Data processing agreement

1. Parties

This data processing agreement (the Agreement) is made between the organization that accepted it when signing up for PageForge, as recorded with the acceptance (the Controller), and the operator of PageForge, referred to as the PageForge operator (the Processor).

The Processor can be reached at [email protected].

The Controller is the data controller for the personal data in the sites it builds and publishes with PageForge. The Processor processes that data on the Controller's behalf and is the data processor.

2. Preamble

This Agreement sets out the rights and obligations of the Controller and the Processor when the Processor processes personal data on behalf of the Controller. It is meant to ensure that the Parties comply with Article 28(3) of the General Data Protection Regulation (GDPR). It follows the structure of the standard contractual clauses published by the Danish Data Protection Agency (Datatilsynet) for that Article, adapted to PageForge.

The Processor provides PageForge, a hosted service for building and publishing websites (the Service), to the Controller. The arrangement under which it does so, including the subscription recorded in PageForge, is the Service arrangement. The Service arrangement ends when either Party gives written notice to the other Party's contact address (section 15), or when the Controller's organization is deleted. In providing the Service, the Processor processes personal data on behalf of the Controller as described in Annex A.

This Agreement does not cover personal data for which the Processor is itself the controller, for example the login accounts of the Controller's staff. That processing is described in the privacy policy.

Annexes A to D are part of this Agreement. This Agreement does not release either Party from obligations that apply to it directly under the GDPR.

3. Rights and obligations of the Controller

The Controller is responsible for making sure that the processing of personal data takes place in compliance with the GDPR, other EU or member state data protection law and this Agreement.

The Controller has the right and the obligation to decide the purposes and means of the processing, and is responsible for having a lawful basis for it, for the content it publishes and for the questions its forms ask.

Content that the Controller links to or embeds from other websites is outside the Processor's control. The Controller is responsible for it.

The Service is not designed for special categories of personal data (Article 9 GDPR), data about criminal offences (Article 10) or Danish civil registration numbers (CPR numbers). The Controller must not collect such data through the Service unless the Parties have agreed otherwise in writing beforehand.

4. The Processor acts on instructions

The Processor processes personal data only on documented instructions from the Controller, unless EU or member state law requires otherwise. In that case the Processor informs the Controller of the legal requirement before processing, unless the law prohibits such information.

The Controller's instructions are given by using the Service in accordance with the Service arrangement, Annex A and Annex C: creating and publishing content, uploading media, and receiving, reading, exporting and deleting form messages in the admin. The Controller can give further instructions in writing to the Processor's contact address.

The Processor immediately informs the Controller if an instruction, in the Processor's opinion, infringes the GDPR or other data protection law.

5. Confidentiality

The Processor only gives access to the personal data to persons authorised by the Processor, who have committed themselves to confidentiality or are under a statutory duty of confidentiality, and who need the access to operate and support the Service.

At the Controller's request the Processor demonstrates that the persons concerned are subject to the confidentiality described above.

6. Security of processing

Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, and the risks to the rights and freedoms of natural persons, the Processor implements the measures described in Annex C, with the aim of ensuring a level of security appropriate to the risk in accordance with Article 32 GDPR.

The Controller is responsible for assessing whether the measures in Annex C are sufficient for the risk of the processing the Controller carries out through the Service. If the Controller requires further measures, the Parties agree on them in writing.

The Processor assists the Controller in complying with the Controller's own obligations under Article 32 by giving the Controller the information about the measures that the Controller needs.

7. Use of subprocessors

The Processor meets the conditions in Article 28(2) and (4) GDPR for engaging another processor (a subprocessor). The Controller gives the Processor general authorisation to use the subprocessors listed in Annex B.

The Processor notifies the Controller in writing at least 30 days before it adds or replaces a subprocessor, and updates Annex B on this published page. The Controller can object to the change on reasonable grounds relating to data protection within that period. Notice is sent to the Controller's contact persons (section 15).

If the Controller objects and the Parties cannot find another solution, the Controller can end the Service arrangement with effect from the date the change would take effect.

The Processor engages each subprocessor on terms that provide at least the same level of protection as Article 28(4) GDPR requires. The Processor remains fully responsible to the Controller for the subprocessor's compliance.

8. Transfer to third countries

The Processor transfers personal data to a third country or an international organization only on the Controller's documented instructions, and always in compliance with Chapter V of the GDPR.

The Controller instructs the Processor to use the subprocessors in Annex B, including the transfer of data to Cloudflare, Inc. in the United States on the basis of the EU-US Data Privacy Framework.

The Processor makes no other transfer to a third country unless EU or member state law requires it. In that case the first paragraph of section 4 applies.

9. Assistance to the Controller

Taking into account the nature of the processing, the Processor assists the Controller, insofar as possible, by appropriate technical and organisational measures, in meeting the Controller's obligation to respond to requests from data subjects under Chapter III GDPR. The Controller can itself read, export (as CSV, up to 10,000 rows per export) and delete form messages in the admin. Where a request cannot be handled there, the Processor helps on request.

The Processor also assists the Controller, taking into account the nature of the processing and the information available to the Processor, with the Controller's obligations under Articles 32 to 36 GDPR: security of processing, notification of personal data breaches, data protection impact assessments and prior consultation with the supervisory authority.

10. Notification of personal data breach

The Processor notifies the Controller of a personal data breach at the Processor or at a subprocessor without undue delay and at the latest 48 hours after becoming aware of it, so that the Controller can meet its own deadline of 72 hours for notifying Datatilsynet under Article 33 GDPR.

As far as possible the notification states the nature of the breach, including the categories and approximate number of data subjects and records concerned, the likely consequences of the breach, and the measures the Processor has taken or proposes to take to address it. The Processor provides further information as it becomes available.

The Controller decides whether to notify Datatilsynet and the data subjects. The Processor keeps a record of every personal data breach, as Article 33(5) GDPR requires.

11. Erasure and return of data

During the Service arrangement the Controller can delete form messages and site content itself. In addition, form messages are deleted automatically 180 days after they were submitted. The Controller can export form messages as CSV in the admin at any time (up to 10,000 rows per export).

The Processor deletes the Controller's personal data within 30 days of the end of the Service arrangement. A platform administrator does this by deleting the Controller's organization in the PageForge admin, which deletes the organization with all its sites and their content, media and form messages.

During those 30 days the Controller can ask the Processor in writing to return its data. The Processor then returns the data before deleting it.

Copies in the Processor's backups are overwritten on the regular schedule and can remain for up to 30 days after the deletion. The Processor does not use them for any other purpose.

The Processor does not delete data that EU or member state law requires it to keep. At the Controller's request the Processor confirms in writing that the deletion has taken place.

12. Audit and inspection

The Processor makes available to the Controller all information necessary to demonstrate compliance with Article 28 GDPR and this Agreement, and allows for and contributes to audits, including inspections, carried out by the Controller or another auditor mandated by the Controller.

The Controller first asks for written information, such as documentation of the measures in Annex C, the Processor's records of processing and the subprocessor register. If that is not enough, the Controller can request an inspection. The Processor agrees a date on reasonable notice. The inspection takes place during normal business hours, must not disrupt the operation of the Service, gives no access to other customers' data, and is carried out at the Controller's own cost by persons bound by confidentiality.

The rights of supervisory authorities to access the Processor's premises and systems under the law are not affected by this section.

13. The Parties' agreement on other terms

This Agreement is governed by Danish law.

This Agreement is published in English and Danish. If the two versions differ, the Danish version prevails.

If the Service arrangement and this Agreement conflict on a data protection matter, this Agreement prevails. Annex D contains the remaining terms.

14. Commencement and termination

This Agreement takes effect when the Controller accepts it when signing up for PageForge. The acceptance is recorded together with the version of the Agreement that was accepted.

The Agreement applies for as long as the Processor processes personal data on behalf of the Controller, and ends when the Service arrangement ends. Section 11 continues to apply until all personal data has been deleted.

A change in substance to the clauses of this Agreement is published as a new version. It takes effect for the Controller only when the Controller has accepted the new version, and the version it accepted before keeps applying until then. Updates to Annex B follow section 7 and are not a change to the clauses.

15. Contact persons and notices

The Controller's contact persons are the Owners of its organization in PageForge (the owners of all its sites). Notices to the Controller are sent to the email address that each of them registered when signing up.

The Processor's contact address is [email protected].

Each Party notifies the other without undue delay of a change of contact person or address.

Annex A. Information about the processing

Purpose: to host, render and publish the Controller's websites, to store and make available the messages visitors send through the Controller's forms, and to store the media the Controller uploads, so that the Controller can use PageForge as agreed in the Service arrangement.

Nature of the processing: storage, retrieval, display, transmission over the network, export and deletion. The Processor does not otherwise use the data.

Categories of data subjects:

• All visitors to the Controller's sites, including those who submit a form.
• Persons named or pictured in the content and media the Controller publishes.
• The Controller's staff, as authors of content and uploaders of media.

Annex A (continued). Types of personal data

Types of personal data:

• Form messages: the field values the visitor enters, as the Controller has defined the form fields, together with the form name, the page, the source path and the time of submission. The Processor does not store the visitor's IP address or browser identification with a form message.
• Site content: pages, revisions with the id of the author, menus, translations and themes, with whatever personal data the Controller publishes in them.
• Media: uploaded files and their variants, file name, description text and the id of the uploader. Media files are served publicly, so anyone with the address of a file can fetch it.
• Visitors' IP addresses and request details pass through the network of Cloudflare while a page is requested (see Annex B).

Annex A (continued). Duration

The processing lasts for as long as the Service arrangement lasts, and ends with deletion as set out in section 11.

Annex B. Approved subprocessors

On the date of this version the Controller authorises these subprocessors. Changes follow the 30-day notice in section 7.

• Cloudflare, Inc. (USA): network edge and tunnel in front of the Service. Cloudflare sees visitors' IP addresses, the address and headers of each request and the content of traffic in transit (TLS ends at Cloudflare). Cloudflare also receives the network error reports that visitors' browsers send to it. Transfer to the USA relies on the EU-US Data Privacy Framework.
• Brevo (Sendinblue SAS): sends the Service's invitation and password reset emails to the Controller's staff, on the Controller's behalf, so it receives the recipient's email address, the subject and the link in the message. According to its public information it operates in the EU (France).

Annex C. Instructions and security measures

Subject of the processing: the Processor's provision of the Service to the Controller, as set out in Annex A.

Technical and organisational measures in place on the date of this version:

• Separation of customers: data is filtered by site by default in every database query, and saving site data is refused when no site has been resolved. Background and cross-site jobs switch site explicitly.
• Access control: passwords are stored only as a BCrypt hash, with a minimum length of 8 characters. The access token is signed and valid for 8 hours. Access follows roles per site, and platform administration is restricted to platform administrators.
• Protection against abuse: rate limits apply to login, password reset, invitations, writes in the admin and public forms. The IP addresses used for the limits are kept only in memory, for at most 15 minutes.
• Transport: traffic from visitors and users is encrypted with TLS up to Cloudflare, which ends the connection and forwards it through a tunnel to the Service. Email is sent to Brevo with STARTTLS. API responses carry security headers, and public sites are served with a content security policy.
• Input handling: form input is validated against the form's declared fields before it is stored, links with unsafe schemes are blocked, and uploads are limited to 10 MB.
• Logging: logs contain no IP addresses or browser identification, invitation tokens are removed, and email addresses are masked in application log lines. A log size cap is configured (3 files of 10 MB per service), and logs are discarded on redeploy.
• Secrets: the signing key, database connection string and email password are supplied through environment variables and are not stored in the source code.
• Availability: the database and uploaded files are backed up every night. One copy is kept for 7 days on the server, and a second copy on a separate computer controlled by the Processor is kept for 30 days. The Service has health checks and restarts automatically.
• Data minimisation: form messages carry no IP address or browser identification and are deleted automatically after 180 days.
• Limits: the Processor does not currently apply encryption at rest to the backup copies. Encrypting them is a planned improvement.

Annex C (continued). Storage period, location and audit

Storage period: form messages are deleted 180 days after submission. Site content and media are kept until the Controller deletes them or the Service arrangement ends. After the Service arrangement ends, data is deleted as set out in section 11.

Location of the processing: the Service runs on servers in Denmark. Traffic passes through Cloudflare's global edge network (Annex B).

Transfers: only the transfers described in Annex B and section 8 are instructed.

Procedure for audit and inspection: as set out in section 12.

Annex D. Other terms

Governing law: Danish law applies to this Agreement.

Language: the Danish version of this Agreement prevails over the English version.

Acceptance: the Controller accepts this Agreement when signing up for PageForge. The acceptance is recorded with the version of the Agreement, shown at the top of this page.