Data processing terms

Entwurf, 5. November 2026

Entwurf zur rechtlichen Prüfung. Dieser Text ist nicht endgültig und muss vor dem Start von einem Anwalt geprüft werden.

Dieser Rechtstext ist derzeit nur auf Englisch verfügbar.

These terms apply where we process personal data for a customer under Article 28 of the UK GDPR and the EU GDPR.

Roles and instructions

The customer is the controller and we are the processor. We process the data only to provide the service and on the customer's documented instructions, unless the law requires otherwise.

What is processed

Who: visitors who leave feedback and the customer's team members.
What: ratings, comments, and names and phone numbers where a form asks for them; names, job titles and work contact details of team members.
How long: for the period set by the customer, and until deletion after the contract ends.

Our commitments

Our support staff can open your panel only to help you with a problem, and each such access is recorded.
People with access are bound by confidentiality.
We apply appropriate security measures: encrypted connections, access control, backups [details to be added with the hosting setup].
We help the customer respond to data subject requests.
We notify the customer without undue delay after becoming aware of a personal data breach.
We delete or return data at the end of the service, as the customer chooses.
We provide the information needed to show compliance and allow reasonable audits.

Sub-processors

The customer authorises the sub-processors listed here: [list to be added]. We will announce changes in advance so the customer can object.

International transfers