Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Sitebefy and the customer (the controller), and applies wherever Sitebefy processes personal data of the customer's website visitors or users on the customer's behalf.

Roles and scope#

For your account data, Sitebefy is the controller and the Privacy Policy applies. For the personal data your website collects from its visitors (form submissions, comments, orders, analytics your site runs), you are the controller and Sitebefy processes it only to host and operate your site.

Subject matter, duration, nature and purpose#

Processing consists of storing, serving, backing up and, at your request, transforming (for example with AI features you invoke) the content and data of your websites, for as long as your account and those sites exist.

Instructions#

Sitebefy processes this data only on your documented instructions: what you configure, upload, publish and invoke in the product is the instruction. We do not access site data beyond what operating the service requires, and we do not use your site's visitor data for our own purposes.

Confidentiality#

People with access to customer data are bound by confidentiality obligations. Support staff see account data through tooling that masks personal details unless full access is required and recorded.

Security#

The measures are described in the Security Policy and include encrypted transport, per-site isolation at the operating system level, hashed credentials, re-authentication for sensitive operations, audit logging, and backups retained up to 14 days.

Subprocessors#

The subprocessor list is the provider table in the Privacy Policy.

Assistance#

Sitebefy assists you in meeting your own obligations: the product includes the means to export site data, to delete it, and to take a site offline; we pass on without undue delay any data subject request we receive that belongs to you; and we notify you without undue delay of a personal data breach affecting your data, with what we know at the time.

Deletion and return#

When you delete a site, or your account, the site's data is deleted as the Privacy Policy describes, leaving routine backups to expire within 14 days. You can create and restore backups of a site inside the product; a self-serve download of a full site copy does not exist yet, so if you need one before deleting, ask us through the contact page.

Last updated: 5 Sep 2026