Data processing agreement

This annex belongs to the terms and conditions and applies for as long as I work on or maintain a website of yours in which personal data are processed. Think of a contact form, a newsletter sign-up, a booking system or a webshop.

For the data I process about you as a client, such as your billing details and our messages, I am the controller myself. The privacy policy applies to that, not this annex.

If we agree something else in writing, or a client asks for their own signed data processing agreement, that takes precedence over this annex.

I process that data only to do what you asked me to, and not for my own purposes. I never use it for my own marketing and never sell it on.

If I believed an instruction conflicted with privacy legislation, I would tell you before carrying it out.

I do not look into the data unless I need it for the work, for example to trace a fault in a form. What I see then, I keep to myself.

I take appropriate technical and organisational measures: an encrypted connection, access only for whoever needs it, passwords stored as an irreversible hash, and I keep the software I use up to date.

With a subscription that includes backups, I make a daily backup and keep it for seven days, so a mistake can be undone.

I keep your website's data separate from that of other clients.

I keep confidential whatever I get to see on your instruction, also after the work is finished. If I work with a third party who can reach the data, I bind them to the same confidentiality.

For hosting, email and payments I work with service providers. For the data running through your website those are mainly the hosting provider and the mail provider. You give me permission to engage them.

If I want to engage a new party that can reach your data, I will tell you in advance. If you have an objection you can substantiate, we look for an alternative together; if that is not possible, you may end the maintenance free of charge for the remaining term.

I bind those parties to obligations no less strict than what is set out here, and I remain responsible towards you for what they do.

The data sit on servers within the European Economic Area. If processing outside the EEA were necessary, it would only happen under a valid transfer mechanism and I would tell you in advance.

If a visitor or customer of yours asks for access, correction or erasure, that is your request to answer: you are the controller.

If such a request reaches me, I forward it to you and do not answer it myself. If you need my help to carry it out, for example to pull a submission out of the database, I will help. If that takes more than half an hour, we agree the cost first.

I also help you with a data protection impact assessment or with questions from the supervisory authority, as far as my part is concerned.

If I notice a data breach affecting your data, I will tell you within 48 hours of establishing it, and in any case soon enough for you to meet the statutory 72-hour deadline.

I tell you what happened, which data and how many people it affects as far as I know, what I have done and what I recommend. I do not report it to the supervisory authority myself: that is your decision as controller.

I keep a record of what happened and what was done about it, so you can show that to the supervisory authority.

When the work or your subscription stops, I give you the data and the files in a common format. After that I delete what I still have, except what I am legally required to keep or what sits in a backup that expires by itself according to the schedule above.

If you ask for a statement that it has been deleted, you get one.

You may ask me to demonstrate that I keep to this. I answer your questions and show what I have put in place. If you want an on-site or external audit, we agree the timing and the cost together, and it happens in a way that does not affect my other clients.

The liability limitation from the terms and conditions also applies to this annex. Whatever the GDPR imposes on a processor as mandatory law continues to apply in full alongside it: a contract cannot write those rules away, and that is not the intention either.