TangentLens

Home / Legal / Data processing

Data processing agreement

Last updated: September 2026

Draft — not yet reviewed by a lawyer.This document is a working skeleton written by the Tangent team to cover the right ground in the right order. It has not been reviewed by a qualified data-protection or commercial lawyer, and it must be before Tangent accepts a paying customer. Treat it as a checklist of what needs to exist, not as an enforceable agreement.

Roles

For behavioural data collected from your product, you are the controller and Selicatech is the processor. We process only on your documented instructions — which, in practice, are your configuration: what you instrument, what you enable, and what retention you set.

Subject matter and duration

Provision of product analytics, for as long as your subscription runs, plus the export window after termination.

Categories of data subject

Users of your product — identified and anonymous.

Types of personal data

Identifiers you assign, device and browser characteristics, coarse location from an anonymised IP address, behavioural events and their properties, and session recordings with text input masked before transmission. The contents of custom properties are determined by you.

Our obligations

  • Process only on your instructions, and tell you if we believe an instruction breaches data protection law.
  • Ensure personnel with access are bound by confidentiality.
  • Apply appropriate technical and organisational measures — see Security & trust, including its list of gaps.
  • Not engage a new subprocessor without notice and an opportunity to object.
  • Assist with data subject requests, impact assessments, and regulator enquiries.
  • Delete or return personal data at the end of the agreement, subject to legal retention.
  • Make available the information needed to demonstrate compliance.

Breach notification

We will notify you without undue delay after becoming aware of a personal data breach affecting your data, with the facts we have and what we are doing about it — rather than waiting until the picture is complete.

Subprocessors

Listed and kept current on the subprocessors page. Material additions are notified in advance.

International transfers

To be completed on legal review — depends on the deployment region chosen and the standard contractual clauses that apply.

Audit

You may request the information reasonably needed to verify compliance. We do not currently hold a SOC 2 or ISO 27001 certification, so we cannot offer a report in place of answering your questions directly — and we will answer them.

Signing

Write to [email protected] for a countersigned copy.