Data Processing Agreement
Parties
The customer (controller) and Devgo, trading as Sitehold (processor).
1. Subject
Sitehold hosts and serves the customer's sites. In doing so it processes personal data of site visitors, mainly IP addresses and request data needed to deliver pages at the edge. Sitehold adds no tracking to customer sites and does not receive form submissions.
2. Instructions
Sitehold processes this data only to provide the service and on the customer's documented instructions, which are this agreement and the customer's use of the product. Sitehold tells the customer if an instruction breaks the GDPR.
3. Confidentiality
Anyone at Sitehold with access to the data is bound to confidentiality.
4. Security
Sitehold takes appropriate technical and organisational measures, at least: encryption in transit, encryption at rest, access restricted to people who need it, and logs that redact emails and leave out request bodies, cookies, headers and keys.
5. Subprocessors
The customer authorises the subprocessors listed at sitehold.app/subprocessors. Sitehold gives 14 days' notice by email before adding or replacing one. The customer may object and, if no solution is found, end the service. Sitehold imposes the same data protection duties on each subprocessor.
6. Transfers
Transfers outside the EEA rely on an adequacy decision (including the EU-US Data Privacy Framework) or Standard Contractual Clauses.
7. Assistance
Sitehold helps the customer respond to data subject requests and with security and impact assessments, as far as reasonable for the service.
8. Breaches
Sitehold notifies the customer without undue delay, and within 48 hours of becoming aware, of a personal data breach affecting customer data.
9. End
When the service ends, Sitehold deletes the customer's data within 30 days, unless the law requires keeping it. Backups expire within 2 days.
10. Audits
Sitehold provides the information needed to show compliance with this agreement. On-site audits are possible once a year at the customer's cost, with 30 days' notice.
11. Liability
The liability limits of the beta agreement apply.