WEBWITA · Private beta · by invitation · no payment card
Pilot Data Processing Agreement
WebWita · Pilot Data Processing Agreement
Parties and instructions
The customer is controller for personal data they choose to publish or collect through their website; Premium ADV, identified in the Terms, acts as processor to the extent it processes that data on their documented instructions. Account administration and the platform’s own security are governed separately by the Privacy Policy. This agreement accompanies the service for the duration of such processing.
Scope and data
The subject is hosting, maintaining, generating and recovering the customer’s basic website and, only when enabled, forwarding contact messages to verified recipients. Data can include names, business contact details, website content and ordinary enquiry text about customers, visitors or the customer’s staff. Special-category data, identity documents and credentials are outside the intended scope.
Processor commitments
Process only documented lawful instructions, including on transfers; tell the customer if an instruction appears to infringe data-protection law. Bind authorised personnel to confidentiality. Maintain proportionate technical and organisational measures, tenant access controls, secure transport, protected credentials and tested recovery. Assist with data-subject requests, security duties, impact assessments and supervisory consultation where applicable, taking account of the nature of processing.
Subprocessors and transfers
The customer grants general authorisation for the infrastructure categories and providers disclosed in the current register: IONOS hosting and Cloudflare network/security, as activated. Operator-owned TerraMaster storage is not a separate external processor. Additional external AI or video providers require prior notice, appropriate contractual safeguards and an opportunity to object before affected processing begins. Subprocessors must receive equivalent data-protection duties. Transfers require a lawful GDPR Chapter V basis.
Incidents, evidence and ending
Notify the customer without undue delay after becoming aware of a relevant personal-data breach and provide available information and updates to support their duties. Make necessary compliance information available and permit proportionate audits or inspections under agreed confidentiality and security arrangements. At the customer’s choice, return/export or delete the relevant data when processing ends, unless law requires retention. Backup deletion follows the disclosed cycle; restored deletions must be applied again. The customer remains responsible for lawful collection, their notices and the accuracy of their instructions.