Data processing terms
Last updated: 8 October 2026
When people open your links, we process data about them on your behalf. This page lists the details a data processing agreement normally contains.
The binding text is section 14 of our Terms of Service, "Data we process for you". It applies from the moment you accept the Terms, so nothing has to be signed for it to be in force. If this page and the Terms ever differ, the Terms apply.
Who is who
You are the controller: you decide which links exist, where they point and whether they carry retargeting pixels. We are your processor: Ivan Voitovych, trading as Urlicer, Lviv, Ukraine.
We are a controller only for our own purposes: your account and billing, the security of the service and the prevention of abuse, and links made without an account. The Privacy Policy covers those.
What we process for you
| Purpose | Redirecting visitors to your destinations, counting clicks for your analytics, and running the consent step for retargeting pixels on your own domain. |
|---|---|
| People concerned | The people who open your links. |
| Data | The visitor's IP address, held only briefly to find the country, to create the hashed click record and to decide whether to ask for consent; browser details and the referring site; the pseudonymised click record; for pixels, the consent cookie and the record of the answer. |
| Duration | For as long as your account exists. Click records are kept for the analytics retention of your plan, and consent answers for 18 months. |
What we commit to
- We process this data only on your documented instructions, which are the Terms and your settings, and tell you if we think an instruction breaks the law.
- Anyone with access is bound by confidentiality.
- We keep the security measures described on Security and backups.
- We use only the sub-processors listed in the Privacy Policy, under terms as protective as these, and email you at least 30 days before adding one. You may object by cancelling.
- We help you, as far as is reasonable, with requests from individuals, security, breach notices and impact assessments.
- We tell you without undue delay, and within 48 hours of becoming aware of it, of a personal data breach affecting this data.
- We delete this data when your account is deleted, after you have had the chance to export it, unless the law requires us to keep it.
- We give you the information needed to show that we meet these commitments, and allow a reasonable audit: first by written questions, otherwise at your cost, on 30 days' notice, at most once a year.
Sub-processors
The full list, with what each company receives, is in section 5 of the Privacy Policy. Two of them hold data about the people who open your links:
- netcup GmbH: the server the service runs on, in Amsterdam, the Netherlands;
- Hetzner Online GmbH: storage for our backups, in Germany. The backups are encrypted before they leave our server.
Ad platforms whose pixels you add to your links are not our sub-processors. You choose them, and each is a controller under its own terms.
Transfers outside the EU
Our servers are in the European Union and we are established in Ukraine. To the extent our processing is a restricted transfer, the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module 2) apply and are incorporated by section 14(c) of the Terms, with you as data exporter and us as data importer. For data from the United Kingdom the UK International Data Transfer Addendum applies, and for data from Switzerland the Clauses are read with the adjustments the Swiss authority requires.
If you need a signed copy
These terms are in force without a signature. If your company's process needs a signed copy, or you have questions before you sign up, write to privacy@urlicer.com.