controller may object for good cause; failing agreement, a special termination right applies.

7. Third‑country transfers

Where transfers outside the EU/EEA occur, the Processor provides appropriate safeguards (notably the EU Standard Contractual Clauses) and supplemental measures.

8. Assistance

Reasonable assistance with data subject requests (Arts. 12–23 GDPR), DPIAs (Art. 35), notifications (Arts. 33/34) and security measures (Art. 32); reasonable fees may apply.

9. Personal data breach notification

Notification without undue delay, at the latest within 48 hours after becoming aware, providing the available information under Art. 33(3) GDPR, with rolling updates.

10. Deletion and return of data

Upon termination: deletion/anonymisation after 30 days; before that, export via the customer account where available. Statutory retention obligations remain unaffected.

11. Evidence and audits

Provision of necessary information (policies, certifications, redacted pen‑test excerpts). Audits/inspections on reasonable prior notice; confidentiality/trade secrets preserved; no more than once per year, except for cause.

12. Liability

The liability provisions of the Terms apply accordingly; mandatory statutory liability remains unaffected.

13. Miscellaneous; order of precedence and venue

In case of conflict, this DPA prevails over the Terms. Venue: Munich, Germany.

Annex 1 – List of subprocessors (as of 28 Oct 2026)

  • OVH SAS (OVHcloud) — Hosting (VPS) for application, databases, cache, analytics database, logs and backups; Location: Germany (Frankfurt, Limburg); Safeguards: DPA.
  • Cloudflare, Inc. — DNS and object storage (R2) for profile pictures; Location: EU (R2 bucket), group‑wide possible; Safeguards: DPA, SCC, EU‑US Data Privacy Framework where applicable.
  • Auth0 (Okta, Inc.) — Authentication/sign‑in; Location: EU (tenant hosted exclusively in the EU), group access from third countries possible; Safeguards: DPA, SCC, EU‑US Data Privacy Framework where applicable.
  • Stripe Payments Europe, Ltd. — Payment processing, subscription and invoice management; Location: EU (primary), group‑wide possible; Safeguards: DPA, SCC as applicable.
  • Resend, Inc. — Transactional email; Location: EU data residency where available; possibly global; Safeguards: DPA, SCC as applicable.

For website analytics (Google Ireland Limited, consent only) and the contact form (Formspree, Inc.), Byteman acts as controller itself; they do not involve processing on behalf of customers and are listed in the Privacy Policy and at /subprocessors.

Annex 2 – Technical and organisational measures (short form)

Organisation/policies; roles/permissions (least privilege), MFA for administrative access; logging/review; infrastructure: self-operated container environment on OVH VPS in Germany; authentication via Auth0; encryption (TLS 1.2+) in transit, encryption at rest where supported by the hosting; tenant separation/minimisation (IP addresses are not stored in click analytics); firewalls, rate limits; monitoring/alerting; regular backups and restore tests; versioned deployments, code reviews, CI/CD, rollback; secrets management and rotation; server logs retained for 30 days, click analytics per plan (90/180 days); 30‑day export window after termination; supply chain with DPA/SCC and ongoing evaluation.

Annex 3 – Instruction channel & contacts

Instructions via the admin console or contact@urlify.eu. Privacy contact: contact@urlify.eu.