Last updated: May 9, 2026 · Effective version
This Data Processing Agreement (“DPA”) forms part of and is incorporated by reference into the Clamp Terms of Service. By using the Clamp service to process Personal Data, you (the “Customer”) and Clamp Analytics (“Clamp”, “we”, “Processor”) enter into this DPA. No separate signature is required for the DPA to be effective.
On request, Clamp will counter-sign a PDF copy of this DPA for your procurement file. Email privacy@mail.clamp.sh with the subject “DPA countersign request.”
Agency and reseller use.The Customer may use the Services to process Personal Data on behalf of its own customers (“End Clients”), in which case the Customer acts as the Processor and Clamp acts as the Sub-Processor in relation to those End Clients. This DPA contemplates and authorises such use.
Terms used in this DPA have the meanings given to them in the EU General Data Protection Regulation 2016/679 (“GDPR”). “Personal Data”, “Controller”, “Processor”, “Sub-Processor”, “Data Subject”, “Processing”, and “Personal Data Breach” have the meanings given in Article 4 GDPR.
“Services” means the analytics services provided by Clamp at clamp.sh, including the tracking SDK, MCP server, API, and dashboards. “Customer Data” means any data (including Personal Data) that the Customer submits to or generates through the Services.
Subject matter: Provision of the Services to the Customer under the Terms of Service.
Duration:The term of the Customer's subscription, plus any post-termination period required to return or delete Customer Data per Section 11.
Nature and purpose: Collection, aggregation, storage, and display of pseudonymous event data so the Customer can analyse traffic and user behaviour on their own website or application. Processing is performed by automated means.
Categories of Personal Data processed:
Categories of Data Subjects:end users of the Customer's website or application; and authorised users of the Customer's Clamp account.
Clamp shall, in accordance with Article 28(3) GDPR:
The Customer is responsible for ensuring that it has all necessary legal bases, consents, and notices in place under applicable data protection law for the Personal Data it submits to the Services. The Customer shall provide instructions to Clamp in a form documented through the Customer's use of the Services and through any subsequent written communications with Clamp.
The Customer provides general authorisation for Clamp to engage Sub-Processors as listed at clamp.sh/sub-processors. Clamp will give the Customer at least 30 days' advance notice before adding a new Sub-Processor. During the notice period, the Customer may object on reasonable grounds related to data protection. If the parties cannot agree on a resolution, the Customer may terminate the affected Services for convenience.
Clamp shall impose data protection obligations on each Sub-Processor by written contract that are no less protective than those in this DPA, and remains liable to the Customer for its Sub-Processors' performance of those obligations.
All visitor analytics data processed by Clamp is stored exclusively within the European Economic Area (Germany). Where transfers to Sub-Processors outside the EEA are necessary (for billing, transactional email, or optional OAuth sign-in), Clamp relies on:
See clamp.sh/sub-processors for the per-Sub-Processor transfer mechanism.
Clamp implements technical and organisational measures appropriate to the risk, in accordance with Article 32 GDPR, including but not limited to:
Hetzner Online GmbH's full technical and organisational measures are published at hetzner.com/AV/TOM_en.pdf and the binding DPA between Clamp and Hetzner at hetzner.com/AV/DPA_en.pdf. Additional security documentation is available on request to privacy@mail.clamp.sh.
Clamp will notify the Customer without undue delay, and in any event within 72 hours of becoming aware of a Personal Data Breach affecting the Customer's Personal Data. The notification will include the information required by Article 33(3) GDPR to the extent then known, and Clamp will provide updates as further information becomes available. Notifications will be sent to the Customer's administrative contact on file.
On reasonable prior written notice (no more frequent than once per twelve-month period, except where required by a supervisory authority or following a Personal Data Breach), Clamp will make available the information necessary to demonstrate compliance with this DPA. The Customer may request additional documentation (security overviews, sub-processor agreements, third-party audit reports if available) under reasonable confidentiality terms. On-site audits are by mutual agreement and at the Customer's cost.
On termination or expiry of the Services, the Customer may export their data via the dashboard and the public API during a 30-day return window. After the return window, Clamp will delete all Personal Data within 30 days, except where applicable law requires further retention (e.g. financial records retained for statutory periods). Backups containing Personal Data are overwritten in the normal backup rotation; Clamp does not access backed-up Personal Data after deletion of the live copy.
Clamp will, taking into account the nature of the processing, assist the Customer by appropriate technical and organisational measures, insofar as possible, for the fulfilment of the Customer's obligation to respond to requests for exercising the rights of Data Subjects under Chapter III GDPR.
Each party's liability arising out of or related to this DPA is subject to the limitations of liability set out in the Terms of Service.
This DPA is governed by the law and subject to the jurisdiction specified in the Terms of Service. Where the Terms of Service do not specify a forum suitable for GDPR disputes, the parties agree to the courts of the Customer's habitual residence (where the Customer is a Data Subject) or the courts of the Federal Republic of Germany (in all other cases).
We may update this DPA from time to time. Material changes will be announced via email (where the Customer has opted in to communications) and reflected in the “Last updated” date at the top of this page. Continued use of the Services after the effective date of a change constitutes acceptance of the updated DPA.
For DPA-related questions, counter-signature requests, or privacy enquiries, email privacy@mail.clamp.sh.