Data processing agreement (dpa) — Umami

Cited by

Facts read from this source

• DPA auto acceptance Report an error

  “This DPA is incorporated into the Agreement by reference and applies automatically when Umami processes Customer Personal Data on Customer’s behalf in connection with the Services.”

• DPA no signature required Report an error

  “This DPA is legally binding on the parties without a handwritten, electronic, or countersignature.”

• DPA scope exclusion self hosted Report an error

  “Customer’s use of self-hosted or open-source Umami software where Umami does not receive or Process the relevant data”

• DPA special categories prohibited Report an error

  “Customer will not submit to the Services any special categories of Personal Data under Article 9 of the EU GDPR, data relating to criminal convictions and offences, protected health information, payment-card data, government identification numbers, or other highly sensitive regulated data unless the Agreement expressly permits that data”

• No data sale Report an error

  “Umami will not sell Customer Personal Data, share Customer Personal Data for cross-context behavioral advertising, or retain, use, or disclose Customer Personal Data outside the direct business relationship between Umami and Customer”

• Security incident notification Report an error

  “Umami will notify Customer without undue delay after becoming aware of a Security Incident.”

• Assistance dsr Report an error

  “Taking into account the nature of the Processing, Umami will provide reasonable assistance through appropriate technical and organizational measures to help Customer respond to Data Subject Requests.”

• Assistance fees Report an error

  “Umami may charge reasonable fees for unusually burdensome or repetitive assistance not included in the Services, except to the extent the request results from Umami’s breach of this DPA.”

• List URL Report an error

  “Umami’s current Subprocessors are listed at: https://umami.is/subprocessors”

• Notice period days Report an error

  “Umami will provide at least fifteen (15) days’ advance notice before authorizing a new Subprocessor to Process Customer Personal Data, except where an urgent change is reasonably necessary”

• Objection window days Report an error

  “Customer may object to a new Subprocessor by sending Umami a written objection within ten (10) days after receiving notice.”

• Deletion on termination Report an error

  “Upon termination or expiration of the Services, and at Customer’s choice where required by Applicable Data Protection Law, Umami will delete or return Customer Personal Data in accordance with the Agreement”

• Backup deletion Report an error

  “Customer Personal Data remaining in backups, archives, or disaster-recovery systems will be protected under this DPA, isolated from ordinary use, and deleted in accordance with Umami’s ordinary retention and backup cycles”

• Audit frequency limit Report an error

  “an audit must: occur no more than once in any twelve-month period; be requested on at least thirty (30) days’ written notice;”

• Audit costs Report an error

  “Customer will bear its audit costs and reimburse Umami for reasonable costs incurred in supporting the audit, except where the audit identifies a material breach of this DPA by Umami.”

• Transfer mechanisms Report an error

  “an applicable adequacy decision; the EU SCCs; the UK Addendum; another approved contractual mechanism; or another lawful basis permitted by Applicable Data Protection Law.”

• UK addendum Report an error

  “Where Customer Personal Data protected by UK Data Protection Law is subject to a Restricted Transfer, the UK Addendum is incorporated into this DPA”

• Scc modules Report an error

  “Module Two — Controller to Processor applies where Customer is a Controller and Umami is a Processor. Module Three — Processor to Processor applies where Customer is a Processor and Umami is a Subprocessor.”

• Scc governing law Report an error

  “In Clause 17, Option 1 applies, and the EU SCCs are governed by the law of Ireland. Under Clause 18, disputes will be resolved by the courts of Ireland.”

• US state privacy role Report an error

  “Umami will act as Customer’s processor, service provider, or contractor, as applicable.”

• DPA contact email Report an error

  “Email: privacy@umami.is”

• Tom security page Report an error

  “Current public security information may be maintained at: https://umami.is/security”

• Tom encryption Report an error

  “encryption of Customer Personal Data in transit using industry-standard transport encryption; encryption at rest where supported by Umami’s infrastructure and storage providers;”

• Tom MFA Report an error

  “multi-factor authentication for privileged or administrative access where technically supported;”

• Scc docking clause Report an error

  “Clause 7, the docking clause, applies.”

• DPA processing features Report an error

  “providing dashboards, reports, funnels, journeys, cohorts, retention analysis, heatmaps, session-related functionality, and similar analytics features;”

• DPA last updated Report an error

  “Last updated August 2, 2026”

• Liability aggregated Report an error

  “Any liability arising under this DPA is aggregated with, and not in addition to, liability arising under the Agreement.”

• Subprocessor termination refund Report an error

  “If no commercially reasonable resolution is available, either party may terminate the affected Services. Umami will refund prepaid fees covering the terminated Services after the effective termination date.”

2 facts read from this page are not shown because they could not be confirmed on the page as captured.

Scores citing this record

• The Agency Developer Data access, export & self-hosting
• The Agency Developer European sovereignty
• The Data Protection Officer Data access, export & self-hosting
• The Data Protection Officer European sovereignty
• The E-Commerce Marketing Lead Data access, export & self-hosting
• The E-Commerce Marketing Lead European sovereignty
• The Growth Analyst Data access, export & self-hosting
• The Growth Analyst European sovereignty
• The Public-Sector Site Owner Data access, export & self-hosting
• The Public-Sector Site Owner European sovereignty
• The Skeptic Data access, export & self-hosting
• The Skeptic European sovereignty