Data Processing Agreement

Last updated: 27 October 2026

This Data Processing Agreement ("DPA") is part of the Siteholm Terms of Service. It applies when we process personal data on behalf of a customer through the customer's website, in particular bookings on the Business and Shop plans and orders on the Shop plan. It meets the requirements of Article 28 of the General Data Protection Regulation (GDPR).

1. Parties

• The controller is the customer who holds a Siteholm plan ("you").
• The processor is Siteholm, India ("we").

You accept this DPA when you accept the Terms of Service. No signature is needed. If you want a signed copy, email hello@siteholm.com.

2. Subject and duration

• We host your website and run its booking, shop and contact form functions. In doing so we process personal data of your website visitors and customers on your behalf.
• This DPA lasts as long as we process personal data for you under your plan, and ends when that data has been deleted or returned under section 10.

3. The processing

• Contact form messages are passed through our mail server to you and are not kept in a database.
• Our mail server logs the sender, recipient, time and subject of contact form messages and keeps these logs for up to 35 days.
• We never receive card or bank details of your customers. Payments in your shop go directly to your own Mollie or Stripe account. Mollie or Stripe is your provider under your own agreement with them and is not our sub-processor.

4. Our obligations

• We process the personal data only on your documented instructions. These Terms, this DPA and the settings you choose in your dashboard are your instructions. If we believe an instruction breaks data protection law, we tell you.
• We do not use the data for our own purposes, and we do not sell it.
• Everyone who has access to the data on our side is bound by confidentiality.
• We take the technical and organisational measures in the annex to protect the data.
• We help you, as far as we reasonably can, to answer requests from people who use their GDPR rights, and with security, breach notification, data protection impact assessments and prior consultation (GDPR Articles 32 to 36).
• If someone contacts us directly about data we process for you, we pass the request to you without delay and do not answer it ourselves, unless you ask us to.

5. Your obligations

• You are responsible for having a legal basis for the processing and for informing your customers. Your site needs a privacy policy that names us as your hosting provider. Our template privacy page can be a starting point.
• You must not ask us to process data in a way that breaks the law.

6. Sub-processors

You give us general authorisation to use sub-processors. The current ones are

Anthropic PBC (USA), whose software writes and changes the content of your site, is not a sub-processor. We use it under Anthropic's consumer terms, so for now Anthropic acts as a separate controller, and it receives your customers' personal data only if you include such data in your brief, uploads or change requests. We therefore ask you not to put your customers' personal data in them.

• We tell you by email at least 30 days before we add or replace a sub-processor. You can object on reasonable data protection grounds within that time. If we cannot meet your objection, you can end your plan before the change applies.
• We bind each sub-processor by contract to the same data protection obligations as in this DPA. Anthropic is not covered by this until we use it under its commercial terms.

7. Transfers outside the EU and EEA

We process your data on our servers in Germany. We reach it from India, outside the EU and EEA. For that access, the Standard Contractual Clauses for transfers from a controller to a processor (Module 2, Commission Implementing Decision (EU) 2021/914) apply between you as data exporter and us as data importer, and they form part of this DPA. Sections 1, 3 and 6 and the annex of this DPA fill in their annexes. Clause 7 does not apply. Under clause 9, option 2 applies with the notice period in section 6. The optional wording in clause 11 is not used. Under clause 13, the supervisory authority is the one of the EU or EEA country where you are established. Under clauses 17 and 18, the law and the courts of Sweden apply. For any other transfer outside the EU and EEA we use a valid safeguard under Chapter V of the GDPR, such as an adequacy decision, the EU-US Data Privacy Framework or the Standard Contractual Clauses.

8. Personal data breaches

If we become aware of a personal data breach that affects data we process for you, we tell you without undue delay, and where possible within 48 hours. We give you the information we have so you can meet your own duty to notify the authority and the people affected.

9. Audits

We give you the information you need to show that we meet this DPA. You can send us written questions once a year, or more often after a breach or when an authority asks. An on-site audit is possible with 30 days' notice, during business hours, at your cost, and under a confidentiality agreement.

10. End of the processing

When your plan ends, we delete the personal data we process for you within 90 days, unless the law requires us to keep it. Before the plan ends you can ask us for a copy of your bookings and orders in a common file format.

11. Liability and order of documents

Liability under this DPA follows the Terms of Service and Article 82 of the GDPR. If this DPA and the Terms of Service conflict on data protection, this DPA wins. The rest of this DPA follows the governing law in our Terms.

Annex - technical and organisational measures

• Encrypted connections (HTTPS with TLS) for our app and every customer site
• Servers in a certified data centre of Contabo GmbH in Germany
• Server access only by key-based login for the people who run the service
• Database not reachable from the internet
• Customer passwords stored only in hashed form
• Payment provider keys for shops stored encrypted
• System and security updates applied regularly
• Server logs kept for a short time only, to detect misuse and faults
• Personal data deleted at the end of the plan as set out in section 10