Data Processing Agreement

Scope

This agreement forms part of the Terms of Service and applies where we process personal data on your behalf as part of the Services (for example data in your WordPress database, uploaded files, form submissions or videos). You are the controller; we are the processor.

Our obligations

We process personal data only on your documented instructions (which include using the Services as designed), unless the law requires otherwise.

Everyone authorised to process the data is under a duty of confidentiality.

We apply appropriate technical and organisational security measures, including isolation between sites, encryption in transit, encrypted backups, access controls and audit logging.

We assist you, taking into account the nature of the processing, with data subject requests, security, breach notification and data protection impact assessments.

We notify you without undue delay, and where feasible within 48 hours, after becoming aware of a personal data breach affecting your data.

At the end of the Services we delete your data as described in the Terms of Service, unless the law requires us to keep it.

We make available information reasonably necessary to demonstrate compliance and allow reasonable audits on 30 days' notice, at your cost, no more than once a year.

Sub-processors

You authorise us to use these sub-processors: Hetzner Online GmbH (Germany/Finland — servers, object storage, backups); Bunny.net / BunnyWay d.o.o. (Slovenia — CDN); Stripe Payments UK Ltd (payments); Twilio SendGrid (email delivery); our application and database hosting provider; AI model providers (when you use Tom). We will give at least 30 days' notice of new sub-processors by updating this page and emailing account owners; you may object and, if we cannot address the objection, cancel the affected Service.

Transfers

Hosting and backups for Your Content stay in the EEA. Any restricted transfer uses an approved safeguard under UK GDPR.

Details of processing

Subject matter and duration: hosting and related services for the term of your subscription. Nature: storage, transmission, backup, restoration, optimisation and rendering. Data subjects and categories: determined by you — typically your website visitors, customers and staff, and contact, account, order and content data.