Data processing agreement.

01Parties and roles

The client is the controller. The business Syntilas Th. Konstantinos (web.lab), Tax ID 135992720, is the processor and acts only on the client's behalf.

02Subject matter and duration

The processing concerns hosting, maintaining, updating and supporting the client's site, and lasts for as long as the partnership is in place.

03Types of data and data subjects

Depending on the site: contact, account, order and message details of the client's visitors, customers or members. We do not process special categories of data unless agreed in writing.

04web.lab's obligations

• We process the data only on the client's documented instructions.
• Everyone with access is bound by an obligation of confidentiality.
• We apply appropriate technical and organizational security measures (Article 32 GDPR).
• We help the client respond to data subject requests and meet its obligations.
• We notify the client without undue delay, and at the latest within 48 hours, of any data breach we become aware of.
• We provide the information needed to demonstrate compliance and allow audits with reasonable notice.

05Sub-processors

The client authorizes the use of the sub-processors below. The client will be told about any change in advance and may object to it.

• Cloudways, hosting, Frankfurt, Germany.
• Cloudflare, DNS, CDN and bot protection, United States.
• Wordfence (Defiant), firewall and protection against malicious activity, United States.
• Google Workspace, sending email from the sites, United States.
• Elastic Email, backup email sending via Cloudways, Canada.

Where any of them process data outside the EEA, transfers take place under the EU-U.S. Data Privacy Framework, a European Commission adequacy decision or standard contractual clauses.

06Security measures

• Encrypted connections (HTTPS/TLS).
• Daily backups with a limited retention period.
• Regular software and plugin updates.
• Access through individual accounts with two-factor authentication, where supported.
• Firewall and monitoring for malicious activity.

07Termination

When the partnership ends, we return the data to the client and delete it from our systems within 30 days, unless the law requires us to keep it.

08Acceptance

This agreement forms part of our Terms of service and applies once you accept them. If you need a signed copy, ask for it at [email protected].

Questions? Write to us at [email protected].