Get free preview

Data Processing Agreement

Last updated: {{LAST_UPDATED}}

1. Parties and scope

The client who orders a website or online store is the business (controller). {{COMPANY_LEGAL_NAME}}, {{ADDRESS}} (“getsaito”) is the service provider (processor). This agreement applies when getsaito builds, hosts or maintains the client’s website and so handles personal information on it, such as contact-form messages, orders and customer emails. It is intended to meet the requirements for service providers and contractors under the California Consumer Privacy Act and, where they apply, the GDPR.

2. What we process and why

  • Purpose: building, launching, hosting and maintaining the client’s website under the order.
  • Types of data: contact details of the client’s site visitors and customers, order details, contact-form messages, technical logs.
  • People concerned: the client’s site visitors, customers and staff.
  • Duration: while we provide the service and no more than 30 days afterward, unless agreed otherwise.

3. Our commitments

  • We process the data only on the client’s documented instructions, including this agreement and the order, and for no other purpose. We do not sell or share it, and we do not combine it with data from other sources.
  • People who process the data are bound to confidentiality.
  • We apply appropriate technical and organizational security: encrypted credentials, limited access, HTTPS, backups.
  • We help the client answer requests from individuals exercising their privacy rights.
  • We tell the client of a personal data breach as soon as possible and no later than 48 hours after we become aware of it.
  • When the service ends, we delete or return the data at the client’s choice, and delete the client’s access credentials (hosting, registrar, API keys).
  • On reasonable request, we let the client verify that we follow this agreement.

4. Subprocessors

The client agrees that getsaito may use these subprocessors: hosting provider {{HOSTING_PROVIDER}} and email provider {{EMAIL_PROVIDER}}. We tell the client in advance about a new subprocessor, and the client may object.

5. Where data is processed

Data is processed in the United States. For clients and visitors in the EEA, the UK or Switzerland, the parties will use the appropriate transfer safeguards, such as standard contractual clauses, where required.

6. Contact

Questions about data: {{EMAIL}}.