Parties
- Controller: the customer as identified in the customer account ("Customer").
- Processor: 3XAYA LTD (Sitewig), company no. 17437429, 128 City Road, London EC1V 2NX, United Kingdom ("Sitewig"). Contact: kontakt@sitewig.com.
1. Purpose and precedence
1.1 This agreement governs Sitewig's processing of personal data on behalf of the Customer when Sitewig provides services under the Terms of Service (the "Main Agreement"): web hosting, website builder (including web shop and booking where included in the Customer's plan), email, DNS, CDN and backup.
1.2 In case of conflict this agreement prevails over the Main Agreement on data protection matters.
2. Instructions (Art. 28(3)(a))
2.1 Sitewig processes personal data only on the Customer's documented instructions, including with regard to transfers to third countries. The instructions are the Main Agreement, this agreement with its annexes, and the Customer's configuration and use of the services.
2.2 Sitewig immediately informs the Customer if, in its opinion, an instruction infringes the GDPR, the UK GDPR or other data protection law.
2.3 Where EU, Member State or UK law requires Sitewig to process the data otherwise, Sitewig informs the Customer before processing unless that law prohibits it.
3. Confidentiality (Art. 28(3)(b))
Sitewig ensures that persons authorised to process the data have committed to confidentiality or are under a statutory obligation of confidentiality, and that access is granted only as necessary.
4. Security (Art. 28(3)(c), Art. 32)
4.1 Sitewig implements the technical and organisational measures in Annex 2 and adapts them to the risk. Sitewig is subject to NIS2 and maintains a risk-management and incident-handling programme.
4.2 The Customer is responsible for security within its control: passwords, two-factor authentication, software it installs (e.g. WordPress and plugins), access rights on its website, and assessing whether the security level is adequate for the data it chooses to store (e.g. special categories).
5. Sub-processors (Art. 28(3)(d), 28(2) and (4))
5.1 The Customer grants general prior authorisation for Sitewig to engage sub-processors. Sub-processors at signature are listed in Annex 3.
5.2 Sitewig gives at least 30 days' notice of any addition or replacement by email and at sitewig.com/underdatabehandlere. The Customer may object on reasonable grounds within that period. If no solution is found, the Customer may terminate the affected services and receive a pro-rata refund for the unused period.
5.3 Sitewig imposes the same data protection obligations on sub-processors by written contract and remains fully liable to the Customer for their processing.
6. International transfers
6.1 The Customer's hosted content (websites, databases, files, email, DNS zones, backups) is stored in the EU (Germany and Finland).
6.2 Sitewig is established in the UK, which benefits from an EU adequacy decision (valid until 27 December 2031). Remote access from the UK to data in the EU is covered by that decision.
6.3 Any other transfer takes place only with a valid transfer mechanism under Chapter V GDPR, such as EU Standard Contractual Clauses (2021/914) with the UK Addendum or the EU-US Data Privacy Framework, see Annex 3.
7. Assistance (Art. 28(3)(e) and (f))
7.1 Sitewig assists the Customer with appropriate technical and organisational measures in responding to data subject requests (Chapter III). The services include self-service export and deletion. Requests received directly are forwarded to the Customer without undue delay.
7.2 Sitewig assists with compliance with Arts. 32–36: security, breach notification and communication, DPIAs and prior consultation.
7.3 Assistance beyond the standard functions may be charged at reasonable time-based rates unless caused by Sitewig's own fault.
8. Personal data breaches
8.1 Sitewig notifies the Customer without undue delay and no later than 48 hours after becoming aware of a breach affecting the Customer's data.
8.2 The notification includes, as far as possible, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. Information not yet available is provided in phases.
8.3 The Customer notifies the supervisory authority within 72 hours where required.
9. Deletion and return (Art. 28(3)(g))
When the Main Agreement ends the Customer may export its data for 30 days. Sitewig then deletes the data; backup copies are deleted within a further 30 days unless EU, Member State or UK law requires retention.
10. Information and audits (Art. 28(3)(h))
10.1 Sitewig makes available the information necessary to demonstrate compliance with Art. 28: written documentation, answers to reasonable questionnaires, and sub-processors' certifications and reports (e.g. Hetzner's ISO/IEC 27001).
10.2 The Customer or an independent auditor bound by confidentiality may carry out an inspection on 30 days' notice, at most once a year, unless there has been a serious breach or an authority requires it. The Customer bears its own costs.
11. Liability and term
11.1 The limitation of liability in the Main Agreement applies to the extent permitted by law; it does not apply to data subject claims or fines where the law does not permit limitation.
11.2 This agreement applies as long as Sitewig processes personal data for the Customer.
12. Governing law
This agreement follows the governing law and jurisdiction of the Main Agreement. Mandatory provisions of the GDPR and UK GDPR prevail.
---
Annex 1 – Processing
| Purpose | Hosting of websites, web shops, booking systems, databases and files; email (receipt, storage, sending, spam filtering); authoritative DNS; CDN; backup; support and operations |
| Nature | Storage, transmission, caching, backup and restore, deletion, technical access for support and troubleshooting (only where necessary or at the Customer's request) |
| Data subjects | The Customer's users, customers, employees, contacts and website visitors; senders and recipients of email |
| Personal data | Whatever the Customer chooses to store: contact details, correspondence, order and booking data, log data (IP addresses, user agents). Special categories only if the Customer stores them – the Customer must assess the security level |
| Duration | Term of the Main Agreement + 30 days (export) + 30 days (backup) |
| Location | Germany (Nuremberg/Falkenstein) and Finland (Helsinki); account data in Frankfurt (Supabase/AWS); CDN edges worldwide for Customers who enable CDN; US (Anthropic) for the AI features in Annex 3 (the AI assistant in webmail, only when the user turns it on; NinaAI in the website builder and AYAAI in the app builder, only when the Customer uses them); US/EU (Resend) for email to the Customer's visitors; Denmark (GatewayAPI) for SMS reminders, only when the Customer turns them on |
| Retention of the Customer's visitor data | Contact form messages: the plan's inbox period (30 days Free, 365 days Starter, at most 24 months on other plans). Bookings: name, email, phone, address and notes are anonymised 24 months after the appointment (the Customer may choose a shorter period). Web shop orders: paid orders are anonymised after the end of the financial year + 5 years (bookkeeping law); never-paid, cancelled orders are deleted after 90 days. AI response cache: 35 days. The Customer can delete or anonymise a customer in the control panel at any time |
Annex 2 – Technical and organisational measures (summary)
- Encryption: TLS 1.2+ in transit (HTTPS, SMTP/IMAP with STARTTLS/TLS), encrypted backups (AES-256).
- Access control: SSH keys, two-factor authentication for administrators, least privilege, logging of administrative access.
- Network: firewalls, segregated private networks, DDoS protection via Hetzner.
- Isolation: customers separated per system user/container and PHP-FPM pool.
- Mail: self-hosted Mailu with SPF/DKIM/DMARC, spam and virus filtering; no third-party mailbox provider.
- Patching: critical updates within 72 hours, others monthly.
- Backup: daily, 30-day retention at a separate location; restores tested regularly.
- Monitoring: central logging, alerting and malware scanning.
- Organisation: information security policy, incident handling (NIS2: early warning 24 h, notification 72 h), confidentiality agreements, security training.
- Physical security: Hetzner's ISO/IEC 27001-certified data centres.
Annex 3 – Sub-processors
| Sub-processor | Service | Data location | Transfer mechanism |
|---|---|---|---|
| Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany | Servers, storage, backup, mail servers (Mailu) | Germany and Finland | EU – not applicable |
| Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513 (infrastructure: AWS eu-central-1) | Account database and login for control panel and webmail (Customer account data – not hosted content) | Frankfurt, Germany | EU SCCs (2021/914, Modules 2/3) + UK Addendum for remote access outside the EU |
| BunnyWay d.o.o., Dunajska cesta 165, 1000 Ljubljana, Slovenia | CDN (only where the Customer enables CDN, Pro/Business) | EU company; global edge servers | Transfers to edge servers outside the EU/EEA take place under bunny.net's data processing agreement |
| Hosting Concepts B.V. (Openprovider), Rotterdam, Netherlands | Domain registration (registrant data); optional secondary DNS | EU | EU – not applicable |
| Anthropic, PBC, 548 Market Street, PMB 90375, San Francisco, CA 94104, USA | AI in the website builder (NinaAI), app builder (AYAAI), translation and setup help (e.g. products and booking services from the Customer's text, CSV files and images), and the AI assistant in webmail (only when the user turns it on). The Claude API processes only the content the Customer or user asks the AI to work on, to return the result. No other AI providers are used. Anthropic does not use API data to train models and retains data only under its API data terms (short-term, for abuse monitoring) | USA | EU SCCs (2021/914) + UK Addendum |
| Resend, Inc., USA | Email to the Customer's visitors: transactional email (contact form, booking, web shop), newsletters and marketing emails the Customer sends or turns on (e.g. abandoned-basket and back-in-stock reminders), and system emails about the Customer's services | US/EU | EU-US Data Privacy Framework + SCCs |
| GatewayAPI (OnlineCity.IO ApS), Denmark | SMS booking reminders (only when the Customer turns SMS on and the end customer has agreed): phone number, first name, service, time and business name | EU (Denmark) | EU – not applicable |
Calendar sync (Google Calendar, Microsoft Outlook): when the Customer connects its own Google or Microsoft account, booking details (service, time, end customer's first name) are transferred to the Customer's calendar on the Customer's instructions and under the Customer's own agreement with Google or Microsoft. Google and Microsoft are not Sitewig's sub-processors for this.
Stripe acts mainly as an independent controller for payment data and is not a sub-processor for the Customer's hosted content. Registries (Punktum dk, EURid, Verisign etc.) are independent controllers.