Data Processing Agreement
Annex to the Websites That Work terms of service.
Last updated 8 September 2026.
When this annex applies
This annex belongs to the Websites That Work terms of service and applies as soon as we process personal data for you. That's the case, for example, when we host or maintain your website.
If we build your website and then hand it over to you, we no longer process any data for you after that.
If we later help you with something and that gives us access to your data, this annex applies for that moment. That doesn't turn the help into an ongoing assignment or a maintenance agreement.
You decide what happens to the data and what it's used for. We carry that out. In the words of the law: you're the controller, we're the processor.
1. What this covers
We process personal data to run and maintain your website: hosting the site, sending automatic emails such as confirmations, and storing what visitors leave through the website.
That means data such as name, email address, phone number, address, order or payment details, and technical data such as an IP address.
That data belongs to your website visitors, your customers, and anyone who fills out a form on your site.
We process it for as long as we work for you or host your website, and no longer than needed for that.
2. We work on your instructions
We process the data only for you and according to your instructions, never for our own purposes.
If we think an instruction breaks privacy law, we'll tell you before we carry it out.
3. Confidentiality
Everyone on our end who has access to your data is bound to confidentiality, even after we stop working together.
4. Security
We protect the data in a way that fits the risk. In practice that includes: connections are encrypted over https, only people who really need access have it, passwords and keys are kept in a vault and never in ordinary files or email, backups are made, and we keep software up to date.
5. Third parties we use
We use third parties for parts of the service. By agreeing to the terms, you give your permission for that.
At the moment, these are:
- a party for hosting the website;
- a party for sending email from your domain;
- a party for storage, if your website stores data.
If we bring in another party, we'll tell you in advance and you can object. We make the same arrangements with every party we use as the ones in this annex, and we remain responsible to you for what they do.
Some of these parties process data outside the European Union. That transfer is covered by the European Commission's standard contractual clauses.
Payments go through a payment provider. For payment data, it's a controller in its own right, so it isn't a party we bring in.
6. When people ask about their data
If someone wants to know what data you hold about them, or asks for it to be corrected or deleted, you handle that. Where needed and possible, we help you so you can reply in time.
7. Data breaches
If something goes wrong with the data — it's lost, or someone gets access who shouldn't — we'll tell you without undue delay, and in any case within 24 hours of finding out.
We tell you what we know: what happened, which data is involved, and what we're doing about it. You report it to the data protection authority; we give you what you need to do that.
8. When we stop working together
When we stop working together, we return the data to you or delete it, whichever you prefer.
How long you need to keep data is up to you. We keep only what we're legally required to keep ourselves, such as invoices.
9. Audits
You may check whether we keep to these arrangements. We give you the information you need to do that.
If you want an independent party to take a look, that's possible by agreement, at most once a year and announced in advance. You pay for it, unless the audit shows we didn't keep to these arrangements.