Statistics Processing Schedule

This Statistics Processing Schedule supplements the INSIGHTS Closed Beta Processor Terms version beta-1 and the Subprocessor Register version beta-1. Those documents continue to apply unchanged; this schedule adds the anonymous statistics lane to the processing they govern. Nothing in this schedule reduces a protection in the Processor Terms; where they differ, the term providing the greater protection applies. The schedule applies to a property only after the Controller's authorised representative has recorded a controller attestation with the INSIGHTS statistics authority naming this exact document version and its content digest, together with the property's reviewed scope. That attestation is the Controller's documented instruction to process under this schedule. It has no effect on a property without it, and the Controller may revoke it at any time as described in section 5.

The lane counts visits and within-window unique visitors for a property's approved page groups, for visitors whose analytics consent question is unanswered and who have not used the statistics objection under the current notice version. Visitors who have accepted analytics are measured by the consented lane under the Processor Terms; visitors who have rejected analytics or used the objection are excluded and send nothing. A visitor whose consent answer becomes known is no longer in this population. Outputs are aggregate figures only: page-group counts, within-window reach, and a monthly unique-visitor estimate with a stated confidence band. A tenant suppression threshold withholds any figure below the configured minimum. No visitor identifier, session, path history, IP address or device fingerprint is stored, exported or made available to the Controller, and no figure links a visitor across windows.

Within-window uniqueness is computed with a random salt that exists for one property and one window only. Window length is the Controller's configured setting (1, 7, 14 or 30 days, bounded by the property's jurisdiction profile). The salted value is held in memory during processing and never stored in plain form; wrapped material is kept only for live-window recovery. At the window boundary the salt is destroyed and the destruction is recorded in the same signed audit chain as the property's other control events, so that the record can be verified independently. After destruction no party, including the Processor, can relate a later visit to an earlier one. A change to the property's configuration during a window opens a new salt for the remainder of that window; it does not extend the life of the old one.

The monthly unique-visitor figure is derived from within-window reach using a revisit factor calibrated on the property's own consented cohort at aggregate level. The factor is computed only when the consented cohort meets the minimum size and calibration period the platform requires; until then the figure is reported as unavailable rather than estimated. The confidence band states the uncertainty of that derivation. Calibration uses aggregate counts only and performs no inference about any individual.

Processing under this schedule is authorised by three attestations recorded with the statistics authority: a review of the assessment and purpose, the Controller's acceptance of the scope and validity period, and a verification that the live privacy notice and objection mechanism exist and match. Each attestation binds the same scope: the property's exact origin, jurisdiction profile, window length, locked configuration version, collector configuration digest, and the versions and content digests of the Processor Terms, the Subprocessor Register, this schedule and the Controller's privacy notice. The Processor issues collection authority to the edge only while all three attestations are current, agree on the scope and fall within the attested validity period. Any change to a bound configuration value stops issuance until fresh attestations are recorded. The Controller may revoke any attestation or the active epoch at any time; revocation stops issuance. The roles are ordinarily held by different people; where the Controller is also the property's own reviewer and verifier, the Controller records that fact in its own attestation record.

INSIGHTS publishes this schedule and the description of the anonymous statistics lane at insights.provenance365.com/statistics-terms, and the property's tag references the document versions it was installed under. The Controller's existing privacy information and consent banner are the visitor-facing controls: a visitor who declines analytics in the banner, or withdraws consent later, is not measured. That existing control is the objection route; it is free, it is already offered, and no separate INSIGHTS page, cookie, preference control or site code is required. The Controller may add a description of the anonymous statistics purpose to its own privacy information, and INSIGHTS provides wording for that; it is the Controller's choice and is not a condition of processing under this schedule. The INSIGHTS loader observes the consent manager's state. A visitor who has accepted analytics is measured by the consented lane; a visitor who has declined or withdrawn sends nothing; only a visitor who has not yet answered is counted here. The notice version bound in the attestation identifies the Controller's privacy information as it stood at attestation and is applied by the loader from the property's own configuration, never entered on the site. A site may additionally signal an explicit objection to the loader; that is optional and a property is measured identically without it.

Observations are processed transiently at the Processor's edge and consumer services and are reduced to aggregate counts; only aggregates and the signed control and audit records are retained, in the locations and with the suppliers listed in the Subprocessor Register version beta-1. This schedule introduces no additional subprocessor. Aggregates are retained for the property's configured reporting period and deleted or returned under section 6 of the Processor Terms.

This is a closed-beta schedule. Figures below the suppression threshold are withheld, the monthly estimate is unavailable until calibration conditions are met, and the Processor may suspend the lane for a property when an attestation lapses or a configuration changes. The Controller remains responsible for its lawful basis, its notice and the accuracy of its instructions. This schedule is an electronic written agreement and is not a substitute for either party's legal advice. Support, incidents, rights requests and data protection: support@hyceangroup.com Registered address: PROVENANCE365 LIMITED, 9 Byford Court, Crockatt Road, Hadleigh, Suffolk, United Kingdom, IP7 6RD