data processing agreement

This agreement is between:

• the site owner who accepts it in their website's admin console (the "controller"), and
• S. Digital & Creative, a sole trader based in England and Wales, who runs the website platform at yourhostsophie.com (the "processor", "we", "us").

It applies whenever we process personal data on the controller's behalf by hosting and running their website on the platform. It meets the requirements of Article 28 of the UK GDPR and forms part of the terms under which the controller uses the platform.

1. What we process, and why

The details of the processing are set out in Schedule 1. We process personal data only to provide the platform and the features the controller chooses to use.

2. Our obligations

We will:

1. Follow the controller's instructions. We process personal data only on the controller's documented instructions: this agreement, the settings they choose in the admin console, and anything else they ask of us in writing. The only exception is where the law requires otherwise, and then we will tell the controller first unless the law forbids it. If we think an instruction breaks data protection law, we will say so.
2. Keep it confidential. Everyone we authorise to process the data is bound by confidentiality.
3. Keep it secure. We take appropriate technical and organisational measures, including those in Schedule 2.
4. Use sub-processors only as agreed. The controller gives general authorisation for the sub-processors in Schedule 3. We will give at least 30 days' notice, in the admin console or by email, before we add or replace one. The controller can object on reasonable data protection grounds. If we can't resolve the objection, the controller may stop using the platform. Each sub-processor is bound by data protection terms that protect the data at least as well as this agreement. We remain responsible for them.
5. Help with individuals' requests. We provide tools in the admin console, and will give reasonable help, so the controller can respond to people exercising their rights: access, rectification, erasure, restriction, portability and objection. If we receive a request directly, we pass it to the controller and do not respond to it ourselves.
6. Help the controller meet its own obligations. This covers security, breach notification, data protection impact assessments and consulting the ICO, taking into account the nature of the processing and the information available to us.
7. Report personal data breaches. We tell the controller without undue delay, and within 48 hours, after becoming aware of a breach affecting their data. We give them the information they need to meet their own reporting duties.
8. Delete or return the data at the end. When the controller stops using the platform, we delete their website's personal data after a short recovery period, unless the law requires us to keep it. Before then, the controller can export their data or ask us to return it.
9. Show we comply. We make available the information needed to demonstrate compliance with this agreement, and allow for reasonable audits by the controller or an auditor they appoint, with reasonable notice and at the controller's cost.
10. Protect international transfers. We transfer personal data outside the UK only with the safeguards UK law requires, as listed in Schedule 3.

3. The controller's obligations

The controller:

• is responsible for having a lawful basis for the personal data their website collects, including any special category data;
• publishes an accurate privacy notice on their website. The platform provides one at /privacy, generated from the site's settings, and the controller checks that it is accurate and complete;
• keeps their admin account credentials secure; and
• makes sure their instructions to us comply with data protection law.

4. Support access

To support the controller, run the platform or keep it secure, our platform staff may sign in to the controller's admin console as an administrator. This access is limited to those purposes, and it is recorded.

5. Our own data

For information about the controller and their admin users, such as admin accounts, admin activity logs and use of the AI assistant, we act as a controller in our own right. Our platform privacy notice explains how we handle it.

6. Liability, duration and changes

• Liability: each party's liability under this agreement is as set out in the platform terms, and as the UK GDPR provides.
• Duration: this agreement lasts for as long as we process personal data for the controller.
• Changes: we may update this agreement to reflect changes in law or in the platform. We will give notice in the admin console, and material changes need to be accepted again.
• Governing law: this agreement is governed by the law of England and Wales.

Schedule 1: Details of the processing

Schedule 2: Security measures

• All connections use HTTPS (TLS).
• Passwords are stored only as salted PBKDF2 hashes.
• Each website has its own separate database.
• Private photos are only served after an access check.
• Forms are protected against cross-site request forgery (CSRF).
• Admin areas are only available to signed-in administrators.
• The platform operator console is limited to approved networks.
• Server access is restricted to key-based administrator logins.
• Servers are kept up to date, and logs are rotated so they are kept for no more than 12 months.
• Automated spam and fraud filtering is in place.
• Data from inactive visitor accounts, and old security records, is deleted automatically.

Schedule 3: Sub-processors

Services the controller connects themselves, such as their own Google Calendar, email account, WhatsApp or AgeVerif, are the controller's own choices and are not our sub-processors.