1. Purpose and application
This Data Processing Addendum ("DPA") applies where a customer uses WeblyBase to process personal data on that customer's behalf and the applicable data protection law requires a written controller-processor or equivalent agreement.
The DPA supplements the Terms of Service. If there is a conflict concerning the processing of personal data, this DPA will govern that subject to mandatory law and the parties' other applicable agreements.
2. Roles of the parties
The customer generally acts as the controller or equivalent decision-maker for personal data collected through the customer's website when the customer determines the purposes and means of that processing.
WeblyBase acts as a processor or service provider to the extent it processes that personal data on the customer's documented instructions to provide the Services.
WeblyBase may separately act as a controller for account administration, billing, platform security, and other activities for which it determines the purposes and means of processing.
The actual roles depend on the specific processing activity and applicable law.
3. Processing details
Subject matter: Provision of website-building and related platform services.
Duration: For the term of the customer's use of the relevant Services, plus any permitted retention period.
Nature of processing: Hosting, storage, transmission, organization, retrieval, configuration, support, security, troubleshooting, and deletion of data as necessary to provide the Services.
Purposes: Delivering and maintaining the Services according to the customer's configuration and instructions.
Data subjects may include: The customer's website visitors, customers, employees, contractors, account users, and other individuals whose information the customer submits.
Personal data may include: Names, contact information, account identifiers, form submissions, order information, appointment details, website usage information, and other data submitted or generated through the customer's use of the Services.
The customer must not submit special-category, highly sensitive, or regulated information unless the service is suitable for that information and the parties have implemented the necessary safeguards and contractual arrangements.
4. Customer obligations
The customer is responsible for:
- Having a valid legal basis for the processing it directs.
- Providing privacy notices and obtaining required consents.
- Ensuring its instructions comply with applicable law.
- Configuring website features and integrations appropriately.
- Responding to data-subject requests concerning processing for which the customer is responsible.
- Protecting account credentials and limiting access to authorized users.
- Avoiding unnecessary collection of sensitive personal data.
5. WeblyBase obligations
To the extent WeblyBase acts as a processor and the applicable law requires, WeblyBase will:
- Process personal data only on documented instructions, unless the law requires otherwise.
- Ensure that personnel authorized to handle personal data are subject to appropriate confidentiality obligations.
- Implement appropriate technical and organizational security measures.
- Provide reasonable assistance with relevant data-subject requests.
- Provide reasonable assistance with security, breach-notification, and impact-assessment obligations where required.
- Inform the customer if WeblyBase becomes aware that an instruction appears to violate applicable data protection law, where required.
- Delete or return personal data at the end of the relevant service, subject to legal retention obligations and the agreed service functionality.
- Make available information reasonably necessary to demonstrate compliance with this DPA, subject to appropriate confidentiality and security safeguards.
These obligations apply only to the extent required by applicable law and the actual processing relationship.
6. Subprocessors
WeblyBase may engage third-party providers for infrastructure, hosting, storage, backups, support, email delivery, monitoring, and other services needed to provide the platform.
Where required by applicable law, WeblyBase will obtain the customer's required authorization for subprocessors and impose appropriate data protection obligations on them.
A current list of subprocessors should be published at [subprocessors URL] or supplied upon reasonable request.
The actual providers and their processing locations must be confirmed before this DPA is published.
7. Security and incidents
WeblyBase will maintain appropriate technical and organizational measures based on the nature of the processing, the risks involved, and the applicable legal requirements.
If WeblyBase becomes aware of a personal data breach affecting personal data processed on the customer's behalf, it will notify the customer without undue delay as required by applicable law and provide information reasonably available to assist the customer's response.
The customer remains responsible for notifications that the law requires the customer to make to individuals or authorities, unless the law or a separate agreement provides otherwise.
8. International transfers
Where personal data is transferred internationally, the parties will comply with applicable transfer restrictions and implement required safeguards, contractual clauses, or other lawful transfer mechanisms.
9. Data-subject requests
Where reasonably necessary and legally required, WeblyBase will assist the customer in responding to requests to access, correct, delete, restrict, or otherwise exercise rights relating to personal data processed on the customer's behalf.
The customer remains responsible for evaluating and responding to such requests unless the parties agree otherwise or applicable law requires a different allocation of responsibility.
10. Return and deletion
Upon termination of the relevant Services, WeblyBase will provide available export functionality or otherwise return personal data where agreed and technically feasible.
Following the applicable retention period, WeblyBase will delete or render personal data inaccessible, except where retention is required by law or permitted for legitimate backup, security, dispute-resolution, or compliance purposes.
Backup copies may remain until removed through ordinary backup-retention cycles, subject to applicable law.
11. Audits and compliance information
Where required by applicable law, WeblyBase will make available reasonable information necessary to demonstrate compliance with this DPA.
Any audit must be reasonably scoped, subject to confidentiality and security safeguards, and conducted in a manner that does not unreasonably disrupt the Services or expose other customers' information.
12. Liability and precedence
Liability under this DPA is governed by the applicable agreement and mandatory law. No provision limits liability to the extent that such limitation is prohibited.