Data Processing Addendum

1. Roles and scope

The customer is the controller of personal data in its site content and form submissions. fastwebsite.app is the processor for that data. We process it only to provide the service, follow the customer’s documented instructions, and meet legal obligations.

2. Customer obligations

• Provide a lawful basis and privacy notice for the data you collect.
• Do not instruct us to process data you are not allowed to process.
• Respond to data-subject requests that relate to your business.
• Configure retention and delete sites or submissions when they are no longer needed.

3. Our obligations

• Process personal data only for the documented purpose.
• Keep personnel who access data under confidentiality obligations.
• Implement appropriate technical and organisational security measures.
• Assist with reasonable data-subject requests and impact assessments.
• Notify the customer without undue delay after becoming aware of a personal-data breach.
• Delete or return data at the end of the service, subject to legal retention.

4. Subprocessors

The customer authorises the following subprocessors. We will give reasonable notice before adding a new subprocessor and will let the customer object on reasonable grounds.

5. Security measures

Measures include tenant-scoped access, hashed passwords, signed sessions, hashed reset and verification tokens, encrypted transport, upload type and size checks, SVG sanitisation, output escaping, rate limits, and least-privilege provider tokens. No system is perfectly secure. The parties will review security incidents and take reasonable remediation steps.

6. Breach notification

We will notify the customer without undue delay after confirming a personal-data breach affecting their data. The notice will describe what happened, the likely consequences, the measures taken, and a contact point. The customer is responsible for notifying regulators and data subjects where required.

7. Data-subject requests

If a data subject contacts us about data controlled by a customer, we will refer the request to the customer without responding substantively, unless the law requires otherwise. We will assist with export, correction, or deletion when the customer provides instructions.

8. International transfers

Where personal data is transferred outside the EEA or UK, the parties will rely on an appropriate transfer mechanism such as standard contractual clauses or an adequacy decision. Contact us for the current subprocessor locations and transfer documentation.

9. Return and deletion

At the end of the service, the customer can export its workspace as JSON and delete its account. We delete the workspace, sites, edits, submissions, and events, subject to backup expiry and legal retention. The customer remains responsible for any DNS records at its registrar.

10. Audit and contact

On reasonable request, we will provide information about our security measures and subprocessors. Formal audits may be subject to confidentiality and cost terms. To execute this DPA, contact support@fastwebsite.app with the legal entity name and signatory details.