Data Processing Addendum

This Addendum is part of your agreement with TheWebSuite whenever we build, host or look after a system that holds personal information about your own customers, clients, staff or contacts. In it, you are the business that decides what that information is for (the “controller”), and we handle it only to provide our services to you (the “processor”, or “service provider” under California law). It sits alongside our Terms of Service, the License Terms and your Project Agreement; where they disagree about your customers’ personal information, this Addendum wins.

1. What we process and why

We process whatever personal information you or your users put into the system we provide, such as names, contact details, records, messages and files, for as long as we build, host or care for that system. We use it only to build, run, secure, back up, support and fix that system for you. Your project paperwork names the system and what it does.

2. Only on your instructions

We act only on your documented instructions: this Addendum, your agreement, and what you ask of us in writing (an email or a request in your portal counts). If a law ever requires us to do something else with your data, we tell you first, unless that law forbids it. We do not sell your customers’ personal information, we do not share it for advertising, we do not use it to train AI models, and we do not combine it with other data except to provide the services to you.

3. People who can see it

Only people working for TheWebSuite who need access to do the work can reach your data, and each of them is bound to keep it confidential. Our AI tools may help with the work; they never send anything to anyone without a person approving it.

4. Keeping it secure

We protect your data with the measures in our list of services and our written security rules, including: encrypted connections everywhere; database rules that let each user reach only what they should; secrets kept out of the code; limits that block repeated guessing; a record of changes that cannot be edited; daily backups; and a review before changes that touch sign in, money or personal data. We keep these measures up to date as risks change.

5. Other services we use

You agree that we may use the outside services listed at thewebsuite.co/subprocessors. Each one is bound to protect data at least as well as this Addendum requires, and we stay responsible to you for them. Before we add or replace a service that will receive your data, we update that page and email you at least 14 days ahead. If you object for a good reason and we cannot find a fix together, you may end the affected service and leave with the handover described in our Terms.

6. If something goes wrong

If we learn of a breach that affects your data, we tell you without undue delay, and no later than 48 hours after we confirm it, with what we know: what happened, what data and roughly how many people, what we have done, and who to contact. We keep updating you as we learn more, so you can meet your own duties to tell regulators or your customers. We do not notify your customers ourselves unless you ask us to.

7. Helping you meet your duties

When one of your customers asks you to see, correct, export or delete their information, we help you do it, through the system itself where it can and by hand where it cannot. If we receive such a request directly, we pass it to you rather than answering it ourselves. We also help, as far as the information we hold allows, with your security, your breach notices and any data protection assessment you need to do.

8. Showing that we comply

On request, once a year, we answer a reasonable written security questionnaire and give you the information you need to see that we keep this Addendum. If a regulator requires more, or a breach has happened, we cooperate with an audit by you or an independent auditor you choose, at your cost, with 30 days’ notice, during business hours and without access to other clients’ data.

9. When we part

When our services end, you choose whether we return your data (an export in a standard format) or delete it. Unless you ask otherwise, we give you the export and the 14 day handover in our Terms, then delete your data from the live system; copies in our providers’ backups disappear as those backups expire. We keep only what a law requires us to keep, and only for as long as it requires.

10. Where your data is

Our own database is in the United States. The location of a system we host for you is named in its project paperwork. If you will send us personal information about people in the European Union or the United Kingdom, tell us before you do, and we will sign the standard contractual clauses for those transfers with you.

11. Questions

Email info@thewebsuite.co with the subject “Data Processing Addendum”. A signed copy of this Addendum is available on request.