Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between ApeTec Ltd (trading as SitegenOS, "we", the processor) and you, the Owner of a site hosted on SitegenOS (the controller), whenever your site collects personal data from its visitors. You accept it once, in your Owner dashboard, when you first sign in.

1. Roles and scope

• You are the controller of personal data your site's visitors submit — contact and quote form entries (name, email, phone, message) and any other details they send you.
• We are your processor: we store those submissions, forward them to your email when that is enabled, and display them in your dashboard. We process visitor data only for these purposes.
• For your own account data (your email, billing records), we remain the controller — see the Privacy Policy.
• Before you have an account. Your site goes live the moment your Builder publishes it, which starts a free 7-day window and happens before you have an account here and before you accept this DPA. It can receive enquiries from that first moment. Throughout that window the controller is the business the site was built for — you — exactly as the site's own privacy page states, and your Builder acts on your behalf in publishing the site and in telling us where its enquiries should go. SitegenOS is the processor for that period on the same terms set out in the rest of this agreement, and accepting it at your first sign-in confirms those terms for that period as well as for everything after it.
• Enquiries during that window are stored, and emailed to the address your Builder gave us for you. Their contents are not readable by your Builder — the database grants that access only to an Owner who is paying for hosting. If hosting is never activated the site goes offline, and anything already submitted stays subject to section 7.

2. Your instructions

We process visitor data only on your documented instructions, which are: collect form submissions on your site, store them, show them to you, and forward them to you by email when enabled. A submission is recorded before any forwarding is attempted, so a failed email delivery does not lose the lead. Forwarding is a separate step you can turn off in your settings. We never use your visitors' data for advertising, profiling, or training, and we never sell it.

3. Confidentiality and security

Everyone we authorise to process visitor data is bound by confidentiality. We apply the technical and organisational measures described in the Privacy Policy: encryption in transit, access controls, and row-level security on stored data. Privileged database access runs server-side only and is never exposed to browsers.

4. Sub-processors

You authorise the sub-processors listed in the Privacy Policy. If we add or replace one, we update that list. Continuing to use SitegenOS after an update constitutes acceptance. Sub-processors are bound by terms no less protective than this DPA.

5. Assistance

Taking into account the nature of the processing, we assist you with your controller obligations through your dashboard's lead views and by helping you respond to your visitors' access or deletion requests — email hello@sitegenos.com and we will locate, provide, or erase the relevant submissions as the law requires. If a visitor asks us directly, we redirect them to you.

6. Personal data breach

If we become aware of a personal data breach affecting your visitors' data, we will notify you without undue delay at your account email with the information reasonably available to us.

7. Retention and deletion

• Visitor form submissions are retained for 12 months from submission, then deleted automatically (the retention promise printed on your site's privacy page).
• If you need a copy of your visitors' submissions, email hello@sitegenos.com and we will provide one.
• If your site or account is deleted, its stored submissions are deleted with it, subject only to statutory retention of financial records.

8. Audit

On written request (no more than once per year), we will provide the information reasonably necessary to demonstrate compliance with this DPA.

9. Legal framework

This DPA is governed by the law of England and Wales and is intended to satisfy Article 28 UK GDPR. If any conflict arises between this DPA and the Terms of Service, this DPA prevails for visitor personal data.

Contact

Questions? Email hello@sitegenos.com.

SitegenOS is a product of ApeTec Ltd, registered in England and Wales, company number 17065917.