Data processing agreement (dpa) — Matomo

Cited by

Facts read from this source

• DPA version Report an error

  “Version 3.0 – 9 October 2025”

• Entity Report an error

  ““We”, “us” or “InnoCraft” refers to InnoCraft Ltd, 7 Waterloo Quay, PO Box 625, 6140 Wellington, New Zealand.”

• Roles Report an error

  “Customer is the data controller and InnoCraft is the data processor in relation to personal data that is processed while providing the Service.”

• DPA GDPR Report an error

  “This DPA is designed to ensure compliance with Article 28(3) GDPR.”

• International transfers Report an error

  “The transfer of personal data to InnoCraft in New Zealand is subject to the European Commission’s adequacy decision under Article 45(3) GDPR.”

• Notification Report an error

  “Prior to modifying the list of sub-processors, the Customer will be notified by email. The list will be updated within thirty (30) days of any such notification if the Customer does not legitimately object within that timeframe.”

• Breach notification Report an error

  “InnoCraft shall, without undue delay, notify the Customer by email.”

• Audit rights Report an error

  “ISO/IEC 27001 certification, Vanta compliance reports, and third-party audit summaries may serve as primary evidence of demonstrating compliance.”

• ISO 27001 Report an error

  “InnoCraft is certified to ISO/IEC 27001, the international standard for information security management, following an independent audit.”

• EU representative Report an error

  “within the European Union pursuant to Article 27(1) GDPR: ePrivacy Holding GmbH represented by Prof. Dr. Christoph Bauer”

• UK representative Report an error

  “in the UK pursuant to Article 27(1) UK GDPR: UK Representative Service for GDPR Ltd. 7 Savoy Court London WC2R 0EX”

• Provider Report an error

  “Matomo Cloud is hosted by Amazon Web Services (AWS) in European data centres (Frankfurt, with backups in Dublin).”

• Deletion Report an error

  “Upon termination of the Customer’s account, InnoCraft shall delete the Customer personal data processed under this DPA within thirty (30) days in accordance with its retention policy”

• Backup retention Report an error

  “Personal data contained in encrypted system backups may be retained for up to sixty (60) days from termination solely for backup integrity purposes”

• Export Report an error

  “Customers may export their data at any time prior to termination, and any data export requests must be submitted before the expiry of the 30-day period”

• UK GDPR Report an error

  “For transfers of personal data from the United Kingdom, InnoCraft must comply with the equivalent provisions of the UK GDPR, including, where applicable, entering into the International Data Transfer Addendum”

• Swiss addendum Report an error

  “This Addendum forms part of the Matomo Cloud DPA and governs the processing of personal data subject to the Swiss Federal Act on Data Protection (FADP)”

• US state privacy Report an error

  “governs processing of personal data of residents of the United States subject to consumer privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), the Virginia Consumer Data Protection Act (VCDPA), the Colorado Privacy Act (CPA), the Connecticut Data Privacy Act (CTDPA), the Utah Consumer Privacy Act (UCPA)”

• No data sale Report an error

  “InnoCraft will not: Use the personal data for any purpose other than for the business purposes specified in the TOS or as permitted by applicable US Privacy Laws; Sell or share personal data it processes on behalf of Customer pursuant to the TOS and DPA to any third party”

• Pseudonymisation features Report an error

  “Matomo supports multiple pseudonymisation features including IP address masking, User ID hashing, exclusion of personal parameters from URLs, and disabling or reducing the precision of geolocation data.”

• Retention configurable Report an error

  “Retention periods can be configured by the Customer.”

• Toms ISO ISMS Report an error

  “These measures form part of InnoCraft’s ISO/IEC 27001 certified Information Security Management System and are reviewed regularly to ensure ongoing effectiveness.”

• Encryption Report an error

  “Data, including user passwords and API tokens, is encrypted using industry-standard algorithms and disk-level encryption.”

• MFA Report an error

  “All systems require multi-factor authentication (MFA) and strong, unique passwords.”

• Multi tenant separation Report an error

  “Customer data in multi-tenant systems is logically and physically separated.”

• Bug bounty Report an error

  “InnoCraft operates a vulnerability management programme that includes regular automated scans, periodic penetration testing, and a responsible disclosure/bug bounty programme.”

• Bcdr Report an error

  “Business Continuity and Disaster Recovery (BCDR) plans define Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs).”

• Dpi assessments Report an error

  “Data Protection Impact Assessments are carried out to assess and mitigate risks to data subjects where processing is likely to result in high risk.”

• Vanta Report an error

  “InnoCraft operates an ISO/IEC 27001-aligned Information Security Management System (ISMS) supported by Vanta automation and compliance platform”

• Privacy contact Report an error

  “Email: privacy@matomo.org”

• List available Report an error

  “A list of sub-contractors is available to the Customer here.”

• DPA part of tos Report an error

  “This DPA forms an integral part of the Matomo Cloud Terms of Service (“TOS”).”

1 fact read from this page is not shown because it could not be confirmed on the page as captured.

Scores citing this record

• The Agency Developer Consent-free operation & data minimisation
• The Agency Developer Data access, export & self-hosting
• The Agency Developer European sovereignty
• The Data Protection Officer Consent-free operation & data minimisation
• The Data Protection Officer Data access, export & self-hosting
• The Data Protection Officer European sovereignty
• The E-Commerce Marketing Lead Consent-free operation & data minimisation
• The E-Commerce Marketing Lead Data access, export & self-hosting
• The E-Commerce Marketing Lead European sovereignty
• The Growth Analyst Consent-free operation & data minimisation
• The Growth Analyst Data access, export & self-hosting
• The Growth Analyst European sovereignty
• The Public-Sector Site Owner Consent-free operation & data minimisation
• The Public-Sector Site Owner Data access, export & self-hosting
• The Public-Sector Site Owner European sovereignty
• The Public-Sector Site Owner Pricing transparency
• The Skeptic Consent-free operation & data minimisation
• The Skeptic Data access, export & self-hosting
• The Skeptic European sovereignty