Data processing agreement
This data processing agreement is part of the Terms of service of Pagebase. It applies to every customer who uses Pagebase to process personal data of their own customers, visitors or contacts, for example with a webshop, customer accounts, a newsletter or forms.
Parties
The customer of Pagebase who processes personal data of their own customers, visitors or contacts with Pagebase ("the Controller"), and Damiën Sluijter, trading as Versa Web Solutions, Sint-Luciestraat 5, 3631 Uikhoven (Maasmechelen), Belgium, company and VAT number BE 1027.741.625, operator of Pagebase ("the Processor").
Article 1 · Subject and duration
The Processor processes personal data on behalf of the Controller to provide the services of Pagebase, as described in Annex 1. This agreement applies as long as the Controller uses Pagebase, and after that until all data has been deleted or returned.
Article 2 · Instructions
The Processor processes the personal data only on the documented instructions of the Controller. Using Pagebase as the Controller sets it up counts as an instruction. The Processor does not use the data for its own purposes. If the Processor believes an instruction breaches the GDPR, it says so straight away.
Article 3 · Confidentiality
Only those who need the data for the service (maintenance, support, security) get access, and they are bound to confidentiality. Viewing an account for support is logged.
Article 4 · Security
The Processor takes appropriate technical and organisational measures, described in Annex 2, and keeps them up to date with the state of the art.
Article 5 · Sub-processors
The Controller gives general authorisation to engage the sub-processors in Annex 3. The Processor announces a new or changed sub-processor at least 30 days in advance by email; within that period the Controller can object with reasons and, if no solution is found, end the service. The Processor imposes the same obligations as in this agreement on every sub-processor.
Article 6 · Transfers outside the EEA
Data is processed outside the European Economic Area only on a valid basis, such as the EU–US Data Privacy Framework or the standard contractual clauses of the European Commission (see Annex 3).
Article 7 · Rights of data subjects
The Processor helps the Controller answer requests from data subjects (access, rectification, erasure, portability, objection), among other things with the features in Pagebase to view, change, export and delete data. A request that reaches the Processor directly is passed on to the Controller.
Article 8 · Data breaches
The Processor reports a personal data breach without undue delay and at the latest within 48 hours of discovering it, with the information needed to assess it and, where necessary, report it to the supervisory authority and the data subjects. The Processor immediately takes measures to limit the consequences.
Article 9 · Assistance
The Processor helps the Controller, as far as reasonable, with a data protection impact assessment and a prior consultation of the supervisory authority.
Article 10 · End
At the end of the service the Controller can export their data. After that the Processor deletes it within 30 days, except what the law requires it to keep. Copies in backups disappear according to the periods in Annex 2.
Article 11 · Audit
On request, the Processor gives the Controller the information needed to show it complies with this agreement. An on-site audit is possible after reasonable notice, at most once a year, at the Controller's expense, unless a supervisory authority requires it.
Article 12 · Liability and law
Liability follows the section on liability in the Terms of service of Pagebase, except where the GDPR does not allow that. This agreement is governed by Belgian law.
Annex 1 · Processing
| Whose data | Which data | What for |
|---|---|---|
| Customers of the webshop and the point of sale | name, email, phone, address, orders, payment status (no card details), returns | processing orders, sending receipts and confirmations, shipping, refunds |
| Customers with a customer account | email, hashed password, addresses, order history | logging in to the webshop, following orders |
| Newsletter subscribers | email, name, confirmation of subscription, unsubscription | sending newsletters |
| People who fill in a form | what the form asks, possibly photos | delivering the message to the Controller |
| Website visitors | shortened IP address, pages visited, cookie consent | statistics, security |
| Staff at the point of sale | name, PIN | who made a sale |
Annex 2 · Security measures
- Encrypted connections (TLS) for all traffic.
- Servers in the EU (Hetzner, Germany), with security updates.
- Hashed passwords; two-step login available; limits on login attempts.
- Keys of connected services (SumUp, Sendcloud) stored encrypted.
- Access to customer accounts for support only for administrators, and logged.
- Daily backups to separate storage in another data centre in the EU, with snapshots that cannot be deleted from the server. Kept: daily for 7 days, snapshots for 14 days, monthly copies for 12 months.
- Errors and outages are monitored.
Annex 3 · Sub-processors
| Sub-processor | What for | Where |
|---|---|---|
| Hetzner Online GmbH | servers, storage and backups | Germany (EU) |
| Hostinger International Ltd | the mailbox info@pagebase.be, DNS | Cyprus (EU) |
| Resend (Plus Five Five, Inc.) | sending emails (confirmations, newsletters) | United States: EU–US Data Privacy Framework, and the standard contractual clauses in Resend's data processing agreement |
| Stripe Payments Europe Ltd | webshop payments, through the shop's own Stripe account | Ireland (EU) |
| SumUp Limited | card payments in a shop, through the shop's own SumUp account | Ireland (EU) |
| Sendcloud B.V. | shipping labels, if the shop connects it | Netherlands (EU) |
| OpenAI | AI features, only when the user uses them | United States |
Stripe, SumUp and Sendcloud work with the shop's own account: the shop makes its own agreement with them.