Data processing agreement

Who is who

You are the data controller for every enquiry submitted through your website. You decide what those details are used for, how long you keep them and who you share them with.

We are your processor for that data. We act only on your instructions, which are the ones set out in this agreement and in your use of the service, and we never use your enquiries for our own purposes.

For your own account details, such as your email address, your business information and your billing, we are the controller rather than your processor. The privacy policy covers that side.

What we process, and for how long

The subject matter is enquiries submitted through the website we build for you. The duration is the life of your subscription, plus the retention period below.

The categories of person are your prospective and actual customers. The personal data is what your form asks for: a name, a phone number, an email address, a postcode, the message they wrote, and which page of your site they sent it from. We record no special category data and ask for none.

We also record cookieless analytics about visits to your site: the page, the referrer, and a visitor value described in the cookie policy.

Only on your instructions

We process enquiry data only to provide the service: to store it, to run it through moderation, to email it to you, and to show it to you in your portal. We do not sell it, mine it, or use it to train anything.

If we ever believe an instruction of yours would breach data protection law, we will tell you rather than carry it out.

Confidentiality and security

Everyone with access to your enquiry data is bound to keep it confidential.

Data is encrypted in transit. Access to the production database is limited to those who need it to run the service. Passwords are stored hashed and never in plain text.

Who else touches it

These are the only companies other than us that handle an enquiry from your website. You are agreeing to us using them. We will tell you before we add or replace one, and you can object.

Railway, which runs the software and holds the database your enquiries are stored in.

Cloudflare, which serves your domain, so an enquiry passes through it on its way to us.

Resend, which sends you the email telling you an enquiry has arrived.

Nobody else. Enquiries are not sent to any advertising, analytics or artificial intelligence service.

Helping you meet your obligations

If one of your customers asks you for a copy of their data, asks you to correct it, or asks you to delete it, we will help you answer within the time the law allows. You can export and delete enquiries from your portal.

If there is a personal data breach affecting your enquiries, we will tell you without undue delay and give you what you need to make your own report.

Where the data is

Your enquiries are stored and processed by the providers named above.

When it ends

When your subscription ends, you can export your enquiries. After the retention period in the cancellation policy we delete them, unless the law requires us to keep them for longer.

You may audit our compliance with this agreement, or ask us for the information you need to satisfy yourself of it.