Data Processing Addendum
How Anacoic handles personal data on your behalf, as required by Article 28 of the GDPR.
Last updated: October 25, 2026
This Data Processing Addendum (“DPA”) is part of the Terms of Service between the Customer (the controller) and Syntarix (operated by SYNTARIX OLEKSII TREMBACH, registered in Warsaw, Poland) (“Syntarix”, “we”, “us”, the “Processor”). Anacoic is a product of Syntarix, operated by SYNTARIX OLEKSII TREMBACH, registered in Warsaw, Poland. It applies whenever we process personal data for you through Anacoic and covers what Article 28 of the GDPR asks for. If you are yourself a processor for your clients (for example an agency), we act as your sub-processor and this DPA applies in the same way.
You don’t need to sign anything: the DPA applies automatically when you accept the Terms. If you’d like a countersigned copy for your records, email [email protected].
1. What, why and for how long
The details are in Annex I. This DPA lasts for as long as we process personal data for you.
2. We follow your instructions
We process personal data only on your documented instructions, including for transfers outside the EEA. The Terms, this DPA and your settings in Anacoic (connections, destinations and the events your sites send) are those instructions. You decide which events and identifiers your websites and stores send to Anacoic, and you’re responsible for having consent or another lawful basis for them. If we think an instruction breaks data protection rules, we’ll tell you. If the law requires us to process data in another way, we’ll tell you first unless the law forbids it.
3. Confidentiality
Everyone we allow to process the personal data is bound by confidentiality.
4. Security
We apply the measures in Annex II and keep them appropriate to the risk. We may improve them over time, but never in a way that lowers the overall level of protection.
5. If something goes wrong
We tell you without undue delay, and within 48 hours of becoming aware of a personal data breach affecting your data. We share what we know (what happened, what kinds of data and roughly how many people, likely consequences, what we’re doing about it) and keep you updated. This gives you time to meet your own 72-hour deadline.
6. Helping you
Taking into account what we do and the information we have, we help you: answer requests from data subjects (and forward any request we receive directly), carry out data protection impact assessments and prior consultations, and meet your security and breach obligations.
7. Subprocessors
You give us general permission to use the subprocessors listed on our subprocessors page. We give at least 30 days’ notice by email to the account owner before adding or replacing one. You can object on reasonable data protection grounds during that time. If we can’t find a solution together, you may end the affected service and get a pro-rata refund of fees you paid in advance. We give each subprocessor the same data protection duties as in this DPA and remain responsible for them.
Platforms that you connect or choose as destinations (for example Meta, Google or TikTok) receive data on your instruction under your own agreement with them; they are not our subprocessors.
8. Data outside the EEA
When personal data is transferred outside the European Economic Area, we make sure there is a valid safeguard: an adequacy decision (including the EU–US Data Privacy Framework for certified recipients) or the European Commission’s Standard Contractual Clauses (Decision 2021/914), Module 3 (processor to processor) with our subprocessors, plus extra measures where needed. To the extent you transfer personal data to us from outside the EEA in a way that needs them, Module 2 (controller to processor) of those clauses applies between us and is included by reference.
9. Deleting or returning data
When the service ends, or when you delete a site or your account, we delete the related personal data without undue delay and at the latest within one month (backups roll over within a further 30 days), unless the law requires us to keep it. Before that, you can export your reports from the app, and if you ask us before deletion, we return the personal data to you in a common, machine-readable format first.
10. Checking our work
We make available the information you need to see that we follow this DPA, answer a reasonable written questionnaire once a year, and allow audits by you or an auditor you appoint, with 30 days’ notice, during business hours, at your cost, under confidentiality, and limited to what our documentation can’t already show.
11. Responsibility and order of documents
Responsibility under this DPA follows the limits in the Terms. If the Terms and this DPA say different things about personal data, this DPA wins.
Annex I: Details of processing
| Item | Description |
|---|---|
| Whose data | Visitors and customers of your websites and stores; your own staff and the people you invite to Anacoic (for their account data we decide how it’s used, see the Privacy Policy) |
| What data | (a) Gateway events: whatever your sites send, typically event details, IP address, user agent, advertising cookie and click IDs, and identifiers you collected (for example email or phone), hashed with SHA-256 before forwarding. (b) Order facts: order ID and number, times, value, currency, status, channel (no names, contact details or addresses). (c) Ad-platform diagnostics: aggregated counts and quality scores (normally not personal data) |
| Special categories | None. Please don’t send special-category data |
| What we do with it | Collect, normalize, hash, store, aggregate, compare, send to destinations you select, delete |
| Why | Showing whether your ad and analytics platforms record your conversions; alerts and reports; forwarding conversion events to the platforms you choose, on your instructions |
| How long | Recent delivery logs: a rolling window of the most recent entries per gateway (currently the last 100; identifier names only, not values). Daily counters: about 60 days. Short-lived technical records (duplicate checks, rate limits): about 24 hours. Order facts and diagnostics: while the site is connected. Access tokens: until you disconnect. Everything: deleted as described in section 9 |
| Where | See the subprocessors page |
Annex II: Security measures
- Encryption: TLS 1.2 or newer in transit; encryption at rest by our hosting providers; platform access tokens also encrypted with AES-256-GCM and decryptable only by server code; personal identifiers hashed (SHA-256) before forwarding where the destination expects it.
- Collecting less: order facts exclude customer names, contact details and addresses; delivery logs store identifier names only; no guessing of identities and no profiles across customers.
- Access control: roles in the app (owner, admin, member); production access limited to named operators with two-factor authentication; secrets kept in the hosting providers’ secret stores.
- Keeping customers apart: every query is scoped to the customer organization, and authorization is checked in every server action and API handler, covered by automated tests.
- Availability: distributed hosting; retries for failed deliveries; database backups by the hosting provider.
- Testing and changes: automated tests and code review for every change; a separate staging environment without production data.
- Monitoring and incidents: error monitoring with reports kept for a limited period; security contact [email protected]; a written breach procedure (section 5).
- Deletion: recent delivery logs are a rolling window and daily counters expire automatically; deletion on request as described in section 9.
Annex III: Subprocessors
As listed on our subprocessors page on the day you accept the Terms, and as updated under section 7.