Privacy Policy

Effective Date: 16 October 2026 · Version: 1.5

MousePlayer ("we", "our", or "us") is dedicated to protecting the privacy, security, and integrity of visitors and users interacting with websites that integrate the MousePlayer tracking and analytics script (the "Service"). This Privacy Policy outlines the types of data collected, how that data is processed, and the measures taken to ensure user privacy. Where MousePlayer acts as a processor on behalf of a website operator, the terms of the Data Processing Agreement and the Technical and Organizational Measures apply in addition.

1. Consent Comes First

Nothing is recorded before consent. On a website using MousePlayer, the script assigns no identifier, writes no cookie, stores nothing, opens no connection and registers no listeners for input or page changes until a consent signal is present; until then it listens only for the consent signal itself. If no signal arrives – because the visitor has not decided, because the consent tool failed to load, or because something went wrong – the absence is treated as refusal, never as permission.

On this website. The consent dialog you see here is loaded from consented.eu — a service of the same provider, run on the same infrastructure. Your browser therefore opens a connection to that domain, which transmits your IP address and user agent. This is not a transfer to a third party, and no sub-processor is involved; it is mentioned because the connection is visible in your browser and you should know who is behind it. As evidence of your decision, consented.eu stores it together with a random identifier, a hash of your IP address, the browser family and the time, and deletes that evidence after three years; the legal basis is our obligation to be able to demonstrate consent (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR). In your browser, the consented cookie keeps the decision (section 10).

A Global Privacy Control signal sent by the browser is honoured worldwide and overrides every other signal, including an explicit approval from a consent tool.

If consent is withdrawn during a visit, recording stops immediately: listeners are removed, observers disconnected, the connection is closed and data still held in the browser buffer is discarded rather than sent. Whether the already stored recording of that visit is deleted as well is a setting the website operator controls.

Obtaining valid consent is the responsibility of the website operator, who is the controller for that website. MousePlayer reads the signal; it does not ask the question. The legal basis of the recording is that consent (Art. 6(1)(a) GDPR); purposes, retention and recipients are determined by the website operator and set out in its own privacy notice.

2. Information We Collect

Once consent is present, the Service collects the technical telemetry and behavioral metrics necessary to deliver session recordings, heatmaps, and real-time live viewing features:

• Device and Environment Data: Browser type and version, operating system, device classification (desktop, mobile, or tablet), screen resolution, and viewport dimensions.
• Network and Geographic Data: The IP address is used to establish the connection, to derive the country, and to defend against abuse of the platform. Country, city and network provider are derived from the full address in the working memory of the recording server. The address is written to the database only in truncated form (the last segment is removed); a complete visitor IP address is not stored there and is never displayed in the dashboard. To detect connection floods an address is counted for a few seconds; if it triggers the automatic abuse defence, it is blocked in full for at most 24 h in a cache that also writes to disk to protect against data loss, after which the entry expires on its own. Every connection attempt is recorded with the truncated address, browser identification and project in a security log that is erased after 72 hours.
• Behavioral Telemetry: Mouse movements, cursor trajectories, click events, scrolling depth, and interaction timestamps.
• Navigation and Traffic Sources: Page views, URLs visited, entry pages, referrer domains, and campaign sources. The values of parameters that typically carry personal data (for example ?email= or ?token=) are removed before storage – in the query string as well as after the #, where sign-in services place access credentials (for example #access_token=).
• DOM Structural Snapshots: Structural layouts and HTML fragments used exclusively to render session replays and live previews. This includes drawing surfaces (canvas) as an image that is renewed when they change, the content of embedded frames of the same origin together with interaction inside them, and open shadow DOM regions; embedded frames from other origins appear only as placeholders. A search index is built from the displayed texts so that the website operator can find sessions by a text that was displayed.
• Technical Diagnostics: Error and warning messages from the browser console, failed or conspicuously slow requests made by the page (address, status and duration, without content and without headers; texts are cleaned of access credentials, e-mail addresses and long digit sequences before they are sent), and page loading metrics (Web Vitals).
• Information Added by the Website Operator: The operator's own customer identifier, where the operator passes it to the script (for example after a sign-in on its website), a name the operator gives a visitor in the analysis, and – where the operator switches on a survey – the answers to it. Free text is cleaned of e-mail addresses, IP addresses and longer digit sequences such as telephone numbers before it is sent.

The website operator can exclude entire paths – a checkout or an account area, for instance – from recording altogether. The exclusion is enforced on our servers, not merely in the browser.

3. Text Entered Into Forms

This deserves its own section, because it is the point at which a session recording can become personal data without anyone intending it.

• Full masking is the default. Every character of every form entry is replaced before it leaves the browser. A replay shows that someone typed, and how long they took, but not what.
• Two weaker levels exist, and neither is self-service. Selective masking keeps names, addresses, e-mail, telephone, payment fields and free-text areas fully masked and replaces only digits elsewhere, so search terms and coupon codes stay readable. No masking records input as typed. Both require written approval from us for that specific website, and we record when it was granted and by whom.
• The approval is enforced, not requested. If a site's stored level is higher than its approval, our server reduces it before the setting ever reaches the browser. Setting the value directly in the database achieves nothing.
• Fields recognised as password or payment fields are never recorded in clear text. They are fully masked on every level. That floor cannot be lifted by any approval. Recognition reads the field's name, id, type and autocomplete attribute against a list covering English, German and Polish terms; a field matching nothing counts as an ordinary field.
• What the website itself displays is a different matter entirely. A confirmation page that prints the address you entered is part of the page, and therefore part of the replay. Masking of input fields does not reach it.

Website operators can mark any region of their page with data-mp-mask or the class mp-masked; its content is then excluded from the recording. Operators are responsible for identifying and marking the regions of their site that display or collect personal data, and can exclude entire paths from recording.

4. Cookies and Local Storage

On its Customers' websites MousePlayer sets no cookies. After consent has been given, the script stores technical identifiers and markers (such as visitor, session and tab identifiers and counters) in the browser's local storage (localStorage) and session storage (sessionStorage). These distinguish unique visitors, connect multi-page journeys within one session, and maintain continuity during live monitoring. They are set only after consent; refusal leaves nothing behind. A withdrawal that arrives while the script is running on the page removes the identifiers and markers; if the script is no longer started at all after a withdrawal, existing entries remain until browser data is cleared but are no longer used.

5. User Identification and Pseudonymization

Data processed by MousePlayer is pseudonymous. Visitors are distinguished by randomly generated tokens rather than by names, e-mail addresses or telephone numbers, none of which the Service itself collects. Pseudonymous does not mean anonymous: a recording combined with other information can identify a person, which is why it is treated as personal data throughout this policy.

6. How We Use Collected Data

• Providing website owners with analytics, session replays, heatmaps and live viewer diagnostics.
• Identifying interface friction, performance bottlenecks and technical errors on the monitored website.
• Ensuring platform security, defending against automated abuse, and maintaining system stability.
• Calculated analyses for the website operator: a friction score per session, behavioural profiles and frequent journey patterns, a prediction of abandonment in the first seconds of a visit, an indication of likely churn among returning visitors, visitor values based on goals set by the operator, and anomalies in the daily figures. Short sentences and reports about visitors, as well as suggestions for the wording of an offer, are phrased by a language model on our own machines in the same local network and at the same site as our server, from findings calculated beforehand; nothing goes to an external AI service. Where the operator switches on an offer, the abandonment prediction may lead to an overlay being shown to the visitor. No decision producing legal effects concerning you or similarly significantly affecting you (Art. 22 GDPR) follows from any of these analyses.

Collected data is not used to build cross-site profiles and is not used by us for advertising purposes. It is combined with data from other sources only on the website operator's instruction: the operator can have figures and sessions from its own Google Analytics account imported, which are held alongside the recordings, and can pass its own customer identifier.

7. Data Security

Data from the internet reaches us over TLS-encrypted connections: HTTPS for the application and the API, WSS for the recording connection; unencrypted requests are redirected to HTTPS. If the WebSocket connection cannot be established, for example because a proxy blocks it, the script falls back to an ordinary HTTPS connection with the same checks; very large page snapshots are likewise uploaded over HTTPS. Within our own local network at the same site, the connections to the database and to the cache are unencrypted; they are access-restricted and not reachable from the internet. Customer data is separated logically by workspace and project, and every read and write path carries that restriction. Access requires an individual account, optionally protected by two-factor sign-in; a role model governs what each account may see and do, and the restriction is enforced on the server rather than only in the interface.

A full description of the measures is published separately as the Technical and Organizational Measures.

8. Who Can See the Data

We do not sell, rent or trade collected telemetry data. Access is limited to:

• Authorized members of the workspace to which the website belongs, according to their role.
• Holders of a share link. An authorized member can create a link that makes a single recording viewable without an account. Such a link is created deliberately, is limited to that one session, can be revoked, and can carry an expiry date. Anyone holding the link can view that recording – that is its purpose, and it is worth knowing. Every access through such a link is logged with the full IP address and browser identification, so that it remains visible from where it was used; the log is deleted with the link, at the latest 90 days after the link expires or is revoked.
• Sub-processors, to the limited extent described in the list of sub-processors. At the recording itself none is involved; a daily off-site copy of the database and of the recording archive is however stored with Google (Google Cloud Storage, bucket in Warsaw). Since 11 August 2026 that copy is encrypted on our own server before it is transferred; the keys stay with us, Google does not receive them and cannot read the content. The previous, unencrypted target folder holding the copies from before 11 August 2026 was deleted on 12 August 2026.
• Recipients chosen by the operator of the website. The operator can switch on interfaces through which individual items are passed to other companies – an analytics or advertising tool, a customer relationship system, a ticketing system, an email marketing system, their own storage such as an object store or a spreadsheet, an issue and task tracker, or an address the operator has named. As a rule, what is passed on is not the recording itself but an identifier and the name of what happened; only an export into the operator's own BigQuery account can, at the operator's request, also include the individual events of the recording. Whether this happens, and to whom, is decided by the operator alone; we carry out the transfer on their instruction.

There is something we owe you about these recipients, and something we cannot tell you. We can tell you what we send: the same items the operator already sees in their own analysis, and depending on the interface considerably less – to an advertising network, for instance, only that network's own click or cookie identifier, the name and time of the event, where applicable a value, the page address or the browser identification – never your name, your email address or your IP address.

What we cannot tell you is what happens there afterwards. The recipient processes the data under its own terms and under the responsibility of the operator who chose it – not under ours. How long it keeps the data, where it moves it, and whom it passes it to is beyond our influence. A deletion request reaching us has no effect there either: it deletes the copy held by us, not the copy held by the recipient.

If you want to know which recipients are switched on for a particular website, the operator of that website is the right address. They are responsible for that decision and must disclose it to you in their own privacy notice. Your rights in relation to such a recipient are exercised against that recipient.

A running session can be followed in real time by an authorised member of the workspace while you are using the page — not only later as a recording. No separate notice is given at the moment of observation; you are informed here and through the consent that precedes any recording.

9. Retention Periods

Session recordings are erased automatically once the retention period of the website operator's plan expires:

• Free: 7 days · Small: 30 days · Business: 90 days · Enterprise: as agreed individually.
• After a downgrade, a grace period of at least 30 days applies during which the longer previous retention continues.
• The application log of our own website (section 10) is erased after 60 days, the web server logs after 14 days, security logs after 72 hours, the change log after 60 days.
• Visitor values derived from recordings and the short sentences phrased from them are erased after 60 days (for Enterprise projects the retention of the plan applies instead), visitor reports after 180 days, the assignment of sessions to behavioural profiles after 180 days and the search index of displayed texts after 30 days. The daily aggregate of the click map – the number of clicks per position on a page and day, without session, visitor identifier or page view – is kept for 730 days and may therefore outlast the recording; it carries no reference to a person.
• Of the records of acceptance of contract documents, the most recent acceptance of an existing account is kept for as long as the account exists; earlier acceptances, notices and records of deleted accounts are erased 730 days after the respective acceptance. Support requests and acceptance of the region-specific recording rules are erased 730 days after the respective request or acceptance.
• Sessions identified as automated access lose their recording after 1 day; the session itself is erased after 14 days. For projects of an account on the Free plan that is marked as suspected of abuse (section 10), only part of the visits is recorded, and recordings are deleted after 1 day.
• Share links are erased together with the log of their accesses 90 days after expiry or revocation, the delivery log of the interfaces switched on by the operator after 30 days, and data imported from Google Analytics after 180 days.
• When a Customer account ends, the associated data is erased within 30 days. The deletion is started by the Customer in the account settings; no request by e-mail is required. It first archives the account: access ends at once, nothing is recorded or shown any more, and for 30 days we can still restore it on request in case the deletion was a mistake. After that period it is erased permanently; when starting the deletion, the Customer can also choose permanent erasure at once. A project or a workspace that the Customer deletes is likewise archived for 30 days first and can be restored in the dashboard during that time. Three things are deliberately kept, because the law requires it or because they document a decision rather than a person: the record of acceptance of these documents, the security and change log (with the user reference removed), and support requests. Support requests are kept, including the e-mail address of the sender. They document what was asked and answered and are needed to establish, exercise or defend legal claims; the legal basis is the legitimate interest under Art. 6(1)(f) GDPR. The link to the account is removed when the account is deleted, the request itself is not. A workspace can be transferred to another account instead of being deleted with it. The transfer only takes effect once the recipient has expressly accepted it; the invitation expires after three days. With the acceptance the recipient becomes the owner and thereby the Controller's contract partner for that workspace, and the recipient's plan applies from that moment — which may shorten the retention period of the recordings it contains.

Records of consent decisions are kept beyond the erasure of the recording itself. They contain no behavioural data – only the fact, the time and the source of the decision – and exist so that the decision remains demonstrable.

Records of consent decisions are erased 730 days after the withdrawal, but never before no recording refers to them any more: while a recording exists, its evidence has to exist.

One period outlasts all the others, and it belongs here rather than only in the technical annex: the backup. An off-site copy of the database and of the recording archive is made daily and held encrypted – encrypted on our own server before it is transferred, file and directory names included, with the keys held by MousePlayer; Google does not receive them. In addition, an unencrypted local copy is kept for 7 days on a separate storage medium at the same site. Daily copies are kept for 7 days, weekly copies for 364 days. Anything erased in the live system therefore remains inside those copies until they expire, at most 364 days after the erasure. Nothing is selectively removed from a backup: a copy is a sealed archive whose purpose is to be a faithful image of one point in time, and altering it would destroy both that property and the proof that nobody tampered with it. Backups are used for nothing except restoring the system after a loss, and where one is restored the erasure requests recorded for visitors are carried out again before the system returns to service.

A Customer account does not only end on request. For an account on the Free plan – with its own free plan and no membership in a workspace whose owner has a paid plan – we point out by e-mail when it has gone unused for 24 months; if no sign-in follows within 30 days, the account is deleted. Unlike a self-initiated deletion, it is not archived first but erased permanently at once. Signing in is enough to prevent this. Deletion only ever follows a notice that was delivered; an account on a paid plan is not deleted for inactivity.

10. When you visit our own website

Everything said so far describes what happens on our Customers' websites, where we act as processor. On mouseplayer.com itself we are the controller. What is processed there is set out here — separately, because these are two different roles, and mixing them creates exactly the confusion this document is meant to avoid.

The demonstration on the home page

The home page carries a demonstration of what MousePlayer does. It is not a depiction but the real thing: after your consent it transmits the position of your mouse pointer and your clicks to our server and shows them — together with a randomly assigned session identifier and the country derived from your IP address — to the other people who currently have the page open. Conversely, you see their pointers. Your IP address itself is not passed on, only the country derived from it; pointer positions and clicks are not stored, and only the connection attempt is recorded in the security log (section 2). Without consent nothing is transmitted and nothing is shown; the reason appears in its place, together with a way back into the settings. The legal basis is your consent under Art. 6(1)(a) GDPR, which you can withdraw at any time via “Cookie settings” in the footer; a withdrawal stops the transmission immediately.

Protection against automated access

On the sign-in, registration, password reset, support form and billing pages we use Google reCAPTCHA to fend off automated access. Your IP address and information about your device and your behaviour on the page are transmitted to Google and evaluated there; the provider is Google Ireland Limited, and a transfer to Google LLC in the United States takes place; it relies on the adequacy decision for the EU-US Data Privacy Framework and, alternatively, on standard contractual clauses. The legal basis is our legitimate interest in preventing abuse under Art. 6(1)(f) GDPR. Without this protection the sign-in and the support form would be open to automated attack.

Account, billing and support

For an account we collect name, e-mail address, the account type (business or private individual), for business accounts the company details and, where available, the VAT identification number; providing the number is voluntary. Without name, e-mail address and – for business accounts – company details we cannot set up an account; you are not obliged to provide them, but they are required to conclude the contract. We check a number provided through the VAT Information Exchange System (VIES) of the European Commission; the country code and the number are transmitted to the Commission, and the result is stored – for some Member States together with the name and address held there. You can optionally upload a company logo; it is visible to your account, to the members of the workspaces you own, to people with an open invitation to such a workspace, and to our administration. Changes to these details are recorded with the time, the person acting and the IP address, so that it remains traceable who changed what. The legal basis is performance of the contract under Art. 6(1)(b) GDPR, and for statutory retention Art. 6(1)(c) GDPR. Payment is processed by Stripe; we do not receive complete payment details. Payment processing is not yet in operation; no payments currently take place. Once it is, Stripe receives name and e-mail address with a purchase, and where applicable also the billing address and VAT identification number; you enter your payment details directly with Stripe. The data processing agreement with Stripe has been in place since 1 Aug 2026. The contracting party is Stripe Payments Europe, Ltd. (Ireland); transfers to Stripe, Inc. in the United States rely on the EU-US Data Privacy Framework and, alternatively, on standard contractual clauses.

At registration, to fend off accounts created abusively, we set the cookie _mp_did containing a random device identifier (two years) and store that identifier with your account; we also check whether the e-mail address belongs to a provider of disposable addresses. If the device identifier already belongs to another account or the address is a disposable one, the account is marked as suspected of abuse. For an account so marked on the Free plan, only part of the visits to its websites is recorded, and recordings are deleted after 1 day. If you consider the marking incorrect, contact us so that we can review it. The legal basis is our legitimate interest in protecting free use against abuse (Art. 6(1)(f) GDPR).

If you write to us through the support form, we store your e-mail address, your message and your full, untruncated IP address. The full address serves to defend this channel against abuse — bulk or repeated submissions, threats and similar detriment can neither be detected nor stopped without it. The legal basis is Art. 6(1)(b) GDPR where you are a customer, otherwise Art. 6(1)(f) GDPR.

To answer you, we can have your message translated and a draft reply prepared. Both are done by a language model on our own machines with a graphics card, in the same local network and at the same site as our server; nothing goes to an external AI service. The model receives the text of your message, the topic you selected, whether you have an account and the path of the page you wrote from; e-mail addresses and digit sequences of six or more digits are replaced beforehand. Your IP address and your e-mail address do not reach it. A draft is never sent automatically: a member of our team reads it, corrects it where needed and decides whether to send it. Our own reply can likewise be translated into your language before it is sent. The text prepared for the model and the result are stored with your request and deleted with it. The legal basis is the same as for the request itself.

Sign-in, security and export of your account

For every sign-in we store the IP address, browser, operating system and device type, together with the country and city derived from them. In the account settings you can see this list and end individual sign-ins or all others; changing the password ends all other sign-ins. The entries are erased 90 days after the last activity. If your account signs in from a device it does not yet know – recognised by browser, operating system, device type and the network range of the IP address – you receive an e-mail with these details; you can switch this off in the settings. We record the IP addresses from which your account is used, together with the network provider, to defend against abuse; an entry is erased 90 days after the address last appeared. You can optionally protect the sign-in with a second factor (time-based one-time codes from an app); the secret required for it is stored encrypted, and the recovery codes only as check values. The legal basis is Art. 6(1)(b) and (f) GDPR.

In the settings you can, after entering your password, download the data stored for your account as a file in a common, machine-readable format (Art. 15(3) and Art. 20 GDPR).

E-mails – such as account confirmation, password reset, invitations, sign-in alerts, notices before deletion for inactivity, notifications of changed contract documents, replies to support requests, and reports and alerts you have switched on – are sent through the e-mail service Namecheap Private Email. Your name, your e-mail address and the content of the message are transmitted in the process; Namecheap is based in the United States, and the transfer is based on standard contractual clauses.

Web server and application logs

Every request to our pages is logged by the web server: IP address, time, requested address, status code and browser identification. Unlike the recordings on Customer websites, the address is not truncated here; the logs serve operations and defence against attacks, are erased after 14 days.

In addition, the application keeps its own log of requests to mouseplayer.com: full IP address, time, requested address, browser identification, device type, operating system and browser, as well as the country, city and network provider derived from the address. It serves operations and the defence against abuse and is erased after 60 days. The log itself carries no account identifier; where someone is signed in, however, the most recently used IP address and the location derived from it are additionally stored with their account and overwritten by later requests. The legal basis for both logs is Art. 6(1)(f) GDPR.

Failed sign-in attempts and comparable security-relevant events are recorded with the full IP address and browser identification in a security log in order to detect and slow down attacks; it is erased after 72 hours. The legal basis is Art. 6(1)(f) GDPR.

Cookies and storage on this website

On mouseplayer.com we set only cookies needed for the service you use or for a choice you have made: PHPSESSID keeps your session and ends when the browser is closed; mp_remember keeps you signed in if you choose this at sign-in (90 days); mp_lang remembers the selected language (one year), mp_view_mode and mp_per_page the list view (30 days); _mp_did serves abuse prevention at registration (see above); short-lived security markers accompany a sign-in via single sign-on (five minutes) and access to embedded services (four hours). Your decision in the consent dialog is stored in the consented cookie (365 days); where applicable, the dialog keeps the language selected in it in session storage until the tab is closed. On the pages with reCAPTCHA, Google may set its own cookies. We do not set third-party advertising or analytics cookies.

11. Your Rights

Under the GDPR you have the right to access your data, to have it rectified or erased, to restrict or object to its processing, and to data portability. You may also lodge a complaint with a supervisory authority. Ours is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland – and you may equally address the authority of the Member State where you live or work.

Right to object under Art. 21 GDPR: Where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR – for example logs, abuse prevention, reCAPTCHA, support requests from people without a customer account), you may object to that processing at any time on grounds relating to your particular situation; we will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. You may withdraw consent you have given at any time with effect for the future; the lawfulness of the processing carried out until then remains unaffected. For recordings on our Customers' websites, address objection and withdrawal to the respective website operator.

A step-by-step guide is published separately: Access and Erasure – How to Identify Your Data. It explains where the identifier lives, how to read it, and what an erasure actually removes.

Where to address a request. For data recorded on a particular website, the operator of that website is the controller and the first point of contact; MousePlayer acts on that operator's instructions and will assist them. For your MousePlayer account itself, address us directly.

Requests concerning session recordings can be executed on the basis of the visitor identifier or the network address held. Because IP addresses are stored only in masked form, identifying every recording belonging to one person is not always possible from that alone; the more precisely a request can be narrowed down (website, approximate time, page), the more completely it can be fulfilled.

Contact for data protection requests: office@mouseplayer.com

Viewing and deleting your own data: At mouseplayer.com/my-data you can see how many sessions are stored under your identifier, from what period and on which websites — and have them deleted. The page deliberately does not show the recordings themselves: the identifier is a key without a password, and anyone knowing it could otherwise view your behaviour.

Your identifier is held in the browser storage of the website you were recorded on. Browsers keep that storage separate per website, and we deliberately do not join it up — which is why our page cannot read it on its own. If you were recorded on mouseplayer.com itself, it finds your identifier without any action from you. If you were recorded on another website, you reach this page through the link in that site’s privacy notice; and if you already know your identifier, you can enter it on the page yourself. If that link is missing, contact the operator of that website: for your data they are the controller, and we support them in answering.

If you have cleared your browser data, the earlier identifier can no longer be found — not by us either. We ourselves collect nothing that would allow an identifier to be matched to a person – unless the website operator has passed its own customer identifier; in that case the match can be made through it, and the operator is the right point of contact. Otherwise, under Art. 11 GDPR we are not obliged to collect additional information merely to find you again.

12. Contact and Status

Operator of the Service: LW IT Solutions Company Lukas Wójcik, al. Tadeusza Kościuszki 80/82 lok. 301, 90-437 Łódź, Poland · NIP PL7252266190

No data protection officer has been designated. Whether one must be is assessed under Article 37(1)(b) GDPR, and the assessment is written down with its date and its reasoning in section 9 of our Records of Processing: regular and systematic monitoring is met without argument – that is what the Service does – while large scale is not met on present figures. Because the second point turns on the number of end users observed, and that number follows traffic on our Customers' websites rather than any decision of ours, it is measured daily; the assessment is repeated above 100000 end users a month and in any event annually. If a data protection officer is designated, the contact details appear here.

This policy is reviewed when the processing changes. In case of divergence between language versions, the English version prevails.