This English version is a translation provided for convenience only. The Spanish version is the only legally binding version and prevails in the event of any discrepancy. Read the Spanish version.

This Agreement governs, in accordance with Article 28 of Regulation (EU) 2016/679 (the General Data Protection Regulation, “GDPR”), the processing of personal data carried out by Stackslides S.L. (“wiweb”, the “Processor”) on behalf of the Customer (the “Controller”) when providing the service of creating, hosting and maintaining the Controller’s website. It forms an integral part of the Terms and Conditions, applies to all plans, including Free, and is accepted together with them.

1. Subject matter and duration

The Processor will process the personal data of visitors to the Controller’s page only to the extent necessary to provide the Service: hosting and serving the page; receiving the messages sent through its contact form, storing them in the “Messages” inbox of the dashboard and forwarding them by email to the address indicated by the Controller; and producing aggregated visit statistics. The duration of the processing is the same as the life of the Controller’s account.

2. Nature of the processing and types of data

• Data subjects: visitors to the Controller’s page and its customers or prospective customers.
• Form data: whatever the visitor enters—by default name, phone number and message, plus any additional field the Controller has added to its form—together with the page from which it was sent and the visitor’s acceptance of the privacy policy, which the form requires. The visitor’s IP address and browser are not stored.
• Browsing data: the IP address and user agent are processed ephemerally to serve the page and protect it against abuse. To count unique visitors, a cryptographic summary (hash) of the IP address, browser, page and day is calculated; it changes every day and does not allow anyone to be re-identified or tracked across days or across pages. Totals by day, path, source, country and device type are also kept. No cookie or identifier is placed on the visitor’s device.
• Special categories: the Service is not designed to process special categories of data (Art. 9 GDPR). The Controller undertakes not to request or encourage their submission through its page.

3. Obligations of the Processor

wiweb, as Processor:

• will process the data only on the documented instructions of the Controller, which take the form of the page’s configuration (which fields the form has, to which email address messages are forwarded) and of the contract itself, and will inform the Controller if it considers that any instruction infringes the GDPR;
• will not use visitors’ data for any purpose of its own: the data are not sent to artificial intelligence providers, nor used for advertising or to improve the Service;
• ensures that the persons authorised to process the data are subject to a duty of confidentiality;
• applies appropriate technical and organisational measures (Art. 32 GDPR), including: encryption of traffic (TLS) with a dedicated certificate for each page; isolation of each customer’s data through row-level access controls in the database; least-privilege access control; a change history and copies of each page that allow versions to be restored; rate limiting and filtering of requests and of the form to prevent abuse; and immediate suspension of compromised pages;
• will assist the Controller, taking into account the nature of the processing, in responding to the exercise of data subjects’ rights (access, rectification, erasure, objection, restriction and portability)—for example, by deleting a specific message at the Controller’s request—and in complying with its obligations regarding security, notification of breaches and impact assessments;
• will notify the Controller without undue delay of any personal data breaches of which it becomes aware, providing the available information on their nature, scope and the measures taken;
• will make available to the Controller the information necessary to demonstrate compliance with this Agreement and will allow reasonable audits, with at least 15 days’ prior notice, no more than once a year and at the Controller’s expense, provided that they do not compromise the security or confidentiality of other customers’ data.

4. Sub-processors

The Controller gives general authorisation for the engagement of the sub-processors needed to provide the Service. The current list is set out below; we will inform the Controller by email of any addition or replacement at least 15 days in advance, during which period the Controller may object on reasonable grounds (an objection may make it impossible to continue providing the Service):

• Vercel Inc. (USA) — hosting and delivery infrastructure for the page. Certified under the EU-US Data Privacy Framework (DPF).
• Supabase, Inc. (USA) — database in which the page’s content, the messages received and the visit statistics are stored, and storage for photos. The data reside in the European Union (Ireland, eu-west-1 region); the provider’s remote access from the USA is covered by the European Commission’s Standard Contractual Clauses.
• Resend, Inc. (USA) — delivery by email to the Controller of the messages received through its form. DPF.
• Functional Software, Inc. (Sentry) (USA) — technical error monitoring for the platform. DPF.

All sub-processors are subject to obligations equivalent to those in this Agreement. Where the processing involves transfers outside the European Economic Area, these are covered by the adequacy decision for the EU-US Data Privacy Framework in the case of certified providers and, for Supabase—whose servers are in the European Union—by the European Commission’s Standard Contractual Clauses together with the corresponding transfer impact assessment, which cover remote access from the USA.

Third parties that receive data as a result of a decision by the visitor or the Controller, and which are not wiweb sub-processors: Google (fonts, only if the visitor accepts them in the cookie notice; YouTube thumbnails and player, if the page includes a video widget) and, if the Controller connects its own Google Analytics or Tag Manager, Google as the Controller’s own processor under the terms the Controller has agreed with Google.

5. Obligations of the Controller

The Controller, as owner of its page and of the relationship with its visitors:

• warrants that it has a legal basis for the processing it carries out through its page and that it provides data subjects with the information required by Arts. 13 and 14 GDPR. The Service generates the page’s privacy policy and cookie policy based on what the page actually does, and publishes in its footer the identification details entered by the Controller; reviewing those texts and ensuring they are adequate, and the accuracy of those details, are the Controller’s responsibility;
• will maintain a valid email address for its page’s privacy notice and for receiving the messages from its form;
• will handle the rights requests it receives from its visitors;
• will not use the Service to process data beyond what is described in this Agreement, and will not add to its form any fields requesting special categories of data, bank details or identity documents.

6. End of the processing

Moving to a lower plan, including Free, does not end the processing: the page, its messages and its visits are kept. The processing ends when the Controller deletes its page or its account, or when wiweb terminates the contract. From that moment the page is no longer served and the data remain blocked for 90 days, during which the Controller may request their recovery or an export of the messages received in a structured, commonly used format. Once the 90 days have elapsed, the Processor will erase the personal data processed on behalf of the Controller, unless a legal provision requires their retention, in which case they will remain blocked for the period required by law. Daily visitor identifiers are in any event deleted after 400 days.

7. Contact

For any question about this Agreement: privacidad@wiweb.io.