Data processing agreement
Last updated 7 November 2026
This DPA applies when you (the "controller") use Anchorpost to process personal data of your visitors, and Orionwave Private Limited acts as your "processor" under the GDPR and UK GDPR. It forms part of our terms.
Processing
| Subject matter | Short-link redirects, click analytics, retargeting pixel delivery, client reports |
|---|---|
| Data subjects | People who click your links or scan your QR codes; your team members |
| Data | Country, device, browser, OS, referrer domain, daily-salted visitor hash; team member emails |
| Duration | For the term of your account; raw events 30 days |
Our commitments
- Process data only on your documented instructions (your settings in Anchorpost).
- Confidentiality obligations for everyone with access.
- Security measures: encryption in transit, EU hosting, access control, IP addresses not stored, tenant isolation tested on every release.
- Use only the listed sub-processors, with 30 days' notice of changes.
- Help you answer data subject requests and notify you of a personal data breach without undue delay.
- Delete or return data at the end of the service.
Transfers
Data is stored in the EU. Where a sub-processor transfers data outside the EEA, the EU Standard Contractual Clauses apply.