Data processing agreement
This agreement covers the personal details of people who contact your business through the website we build and host for you. It forms part of our terms of service and applies for as long as we host your site.
1. The parties and their roles
This agreement is between the business that holds an Ibis Websites account ("you") and EMMV International Ltd, trading as Ibis Websites, company number HE 491820, of Dimokratias 31, 1st Floor, Office 101, 8028 Paphos, Cyprus ("we" or "us").
For the enquiry data described below, you are the controller and we are your processor. In this agreement, "data protection law" means the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, and any other privacy law that applies to the enquiry data, including US state privacy laws.
2. The data we process for you
| Purpose | To collect enquiries through your website, deliver them to you by email and in your account, filter out spam, and keep them available for you to manage. |
|---|---|
| People concerned | Visitors to your website who send an enquiry or tap to call, message or email you. |
| Types of data | Name, phone number, email address, postcode or ZIP code, the service needed and when, the message and any photos they attach, the page they used, the time, which contact button was tapped, their consent choices, their browser type, and a scrambled version of their IP address used for spam protection. |
| Sensitive data | Our forms are not designed to collect sensitive data, such as health information. Please don't ask visitors for it. |
| How long | Enquiries are kept for 24 months and then deleted automatically. You can delete them sooner in your account. |
3. Our commitments as your processor
We will:
- only process the enquiry data on your documented instructions, which are these terms and the way you use your account, unless the law requires otherwise, in which case we will tell you first if we are allowed to;
- tell you straight away if we believe an instruction breaks data protection law;
- make sure everyone at our company who can access the enquiry data is bound by a duty of confidentiality;
- keep the security measures in section 6 in place;
- never sell the enquiry data, or use it for our own purposes, for advertising, or to build profiles; and
- help you, as far as we reasonably can, to meet your own obligations under data protection law, including data protection impact assessments and consultations with authorities.
4. Requests from the people concerned
You can view, download and delete enquiries in your account. If you need more help responding to someone who wants to access, correct or delete their details, we will help you. If someone contacts us directly about an enquiry they sent you, we will pass the request to you and not respond to it ourselves unless you ask us to.
5. Subprocessors
You agree that we can use the providers listed below to help us process the enquiry data. Each is bound by a written contract with data protection obligations at least as strong as those in this agreement, and we remain responsible to you for their work.
| Provider | What they do | Where |
|---|---|---|
| Supabase Inc. | Database and file storage for enquiries and attached photos | Stored in London, United Kingdom |
| Netlify Inc. | Hosting your website and receiving form submissions | United States and global network |
| Resend Inc. | Sending enquiry notification emails to you | United States |
We will give you at least 14 days' notice by email before adding or replacing a subprocessor. If you have a reasonable data protection objection, tell us during that time. If we can't resolve it, you can cancel your account without penalty.
6. Security
We protect the enquiry data with measures appropriate to the risk, including:
- encrypted connections (HTTPS) for every website and for your account;
- encryption of stored data by our database and hosting providers;
- access controls so each business can see only its own enquiries, and our team can access them only when needed to support you;
- storing visitors' IP addresses only in scrambled form;
- spam and abuse filtering on every form; and
- backups and monitoring provided by our hosting and database providers.
7. Data breaches
If we become aware of a breach affecting the enquiry data, we will tell you without undue delay, and in any case within 48 hours. We will give you the information we have about what happened, the data affected and what we are doing about it, and help you with any notifications you need to make.
8. International transfers
Enquiry data is stored in London, in the United Kingdom. Where a subprocessor handles it in the United States or another country without an adequacy decision, we rely on recognised safeguards: the EU-US Data Privacy Framework where the provider is certified, or the European Commission's standard contractual clauses, together with the UK addendum for data covered by UK law.
9. When your account ends
When your account ends, you can download your enquiries before your site goes offline. We will delete the enquiry data within 30 days after your account ends, unless the law requires us to keep it. Copies in backups are deleted automatically on the providers' normal backup cycles.
10. Information and audits
We will give you the information you reasonably need to show that we meet our obligations under this agreement. If that isn't enough, you can audit our compliance, at your own cost, no more than once a year and with at least 30 days' notice, in a way that protects the confidentiality of our other clients.
11. US privacy laws
Where US state privacy laws apply, we act as your service provider or processor. We will not sell or share the enquiry data, keep or use it outside our direct business relationship with you, or combine it with personal information from other sources, except as those laws allow.
12. General
If this agreement conflicts with our terms of service on how enquiry data is handled, this agreement wins. Our liability under this agreement is subject to the limits in our terms of service, except where the law doesn't allow it to be limited. This agreement is governed by the laws of the Republic of Cyprus.