Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between ApeTec Ltd (trading as SitegenOS, "we", the processor) and you, the Owner of a site hosted on SitegenOS (the controller), whenever your site collects personal data from its visitors. You accept it once: when you confirm your site, or — for an account made before that step existed — in your Owner dashboard when you first sign in.

1. Roles and scope

• You are the controller of personal data your site's visitors submit — contact and quote form entries (name, email, phone, message) and any other details they send you.
• We are your processor: we store those submissions, forward them to your email when that is enabled, and display them in your dashboard. We process visitor data only for these purposes.
• For your own account data (your email, billing records), we remain the controller — see the Privacy Policy.
• Before you have an account. Your site goes live the moment your Builder publishes it, which starts the 7 days it stays online before you have to confirm it is yours, and happens before you have an account here and before you accept this DPA. It can receive enquiries from that first moment. Throughout that window the controller is the business the site was built for — you — exactly as the site's own privacy page states, and your Builder acts on your behalf in publishing the site and in telling us where its enquiries should go. SitegenOS is the processor for that period on the same terms set out in the rest of this agreement, and accepting it when you confirm the site (or at your first sign-in) confirms those terms for that period as well as for everything after it.
• Enquiries during that window are stored, and emailed to the address your Builder gave us for you. Their contents are not readable by your Builder. Until you confirm the site they are shown on the page behind your link to confirm it, with each sender's email address and phone number partly hidden; once you confirm it, the database grants that access only to you. If the site is never confirmed it goes offline, and anything already submitted stays subject to section 7.

2. Your instructions

We process visitor data only on your documented instructions, which are: collect form submissions on your site, store them, show them to you, and forward them to you by email when enabled. A submission is recorded before any forwarding is attempted, so a failed email delivery does not lose the lead. Forwarding is a separate step you can turn off in your settings. We never use your visitors' data for advertising, profiling, or training, and we never sell it.

3. Confidentiality and security

Everyone we authorise to process visitor data is bound by confidentiality. We apply the technical and organisational measures described in the Privacy Policy: encryption in transit, access controls, and row-level security on stored data. Privileged database access runs server-side only and is never exposed to browsers.

4. Sub-processors

You authorise the sub-processors listed in the Privacy Policy. If we add or replace one, we update that list. Continuing to use SitegenOS after an update constitutes acceptance. Sub-processors are bound by terms no less protective than this DPA.

5. Assistance

Taking into account the nature of the processing, we assist you with your controller obligations through your dashboard: every submission your site has received is there for you to read and copy, which answers a visitor's request for access, and an archived submission can be deleted permanently from the Archived tab, which answers a request to erase it. "Download your data" in your account settings gives you every submission as a file. Deleting your Owner account deletes every submission your sites have received, at once. If a visitor asks us directly, we redirect them to you.

6. Personal data breach

If we become aware of a personal data breach affecting your visitors' data, we will notify you without undue delay at your account email with the information reasonably available to us.

7. Retention and deletion

• Visitor form submissions are retained for 12 months from submission, then deleted automatically (the retention promise printed on your site's privacy page).
• A copy of your visitors' submissions is in the file "Download your data" gives you, in your account settings.
• If your site is deleted, its stored submissions are deleted within a day; if you delete your Owner account, your sites' submissions are deleted at once. A site that has been offline for twelve months — for whatever reason, usually because it was not confirmed, or not confirmed again in a month — is deleted, and its submissions with it, at once. Only statutory financial records are kept, and the record that each submission was emailed to you, which names no visitor and is deleted after 6 months.

8. Audit

On written request (no more than once per year), we will provide the information reasonably necessary to demonstrate compliance with this DPA.

9. Legal framework

This DPA is governed by the law of England and Wales and is intended to satisfy Article 28 UK GDPR. If any conflict arises between this DPA and the Terms of Service, this DPA prevails for visitor personal data.

Contact

Questions? Email hello@sitegenos.com.

SitegenOS is a product of ApeTec Ltd, registered in England and Wales, company number 17065917. Registered office: 124–128 City Road, London EC1V 2NX.