Data Processing Agreement

1. Roles (Data Ownership & GDPR Roles)

When you create a Webbild site, you are the controller for personal data your site collects from visitors and customers (newsletters, orders, analytics identifiers, and similar). Webbild is the processor: we host and process that data on your behalf to run the platform.

Separately, Webbild is the controller for your platform account (name, email, login security). That is covered by our Terms and Privacy Policy, not by this DPA.

2. What we process for you

Processing is limited to operating the features you use on your site: content and media hosting, newsletter subscriptions, consent-gated analytics, shop orders when enabled, and security/support measures needed to keep the service running. We do not use your customers’ data for independent Webbild marketing.

3. Your responsibilities

• Have a lawful basis and appropriate notices for your visitors/customers.
• Do not use Webbild to process special-category (sensitive) personal data.
• Accept this DPA when creating a site (version and timestamp are stored).

4. Our responsibilities

• Process tenant PII only as needed to provide the service and this DPA.
• Apply appropriate security measures and keep staff access confidential.
• Assist with data-subject requests and incidents in a way that fits an SMB SaaS.
• Delete or return site data according to the site deletion / purge lifecycle.

5. Subprocessors and transfers

We use subprocessors listed in the Privacy Policy — Subprocessors section. Some may process data outside the EEA with appropriate safeguards. See also International data transfers.

6. Contact

Questions about this DPA: info@webbild.com.