Data Processing Agreement (DPA)

1. Subject matter and duration

This data processing agreement (DPA) governs the processing of personal data by turbometrics.io on behalf of the user (hereinafter the “controller”) within the scope of the Live Data feature (Real User Monitoring, RUM).

Personal data is processed exclusively within Germany, on servers of Hetzner Online GmbH (Nuremberg/Falkenstein). No transfer of personal data to third countries outside the EU/EEA takes place.

The DPA applies for the duration of the use of the Live Data feature and ends automatically when that use ends.

2. Nature and purpose of the processing

Nature of the processing: collection, transmission, storage, evaluation and erasure of performance measurement data.

Purpose: provision of the Live Data feature for analysing the load times and Core Web Vitals of the controller's website from the perspective of end users.

Type of data: anonymised technical performance data, in particular:

• load time measurements (LCP, CLS, INP, FCP, TTFB)
• device class (desktop, mobile, tablet) — derived from the screen width
• browser and operating system — derived from the user agent
• connection type and network quality (where provided by the browser)
• country of origin — determined from the IP address, which is anonymised afterwards
• an anonymous page ID for grouping metrics belonging to the same pageview

Categories of data subjects: end users of the controller's websites.

3. Obligations of the processor

turbometrics.io, as processor, undertakes:

• to process data exclusively on documented instructions from the controller — use of the Live Data feature counts as such an instruction
• to take appropriate technical and organisational measures (TOMs) to protect the data
• to ensure that persons authorised to process the data are bound to confidentiality
• to inform the controller without undue delay if an instruction given infringes applicable law
• at the controller's choice, to erase all data after the end of the processing and to destroy existing copies
• to make available to the controller all information necessary to demonstrate compliance with this DPA

4. Obligations of the controller

The controller undertakes:

• to document the collection of performance data in its privacy policy
• to ensure that an appropriate legal basis for the data collection exists (typically Art. 6(1)(f) GDPR — legitimate interest in the technical optimisation of the web offering)
• to embed the tracking snippet only on websites for which it is authorised
• to inform end users about the data collection — turbometrics.io provides a ready-made privacy text block in the dashboard

5. Technical and organisational measures (TOMs)

Location and data sovereignty: All personal data is processed and stored exclusively on servers in Germany (Hetzner Online GmbH, data centres in Nuremberg and Falkenstein). No processing of personal data takes place outside Germany. Hetzner Online GmbH is certified to ISO 27001 and has concluded a data processing agreement pursuant to Art. 28 GDPR with turbometrics.io.

Scan workers: To carry out synthetic website scans, scan workers are used temporarily in various regions (currently Germany and Finland). These scan workers retrieve exclusively publicly accessible URLs and do not process any personal data. Scan results (technical measurements) are stored exclusively on German servers.

Pseudonymisation and anonymisation: IP addresses are used exclusively to determine the country of origin. The last octet of the IPv4 address, or the last 80 bits of the IPv6 address, is set to zero before storage. The complete IP address is not stored. Page IDs are randomly generated strings with no personal reference.

Encryption: All data transfers take place exclusively over HTTPS/TLS. Data is transmitted in encrypted form and stored on encrypted systems in German data centres.

Access control: Access to production systems is restricted to authorised persons and requires authentication. Customer data is isolated from other customers' data by tenant separation.

Erasure concept: Performance data is erased automatically after the period provided for in the plan booked (14 to 180 days) and is then irretrievably destroyed.

6. Sub-processors

turbometrics.io uses the following sub-processors:

Hetzner: all personal data is processed and stored exclusively in German data centres (Nuremberg/Falkenstein).

Cloudflare: Cloudflare is responsible for the CDN and DDoS protection of turbometrics.io. The beacon endpoint (/api/tm) is configured as “cache bypass” — Cloudflare forwards requests directly without storing content. Connection metadata (IP address, timestamp) may be processed temporarily by Cloudflare in the process. Cloudflare is certified under the EU-US Data Privacy Framework.

Brevo: used exclusively for sending system e-mails (alerts, reports). No processing of RUM performance data.

The controller consents to the use of these sub-processors by using the Live Data feature. Changes are published in good time at turbometrics.io/dpa.

7. Right to issue instructions

The controller may issue instructions on the processing at any time. Instructions are generally given through the settings in the turbometrics application (e.g. erasure of data, deactivation of the Live Data feature, adjustment of the sampling rate).

For instructions going beyond this: [email protected]

8. Personal data breaches

turbometrics.io informs the controller without undue delay — where possible within 24 hours — of any personal data breach concerning the controller's data.

Notifications are sent by e-mail to the e-mail address stored in the user account.

For questions on data security you can reach us at: [email protected]

9. Termination

When the use of the Live Data feature or of the turbometrics account ends, all associated performance data is erased within 30 days.

Earlier erasure can be requested at any time through the application (deactivating the Live Data feature) or by e-mail to [email protected].

10. Final provisions

This DPA is governed by German law.

Changes are published at turbometrics.io/dpa. Continued use of the Live Data feature after a new version has been published constitutes consent to the amended version.

In the event of contradictions between this DPA and the Terms and Conditions, this DPA prevails for questions of processing on behalf of the controller.

Contact for data protection enquiries: [email protected]