Defines how Siteligent processes personal data on behalf of Customers and outlines our obligations under applicable data protection laws.
Data Processing Agreement (DPA)
This Data Processing Agreement (“DPA”) forms part of and is incorporated into the Terms and Conditions or any other written agreement (the “Agreement”) between Siteligent (“Siteligent”, “Processor”, “we”, “our”, or “us”) and the Customer (“Controller”, “you”, or “your”).
This DPA governs the processing of Personal Data by Siteligent on behalf of the Customer in connection with the Services and sets out the parties’ respective rights and obligations regarding such processing.
1. Introduction
Siteligent provides a cloud-based platform that enables Customers to monitor, manage, maintain, secure, and optimize WordPress websites.
In providing the Services, Siteligent may process Personal Data on behalf of the Customer. This DPA explains how Siteligent processes such Personal Data and establishes the safeguards implemented to protect it.
This DPA is intended to satisfy the requirements of applicable data protection laws, including, where applicable:
- General Data Protection Regulation (EU) 2016/679 (“GDPR”)
- UK General Data Protection Regulation (“UK GDPR”)
- UK’s Data Protection Act 2018
- India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”)
- Other applicable privacy and data protection laws
Where there is any conflict between this DPA and the Agreement regarding the processing of Personal Data, this DPA shall prevail to the extent of that conflict.
1.1 Order of Precedence
In the event of any conflict between this DPA, the Terms and Conditions, or any other written agreement between the parties regarding the processing of Personal Data, this DPA shall prevail solely with respect to the processing of Personal Data. All other matters shall continue to be governed by the applicable Terms and Conditions or other agreement.
2. Definitions
For purposes of this DPA:
Applicable Data Protection Law means all applicable privacy and data protection laws governing the processing of Personal Data under this DPA.
Controller means the person or entity that determines the purposes and means of processing Personal Data. For the purposes of this DPA, the Customer is the Controller unless otherwise agreed in writing.
Data Subject means an identified or identifiable natural person whose Personal Data is processed.
Personal Data means any information relating to an identified or identifiable natural person processed by Siteligent on behalf of the Customer in connection with the Services.
Processor means a person or entity that processes Personal Data on behalf of the Controller. For purposes of this DPA, Siteligent acts as the Processor.
Services means the Siteligent platform and related services provided under the Agreement.
Subprocessor means any third-party service provider engaged by Siteligent to process Personal Data on behalf of the Customer while providing the Services.
Terms not defined in this DPA have the meanings assigned to them in the Agreement or under applicable data protection law.
3. Roles and Responsibilities
3.1 Customer as Controller
The Customer acts as the Controller for Personal Data processed through the Services and is responsible for:
- Determining the purposes and means of processing.
- Ensuring a lawful basis for processing Personal Data.
- Providing lawful instructions to Siteligent.
- Complying with applicable data protection laws.
- Obtaining any necessary notices, consents, or permissions from Data Subjects where required.
3.2 Siteligent as Processor
Siteligent acts as the Processor for Personal Data processed on behalf of the Customer.
Siteligent will process Personal Data only:
- On the Customer’s documented instructions.
- As necessary to provide the Services.
- As required to comply with applicable law.
If Siteligent believes that a Customer instruction violates applicable data protection law, Siteligent may notify the Customer and suspend the relevant processing until appropriate clarification is received.
3.3 Processing Instructions
Siteligent will process Personal Data only on the Customer’s documented instructions, as described in the Agreement, this DPA, or as otherwise communicated by the Customer through the Services.
Siteligent may process Personal Data without additional instructions where necessary to:
- Comply with applicable law.
- Protect the security or integrity of the Services.
- Prevent fraud, abuse, or unlawful activity.
- Perform routine operational activities necessary to provide the Services.
Where legally permitted, Siteligent will inform the Customer before processing Personal Data pursuant to a legal obligation.
4. Subject Matter and Duration
4.1 Subject Matter:
This DPA applies to the processing of Personal Data by Siteligent in connection with providing the Services under the Agreement.
Processing activities may include the collection, storage, organization, retrieval, use, transmission, analysis, backup, restoration, deletion, and other processing operations necessary to provide the Services.
4.2 Duration:
This DPA remains in effect for as long as Siteligent processes Personal Data on behalf of the Customer under the Agreement.
Upon termination or expiration of the Agreement, Siteligent will, at the Customer’s request and subject to applicable law:
- Return Personal Data to the Customer; or
- Delete Personal Data from Siteligent’s active systems,
unless retention is required by applicable law or reasonably necessary to comply with legal obligations, resolve disputes, enforce agreements, or protect the security and integrity of the Services.
5. Nature and Purpose of Processing
5.1 Nature of Processing
In providing the Services, Siteligent may process Personal Data on behalf of the Customer as necessary to perform the Services under the Agreement.
Processing activities may include:
- Collection.
- Recording.
- Organization.
- Storage.
- Retrieval.
- Consultation.
- Use.
- Analysis.
- Transmission.
- Backup.
- Restoration.
- Security monitoring.
- Deletion or destruction.
The specific processing activities performed depend on the Services used by the Customer and the Customer’s documented instructions.
5.2 Purpose of Processing
Siteligent processes Personal Data solely for the purpose of providing and supporting the Services requested by the Customer.
Depending on the Services used, processing may include:
- Providing access to the Siteligent platform.
- Managing Customer accounts and workspaces.
- Monitoring and managing WordPress websites.
- Performing backups and restorations.
- Delivering maintenance, reporting, and security-related features.
- Providing AI-powered analysis and operational insights where enabled by the Customer.
- Delivering customer support.
- Sending operational notifications and service communications.
- Protecting the security, integrity, and reliability of the Services.
- Complying with applicable legal obligations.
Siteligent will not process Personal Data for purposes incompatible with this DPA except where required by applicable law or expressly authorized by the Customer.
6. Categories of Data Subjects
Depending on how the Customer uses the Services, Personal Data processed by Siteligent may relate to the following categories of Data Subjects:
- Customer account owners.
- Customer employees, contractors, and authorized users.
- Customer team members.
- Client Portal users.
- Website administrators.
- Support contacts.
- End users of Customer-managed websites, where the Customer chooses to process such information through the Services.
- Other individuals whose Personal Data is submitted to the Services by or on behalf of the Customer.
The Customer is responsible for ensuring that it has an appropriate legal basis for processing Personal Data relating to these Data Subjects.
7. Categories of Personal Data
Depending on the Services used and the information provided by the Customer, Siteligent may process the following categories of Personal Data:
Identity Information
- Names.
- Usernames.
- Profile photographs.
- Job titles.
- Organization names.
Contact Information
- Email addresses.
- Telephone numbers.
- Billing addresses.
- Country or region.
- Time zone.
- Language preferences.
Account Information
- Account identifiers.
- Subscription information.
- Authentication information.
- Login history.
- Session information.
Technical Information
- IP addresses.
- Browser information.
- Device information.
- Operating system.
- Diagnostic information.
- Security logs.
- Error logs.
Website Information
- Website URLs.
- Domain names.
- WordPress configuration information.
- Plugin and theme information.
- Website performance metrics.
- Backup metadata.
- Monitoring information.
Communication Information
- Support requests.
- Customer communications.
- Chat history.
- Attachments voluntarily provided by the Customer.
Billing Information
- Subscription information.
- Transaction records.
- Invoice details.
- Tax identification information, where applicable.
Payment card information is processed directly by authorized payment providers and is not stored by Siteligent.
AI Processing Information
Where AI-powered features are enabled by the Customer, Siteligent may process limited technical metadata necessary to provide AI functionality, including website metadata, performance information, plugin and theme information, and technical reports.
Siteligent is designed to minimize the information shared with AI providers and does not intentionally submit sensitive personal information for AI processing.
8. Customer Responsibilities
The Customer is responsible for:
- Ensuring that it has a lawful basis for processing Personal Data through the Services.
- Providing lawful instructions to Siteligent.
- Ensuring the accuracy and lawfulness of Personal Data submitted to the Services.
- Providing required privacy notices and obtaining any necessary consents from Data Subjects.
- Responding to Data Subject requests where the Customer acts as the Controller.
- Configuring and using the Services in compliance with applicable laws.
- Maintaining the security of Customer accounts, credentials, and connected systems.
The Customer shall not instruct Siteligent to process Personal Data in a manner that would violate applicable data protection laws.
9. Siteligent Responsibilities
Siteligent will:
- Process Personal Data only on documented instructions from the Customer or as otherwise permitted by applicable law.
- Ensure that personnel authorized to process Personal Data are subject to appropriate confidentiality obligations.
- Implement appropriate technical and organizational measures to protect Personal Data.
- Assist the Customer in meeting its obligations under applicable data protection laws where reasonably required.
- Notify the Customer of Personal Data breaches as required under this DPA.
- Engage Subprocessors only in accordance with this DPA.
- Delete or return Personal Data upon termination of the Services in accordance with this DPA and applicable law.
- Notify the Customer if, in Siteligent’s opinion, an instruction infringes applicable data protection laws.
10. Security Measures
Siteligent implements and maintains appropriate technical and organizational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, unauthorized access, or other forms of unlawful processing.
These measures are designed having regard to the nature of the Personal Data processed, the risks associated with processing, and the current state of technology.
Such measures may include:
- Encryption of Personal Data in transit and, where appropriate, at rest.
- Access controls based on the principle of least privilege.
- Authentication and authorization controls.
- Security monitoring and logging.
- Vulnerability management and security patching.
- Backup and disaster recovery procedures.
- Employee confidentiality obligations and access controls.
- Security incident response procedures.
- Physical and environmental safeguards provided by our infrastructure providers.
- Other reasonable technical and organizational safeguards appropriate to the Services.
Siteligent regularly reviews and updates its security measures to reflect changes in technology, security risks, industry practices, and applicable legal requirements.
Additional information regarding Siteligent’s security practices is available in our Security Policy.
11. Subprocessors
Siteligent may engage trusted third-party Subprocessors to assist in providing the Services.
The Customer authorizes Siteligent to engage Subprocessors for purposes including:
- Cloud infrastructure and hosting.
- Data storage and backups.
- Payment processing.
- Customer support.
- Email delivery.
- Analytics.
- Artificial intelligence.
- Security.
- Monitoring.
- Other services reasonably necessary to provide the Services.
Siteligent will ensure that each Subprocessor is subject to appropriate contractual obligations designed to protect Personal Data in a manner consistent with this DPA and applicable data protection laws.
A current list of Siteligent’s authorized Subprocessors is available at:
Siteligent may update its list of Subprocessors from time to time. Where required by applicable law, Siteligent will provide appropriate notice before a new Subprocessor begins processing Personal Data on its behalf.
12. International Data Transfers
Siteligent may process or permit the processing of Personal Data in countries other than the country in which the Personal Data was originally collected.
Where Personal Data is transferred internationally, Siteligent will implement appropriate safeguards designed to protect Personal Data and comply with applicable data protection laws.
Depending on the circumstances, these safeguards may include:
- Standard Contractual Clauses (SCCs).
- Adequacy decisions recognized by applicable regulatory authorities.
- Data Processing Agreements with Subprocessors.
- Contractual confidentiality obligations.
- Other lawful transfer mechanisms recognized under applicable law.
Where required, Siteligent will provide additional information regarding international data transfers upon reasonable request.
13. Data Subject Requests
Because the Customer acts as the Controller, the Customer is primarily responsible for responding to requests from Data Subjects exercising their rights under applicable data protection laws.
Where reasonably requested by the Customer, Siteligent will provide appropriate assistance to enable the Customer to respond to such requests, including requests relating to:
- Access.
- Correction.
- Deletion.
- Restriction of processing.
- Data portability.
- Objection to processing.
- Withdrawal of consent, where applicable.
If Siteligent receives a request directly from a Data Subject relating to Personal Data processed on behalf of the Customer, Siteligent will, unless prohibited by applicable law, promptly forward the request to the Customer and will not respond directly except as instructed by the Customer or where legally required.
Siteligent’s assistance under this section is limited to the extent that such assistance is technically feasible, commercially reasonable, and required by applicable law.
14. Personal Data Breaches
In the event that Siteligent becomes aware of a Personal Data Breach affecting Personal Data processed on behalf of the Customer, Siteligent will notify the Customer without undue delay, unless otherwise prohibited by applicable law.
To the extent reasonably available, such notification may include:
- A description of the nature of the Personal Data Breach.
- The categories of Personal Data affected.
- The likely consequences of the breach.
- The measures taken or proposed to address the breach and mitigate its potential effects.
- Contact information for further assistance.
Siteligent will cooperate with the Customer, to the extent reasonably necessary, in investigating, mitigating, and responding to the Personal Data Breach.
The Customer remains responsible for determining whether notification to Data Subjects, supervisory authorities, or other regulators is required under applicable law.
15. Deletion or Return of Personal Data
Upon termination or expiration of the Agreement, or upon the Customer’s written request, Siteligent will, subject to applicable law and the terms of the Agreement:
- Return Personal Data to the Customer; or
- Securely delete Personal Data from Siteligent’s active systems.
Certain Personal Data may continue to be retained where required by applicable law or where reasonably necessary to:
- Comply with legal obligations.
- Resolve disputes.
- Enforce contractual rights.
- Maintain security records.
- Protect the integrity and security of the Services.
Personal Data contained within encrypted backup systems may remain until the applicable backup retention period expires, after which it will be securely overwritten or deleted in accordance with Siteligent’s data retention practices.
16. Audit Rights
Upon reasonable written request, Siteligent will make available information reasonably necessary to demonstrate compliance with this DPA.
Where required by applicable law, the Customer may conduct or request a reasonable audit of Siteligent’s compliance with this DPA, subject to:
- Reasonable advance notice.
- Normal business hours.
- Appropriate confidentiality obligations.
- Measures designed to avoid disruption to Siteligent’s operations.
Where appropriate, Siteligent may satisfy audit requests by providing available security documentation, independent audit reports, certifications, or written responses regarding its security and privacy practices.
Unless otherwise required by applicable law, each party will bear its own costs associated with any audit.
17. Liability
Each party remains responsible for its own compliance with applicable data protection laws.
The liability of each party under this DPA shall be subject to the limitation of liability provisions contained in the Agreement, except where such limitations are prohibited by applicable law.
Nothing in this DPA limits or excludes liability that cannot lawfully be limited or excluded under applicable law.
18. General Provisions
This DPA forms part of the Agreement between the parties.
Except as expressly modified by this DPA, all provisions of the Agreement remain in full force and effect.
If any provision of this DPA is determined to be invalid or unenforceable, the remaining provisions shall continue in full force and effect.
Siteligent may update this DPA from time to time to reflect changes in applicable laws, regulatory requirements, business practices, or the Services. Where required by applicable law, Siteligent will provide appropriate notice of material changes before they become effective.
If you have any questions regarding this DPA or the processing of Personal Data, please contact us at:
Email: support@siteligent.com