Appendix 1: Personal Data Processing Appendix (DPA)

1. Roles and instructions

The customer acts as controller and Webicularis as processor. Webicularis processes personal data only in accordance with the agreement, this appendix and the customer's documented lawful instructions, unless EU or Member State law requires otherwise. If, in Webicularis's opinion, an instruction is unlawful, Webicularis informs the customer and may suspend carrying out the instruction.

• Webicularis Terms of Service

2. Subject matter and duration of processing

The processing concerns website hosting, maintenance, backups, contact forms and other ordered functions. Data submitted through contact forms is stored in a Supabase database. Processing lasts for the term of the agreement and the agreed deletion period after it ends.

Data subjects may include website visitors, customers, prospective customers, job applicants and the customer's staff. Data categories may include contact, message, technical log and usage event data and other data the customer stores in the service. The customer may not store special categories of personal data without a separate written agreement.

3. Confidentiality and security

Webicularis ensures that persons processing personal data have committed to confidentiality. Webicularis implements technical and organisational measures appropriate to the risk, such as access management, encryption where applicable, backups, logging, vulnerability management and resilience.

4. Sub-processors

The customer gives a general prior written authorisation to use sub-processors to provide the service (Article 28(2) GDPR).

Current sub-processors (name – purpose – processing location): Cloudflare, Inc. – hosting, content delivery and security – global network; Lovable – application platform, runtime and database service (backed by Supabase) – location to be confirmed; Supabase, Inc. – database and file storage – EU region to be confirmed; email delivery service – relaying customer website form messages – location to be confirmed; Stripe Payments Europe Ltd – payments (online shop only) – EU/EEA and United States. This list is kept up to date on this page.

Webicularis notifies the customer by email of new and replaced sub-processors at least 30 days in advance. The customer may raise a reasoned data-protection objection within the notice period. The parties examine the objection and seek a reasonable solution, such as an alternative implementation. If no solution is found, the customer may terminate the service concerned before the change takes effect without penalty.

Webicularis concludes with each sub-processor an agreement imposing data protection obligations under Article 28 GDPR equivalent to this appendix and remains liable to the customer for the sub-processor's performance.

5. Transfers outside the EEA

Personal data may be transferred outside the EEA only on a basis under Chapter V GDPR, such as a European Commission adequacy decision (e.g. the EU–US Data Privacy Framework for a certified recipient) or the Commission's standard contractual clauses with supplementary measures. The transfer basis for each sub-processor is provided on request.

6. Duty to assist

Taking into account the information available and the nature of the processing, Webicularis reasonably assists the customer in handling data subject requests, impact assessments, prior consultations and security obligations. Work exceeding the customary service may be invoiced according to the agreed price list, unless the need arises from Webicularis's breach of contract.

7. Personal data breaches

Webicularis notifies the customer without undue delay after becoming aware of a personal data breach concerning the customer's personal data. The notification describes, to the extent available, the nature of the incident, its effects, the measures taken and a point of contact. Webicularis supplements the information as it becomes more precise.

8. Audits

Webicularis makes available to the customer all information necessary to demonstrate compliance with Article 28 GDPR and allows for and contributes to audits by the customer or an auditor mandated by the customer. Audits are agreed with reasonable advance notice and carried out without endangering other customers' data or the security of the service. These practical arrangements do not limit audit rights of the customer or a supervisory authority under mandatory law.

9. Return and deletion of data

When the paid service period ends, the website is taken out of public use and a 30-day transfer and deletion period begins. During the period the customer may request the data processed on its behalf in a commonly used, machine-readable format.

After the period Webicularis deletes the personal data processed on the customer's behalf from active systems in a controlled manner: a deletion case and due date are recorded, the data to be deleted is previewed and an authorised Webicularis administrator approves the deletion before any irreversible step. Deletion is carried out step by step, logged, and the customer can receive a receipt. If the due date is at risk, the matter is escalated and any delay and its reason are recorded.

Accounting and contract records required by law are retained separately for the statutory period. Data in backups is removed as backups rotate in their normal cycle and is not in active use before then; separate deletion from individual backups is not promised. Data held in external services (e.g. payment service, domain registry) is handled service by service; ownership of the domain name or the right to transfer it is not removed.