Data Processing Agreement (DPA)

This data processing agreement (the “DPA”) sets out the parties’ obligations under data protection law arising from the agreement on the use of the Sitebaze platform (the “Main Agreement”). It applies to all processing of personal data that the provider (processor) carries out on behalf of the customer (controller) in the course of using the platform, such as contact details in the CRM, login data of client portal users, or analytics and social media data connected by the customer.

This DPA takes effect upon conclusion of the Main Agreement and applies for its duration. In the event of conflict, the provisions of this DPA prevail over those of the Main Agreement in matters of data protection law.

The subject matter of the processing is the provision of the Sitebaze platform as software as a service, including the storage, analysis and display of data supplied by the customer or retrieved via connected services. The purposes are the performance of the contract with the customer: SEO and visibility analysis, monitoring, evaluation of social media and advertising data, CRM features and client portals.

Nature of the processing: collection, storage, structuring, analysis, display, transmission to recipients designated by the customer, and erasure.

Categories of data (depending on the features used by the customer): master data (name, email address), contact and communication data (CRM contacts, form entries), login data for client portals, usage and performance data from connected services (for example Search Console, Analytics, social media and advertising accounts), and technical connection data.

Data subjects: the customer’s staff and agents, the customer’s own customers and prospects (for example CRM contacts, portal users), and visitors to the customer’s websites (in aggregated or truncated form).

• Processing solely on documented instructions from the customer (Art. 28(3)(a) GDPR); the customer’s use of the platform’s features constitutes such an instruction.
• Commitment to confidentiality of all persons involved in the processing (Art. 28(3)(b) GDPR).
• Implementation of appropriate technical and organisational measures pursuant to Art. 32 GDPR (Annex 1 – TOMs).
• Assistance to the customer with data subject rights (Art. 12–23 GDPR), data protection impact assessments and notification obligations, as far as possible using suitable means provided by the platform (for example export, erasure and disclosure features).
• Notification of the customer without undue delay in the event of a personal data breach affecting the processing under this DPA.
• Notification of the customer if, in the provider’s opinion, an instruction infringes data protection law.

The customer grants general authorisation for the engagement of the sub-processors listed below. The provider will give prior notice of intended changes in text form (for example by email or an in-app notice); the customer may object on serious grounds.

Where the customer connects their own third-party services (for example Google Search Console, Google Analytics, Meta, TikTok, YouTube, advertising accounts), those are not sub-processors of the provider but transfers to the customer’s own contractual partners, initiated by the customer.

The provider implements in particular the following measures (extract; for the current version see the date above):

• Encryption: TLS for all transmissions; encryption of sensitive fields and access tokens in the database (AES-256-GCM); encrypted backups.
• Access control: role-based permissions, two-factor authentication and passkeys, tenant-separated data storage with row-level security.
• Infrastructure: hosting in German data centres, firewalls, administrative access only via VPN, logging of security-relevant events.
• Availability: daily encrypted backups held off-site, restore tests, monitoring and alerting.
• Organisation: confidentiality undertakings, need-to-know principle, defined processes for data breaches and data subject rights.

If a data subject contacts the provider directly, the provider will forward the request to the customer without undue delay. The provider supports the customer through the export, rectification and erasure features available in the platform.

After termination of the Main Agreement, all personal data processed on the customer’s behalf will be erased once the grace periods described in the Main Agreement have expired, unless statutory retention obligations apply. When connected services are disconnected, the associated access tokens are revoked and stored histories are deleted.

Upon request, the provider makes available to the customer all information necessary to demonstrate compliance with the obligations under Art. 28 GDPR. On-site audits are possible after reasonable prior notice during normal business hours, to the extent that equivalent evidence (such as certifications or audit reports) cannot be provided.

Liability is governed by the provisions of the Main Agreement; Art. 82 GDPR remains unaffected.

Please note: this DPA is a standard version applying to all customers. For individual amendments, please contact support@sitebaze.com.