Data Processing Agreement

1.Definitions

In this DPA, “Data Protection Law” means the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, each as amended, which apply throughout the United Kingdom, including Northern Ireland. “Controller”, “processor”, “personal data”, “personal data breach”, “processing”, “data subject” and “supervisory authority” have the meanings given in the UK GDPR. “Customer Personal Data” means personal data about visitors to your websites and about your customers that we process on your behalf through the Service. “Sub-processor” means a third party we engage to process Customer Personal Data. Other capitalised terms have the meaning in the Terms.

This DPA covers Customer Personal Data only. How we handle your own account, billing and support data as a controller is explained in our Privacy Policy.

2.Roles and scope

For Customer Personal Data you are the controller and we are the processor. You are responsible for deciding why and how the data is collected, for your privacy notices, for any consent or cookie banner you need, and for having a lawful basis for the processing, including for any decision to link visitors to customers, identities or payments.

The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subject are set out in Annex 1.

3.Our obligations as processor

We will:

1. process Customer Personal Data only on your documented instructions, which are these terms and your use and configuration of the Service, unless the law requires otherwise, in which case we will tell you first unless the law forbids it;
2. tell you if we believe an instruction breaches Data Protection Law;
3. ensure that people authorised to process Customer Personal Data are bound by confidentiality;
4. keep Customer Personal Data secure with the measures described in Annex 2;
5. not sell Customer Personal Data, use it for advertising, or combine it across customers to profile individuals;
6. keep a record of the processing we carry out for you, as Data Protection Law requires.

4.Sub-processors

You give us general authorisation to use the Sub-processors listed in Annex 3. We will impose on each Sub-processor data protection terms that are no less protective than this DPA and remain responsible for their performance.

If we add or replace a Sub-processor that processes Customer Personal Data, we will give you at least 30 days’ notice by email or in the app. You may object on reasonable data protection grounds within that period. If we cannot reasonably accommodate your objection, you may stop using the affected part of the Service, or end your subscription and receive a refund of any prepaid fees for the period you will not receive the Service.

5.International transfers

We may process Customer Personal Data in countries outside the United Kingdom through our Sub-processors’ global infrastructure. We will make sure any restricted transfer is covered by an adequacy regulation or by appropriate safeguards required by Chapter V of the UK GDPR, such as the UK International Data Transfer Addendum to the EU standard contractual clauses, and will tell you which mechanism applies on request.

6.Data subject requests

Taking into account the nature of the processing, we will help you respond to requests from data subjects exercising their rights under Data Protection Law. The Service lets you delete a website and all of its data yourself. If a data subject contacts us directly about Customer Personal Data, we will refer them to you and will not respond except to say that we have done so, unless the law requires us to.

7.Security, breaches and assistance

We will notify you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and give you the information you reasonably need to meet your own notification duties, including what happened, the likely consequences and the steps we are taking. We will take reasonable steps to contain and remedy it.

We will give you reasonable help with data protection impact assessments and prior consultation with the supervisory authority where they relate to our processing, and with your security obligations under Article 32, taking into account the information available to us.

8.Deletion and return

You can delete a website and its data at any time from its settings, and doing so removes it from our live systems. When your account ends we will delete Customer Personal Data on request, or within a reasonable period if you do not ask for it to be kept, unless the law requires us to keep a copy. Residual copies in platform backups are overwritten in the ordinary course. On request before deletion we will provide the information reasonably needed to export your data through the Service.

9.Information and audits

We will make available the information reasonably needed to show we comply with this DPA and Article 28 UK GDPR, and allow for audits you reasonably request: no more than once a year (unless a breach or a regulator requires more), on at least 30 days’ written notice, during business hours, under confidentiality, without access to other customers’ data and at your own cost. We may meet audit requests first through documentation and written answers.

10.Liability and order of precedence

Each party’s liability under this DPA is subject to the limits and exclusions in the Terms, except where the law does not allow them to be limited. If there is a conflict between this DPA and the Terms about the processing of Customer Personal Data, this DPA prevails.

11.Governing law

This DPA is governed by the law of England and Wales and the courts of England and Wales have jurisdiction, in the same way as the Terms. It applies equally to customers in Northern Ireland, Scotland and Wales, and does not remove any right a customer has under Data Protection Law, which applies throughout the United Kingdom.

12.Annex 1: Details of the processing

13.Annex 2: Security measures

We keep these measures under review and may improve them, but will not materially reduce the protection they give.

• Data minimisation: no storage of visitor or crawler IP addresses, location rounded to about 1 km, removal of email addresses from URLs before collection, and discarding of crawler requests that do not match a known crawler.
• Encryption: all traffic uses TLS. Integration credentials such as payment keys and webhook secrets are encrypted at rest and never shown again after saving.
• Access control: signed sessions, per-website roles (Viewer, Editor, Owner), scoped and revocable agent access with short-lived tokens, and least-privilege administration.
• Separation: every request is checked against the account and website it belongs to, so one customer cannot read another’s data.
• Abuse protection: same-origin checks on state-changing requests, rate limiting, request size limits and bot filtering.
• Accountability: an audit log of owner actions, and read-only, time-limited, reasoned support access to customer websites.
• Resilience: hosting on Cloudflare’s managed infrastructure and database platform.

14.Annex 3: Authorised Sub-processors