YOM

Data Processing Addendum

Last updated:

YOM is run by three companies in the same group. Which one you deal with depends on where you are. For a business account, that is the country of the business's billing address.

  • India: Aapastech Private Limited (CIN U72900DL2022PTC395508; registered office 8/3, 2nd Floor, Roop Nagar, Delhi 110007, India). It is the data fiduciary for your personal data under Indian law.
  • European Union and United Kingdom: Aapastech OÜ (registry code 16453146, VAT EE102489493, Tornimäe tn 3 // 5 // 7, 10145 Tallinn, Estonia). It is the controller of your personal data under the GDPR and the UK GDPR.
  • Everywhere else: 14818032 Canada Inc. (Burlington, Ontario, Canada). It is the controller of your personal data.

The three companies share engineering, hosting and support, and each processes personal data for the others under a written intra-group agreement. In this document “YOM”, “we” and “us” mean whichever of them you deal with.

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between the company named above that you deal with (“Processor”, “we”) and the customer (“Customer”, “you”). It applies automatically when you accept the Terms; no separate signature is needed. If you need a countersigned copy, email contact@aapastech.com. If you turn on YOM Intent, the YOM Intent Addendum supplements this DPA.

1. Scope and roles

This DPA applies when we process Customer Personal Data in providing the Service. For Customer Personal Data, you are the controller (or a processor acting for your own client, in which case we are your sub-processor), and we are your processor or service provider. Each party will comply with the Data Protection Laws that apply to it.

Accounts a partner opens. When a Partner (section 3 of the Terms) opens and runs an account for one of its own customers, that customer is the controller, the Partner is its processor, and we are the Partner’s sub-processor. The Partner gives us instructions under this DPA and is responsible for having a lawful agreement with its customer. When the customer claims the account, this DPA applies directly between the customer and us, and the Partner keeps only the access the customer allows.

For customers in the European Union and the United Kingdom, the processor is Aapastech OÜ, and this DPA is the contract that Article 28 of the GDPR and of the UK GDPR requires. Aapastech OÜ engages Aapastech Private Limited and 14818032 Canada Inc. as Sub-processors (section 6).

If you turn on YOM Intent, the YOM Intent Addendum supplements this DPA for that processing. If they conflict on YOM Intent processing, the Intent Addendum prevails.

2. Definitions

  • Data Protection Laws: all privacy and data-protection laws that apply to the processing, which may include India’s Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, the Information Technology Act, 2000 and the rules made under it, PIPEDA and Canadian provincial laws (including Quebec’s Law 25), the EU GDPR, the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and US state privacy laws such as the CCPA as amended by the CPRA.
  • Customer Personal Data: personal data or personal information within Customer Data (as defined in the Terms) that we process for you.
  • Sub-processor: a third party we engage that processes Customer Personal Data.
  • Personal Data Breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data in our or our Sub-processors’ systems.
  • Terms such as controller, processor, data subject and processing have the meanings given in the GDPR, or the nearest equivalent in other Data Protection Laws.

3. Processing on instructions

We process Customer Personal Data only on your documented instructions. Your instructions are: the Terms and this DPA; your configuration and use of the Service (including the settings, destinations, exports, portals and reports you set up); turning on YOM Intent features, as described in the YOM Intent Addendum; and other reasonable written instructions consistent with the Terms. If we believe an instruction infringes Data Protection Laws we will tell you, and we may decline to follow it. If the law requires us to process Customer Personal Data otherwise, we will tell you first unless the law forbids it. Annex 1 describes the processing.

4. Customer obligations

You are responsible for the lawfulness of the Customer Personal Data you send and of your instructions, including having a lawful basis, giving notices and obtaining consents for collection and for every destination you configure, and for honouring End Users’ choices. In the European Union and the United Kingdom this includes any consent the ePrivacy rules require before anything is stored on, or read from, an End User’s device. You will not send special categories of data or other data prohibited by the Acceptable Use Policy. You will keep your credentials secure.

5. Confidentiality of personnel

We ensure that people we authorise to process Customer Personal Data are bound by confidentiality obligations and access it only as needed to provide, secure and support the Service.

6. Sub-processors

  • You give general authorisation for us to engage Sub-processors. Our current Sub-processors are listed on our sub-processors page.
  • We will give at least 30 days’ notice before a new Sub-processor processes Customer Personal Data, by updating that page and, if you have asked to receive notices (email contact@aapastech.com with the subject “Sub-processor notices”), by email. In an emergency affecting security or continuity of the Service we may give shorter notice.
  • You may object on reasonable data-protection grounds within that notice period. We will try in good faith to address the objection. If we cannot, you may terminate the affected Service, and we will refund any prepaid Fees for the period after termination.
  • Our group companies. Aapastech Private Limited (India) and 14818032 Canada Inc. (Canada) each act as a Sub-processor for the other, and both act as Sub-processors for Aapastech OÜ (Estonia), for engineering, hosting operations, support and billing, under a written intra-group agreement whose terms are no less protective than this DPA. All three companies are listed on the sub-processors page.
  • We impose data-protection obligations on each Sub-processor that are no less protective in substance than this DPA, and we remain responsible for their performance as the law requires.
  • Destinations and connectors you configure (such as webhooks, Meta, Google Analytics, storage buckets, data warehouses, Shopify, WooCommerce or Looker Studio, and the Meta, Google Ads and Klaviyo accounts you connect to YOM Intent) are recipients you choose, not our Sub-processors.

7. Security measures

We implement appropriate technical and organisational measures to protect Customer Personal Data, taking into account the nature of the processing and the risks. The measures in place at the date above include:

  • Encryption in transit: all public endpoints are served over HTTPS/TLS through Cloudflare.
  • Credential protection: passwords are stored as salted bcrypt hashes; API keys are stored as hashes; secret keys, destination credentials and multi-factor authentication secrets are encrypted at rest with AES-GCM; recovery codes are stored as hashes; embed tokens are signed and expire within 24 hours.
  • Access control: role-based access (owner, admin, analyst, viewer), scoped API keys, keys and tokens that can be bound to one project or sub-tenant, origin allow-lists for embeds, and multi-factor authentication available to every user.
  • Separation of customers: each organisation’s data is held in its own database or partitioned by organisation and project, and every API request is checked against the caller’s organisation and project.
  • Data minimisation by default: no persistent identifiers without consent; query strings stripped and referrers reduced to a host in browser events; personal-looking parameters scrubbed from browser events; IP addresses and raw user agents not stored in event records.
  • Integrity of data out: webhook deliveries are signed with HMAC-SHA256 and carry stable event ids; delivery attempts are logged.
  • Abuse protection: rate limiting on the API and ingest, request-size limits and bot filtering.
  • Accountability: audit records of administrative actions.
  • Backups: the platform and analytics databases are backed up daily, and each backup is kept for 30 days.
  • Infrastructure: physical and environmental security, and resilience of the underlying platform, are provided by Cloudflare.
  • Logs: security and administrative events are logged; we are extending log retention to 180 days across all systems by 31 December 2026.

We may update these measures as long as the overall level of protection is not materially reduced. You are responsible for the security of your own systems, credentials and configuration. We do not hold third-party security certifications or attestations at the date above.

8. Personal data breaches

We will notify you of a Personal Data Breach without undue delay and in any case within 24 hours of becoming aware of it. That gives you time to report it, where those duties apply to you, to the Data Protection Board of India within 72 hours and to CERT-In (the Indian Computer Emergency Response Team) within 6 hours of it being brought to your notice. The notice will describe, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. We will update you as more information becomes available, include the details the Digital Personal Data Protection Rules, 2025 require you to give the Board as far as we know them, take reasonable steps to contain and remedy the breach, and give reasonable help with your own notification obligations. Our notice is not an admission of fault. Unsuccessful attempts that do not compromise security (such as pings, port scans or blocked log-in attempts) are not breaches.

9. Assistance and data-subject requests

Taking into account the nature of the processing, we will give you reasonable help to respond to requests from data subjects and to carry out data-protection impact assessments and prior consultations, mainly through the Service’s own controls and documentation. The Service lets you find, export and erase one End User’s events by visitor id, user id or a hash of their email address, from the dashboard or the API. Copies held in our analytics engine cannot be erased one by one; they expire 90 days after they were written, and the Service leaves the erased person out of your reports and exports until then. If we receive a request from your End User, we will refer it to you and not respond ourselves except to say so, unless the law requires otherwise. Help beyond the Service’s standard functionality may be charged at reasonable cost.

10. Audits

On written request, no more than once a year (or after a Personal Data Breach, or where a regulator requires), we will give you information reasonably necessary to show compliance with this DPA, such as written answers to a security questionnaire, descriptions of our controls, and our Sub-processors’ available certifications or reports. You agree that this documentation satisfies your audit rights, including under the Standard Contractual Clauses, unless a regulator requires more. Any on-site or further audit must be agreed in advance, at your cost, during business hours, with reasonable notice, by an auditor bound by confidentiality, and without access to other customers’ data.

11. International transfers

Our three companies are based in India, Estonia and Canada. Aapastech Private Limited and 14818032 Canada Inc. run the Service for the whole group and can access Customer Personal Data, and the Service runs on Cloudflare’s global network, so Customer Personal Data may be processed in India, Canada, the European Union, the United States and other countries. We do not commit to storing data in any particular country. Where Data Protection Laws restrict a transfer:

  • Transfers of personal data out of India follow section 16 of the Digital Personal Data Protection Act, 2023. We will not transfer it to any country the Government of India restricts.
  • Customer Personal Data of customers in the European Union and the United Kingdom is processed by Aapastech OÜ as your processor. Its transfers to 14818032 Canada Inc. in Canada rely on the European Commission’s adequacy decision for Canada (Decision 2002/2/EC, for commercial organisations subject to PIPEDA) and on the United Kingdom’s adequacy regulations for Canada.
  • Its transfers to Aapastech Private Limited in India, and to Sub-processors in countries without an adequacy decision, are made under the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, Module 3 (processor to processor), which are incorporated by reference: clause 7 (docking) applies; under clause 9 option 2 (general authorisation) applies with the notice period in section 6; the optional language in clause 11 does not apply; under clauses 17 and 18 the law and courts of Estonia apply; Annex I is Annex 1 below; Annex II is section 7; and Annex III is our sub-processors page.
  • For the United Kingdom, the International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the Information Commissioner (version B1.0) is incorporated for the same transfers, with its tables completed by this section and Annex 1, and either party may end it as allowed by its section 19.
  • For Switzerland, the Standard Contractual Clauses apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection, and the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority where applicable.

If these clauses conflict with the rest of this DPA, the clauses prevail.

12. US state privacy laws

Where the CCPA or similar US state laws apply, we are your service provider or processor. We will not: sell or share Customer Personal Data; retain, use or disclose it for any purpose other than the business purposes in the Terms, or outside our direct business relationship with you; or combine it with personal information we receive from others, except as those laws permit. We will comply with the obligations those laws place on service providers, give the same level of privacy protection they require, and tell you if we can no longer meet them. You may take reasonable steps to stop and remediate unauthorised use. We certify that we understand these restrictions. The one exception is YOM Intent audience exports, for which the YOM Intent Addendum treats us as a third party and sets out the contract terms the CCPA regulations require.

13. Return and deletion

During the term you can export Customer Data with the Service’s tools. When you close your account or delete a project, or the Service is terminated, collection stops at once and nothing is deleted for 30 days, so it can be restored or exported. After that we delete it from every store automatically. After termination of the Service, and at your election made in writing within 30 days, we will provide an export of the Customer Personal Data we still hold or delete it. In any case we will delete Customer Personal Data within 180 days after termination, except where the law requires us to keep it, in which case we will keep it confidential and process it only for that purpose. Copies in backups are deleted as the backups expire, within 30 days. On request we will confirm deletion in writing.

For personal data of people in India: from 13 May 2027 Indian law will also require us to keep personal data, related traffic data and processing logs for one year from processing. From then, when we delete Customer Personal Data from our systems we will keep a sealed copy for the rest of that year, which nobody uses except to meet that legal duty, and then destroy it.

14. Liability and precedence

Each party’s liability under this DPA is subject to the limitations and exclusions in the Terms, except where Data Protection Laws or the Standard Contractual Clauses do not allow it. If this DPA conflicts with the Terms on the processing of personal data, this DPA prevails, and the YOM Intent Addendum prevails over both on YOM Intent processing.

Annex 1: Details of processing

  • Parties: data exporter: the Customer (controller or processor); data importer (processor): Aapastech Private Limited (CIN U72900DL2022PTC395508; registered office 8/3, 2nd Floor, Roop Nagar, Delhi 110007, India) for Customers in India; Aapastech OÜ (registry code 16453146, VAT EE102489493, Tornimäe tn 3 // 5 // 7, 10145 Tallinn, Estonia) for Customers in the European Union and the United Kingdom, which transfers onward under section 11; or 14818032 Canada Inc., Burlington, Ontario, Canada, for everyone else; contact contact@aapastech.com.
  • Subject matter and duration: provision of the Service under the Terms, for the term of the Terms and until deletion under section 13.
  • Nature and purpose: collecting, receiving, enriching (device, browser, operating system and approximate location), storing, aggregating, analysing, reporting, exporting and forwarding analytics events as configured by the Customer; providing reports, portals, embeds, email reports and API and MCP access; security and support.
  • Data subjects: visitors and users of the Customer’s websites, apps and stores (End Users), and the Customer’s clients and their users where the Customer serves clients.
  • Categories of data: pseudonymous identifiers (visitor, session and, if the Customer sends one, user id) where consent allows; event names, parameters, page paths, referring hosts and campaign tags; device, browser and operating system; approximate location; consent state and privacy signals; transaction details such as order ids and values; any other data the Customer chooses to send in events, including from its servers.
  • Special categories: none. The Customer must not send them (see the Acceptable Use Policy).
  • Frequency: continuous.
  • Retention: as set by the Customer’s plan and settings during the term; deletion under section 13.
  • Sub-processors: as listed on the sub-processors page, including our group companies.
  • Competent supervisory authority: as determined under clause 13 of the Standard Contractual Clauses.