When you use the service to handle personal data of your customers, you decide how that data is used and ControlCMS processes it only on your behalf. This agreement sets out those roles and the safeguards required by the GDPR (Article 28).
Read the full agreement
1. Scope and roles
This Data Processing Agreement forms part of the Terms of Service between you and ControlCMS and applies whenever personal data is processed on your behalf through the service. For the personal data of your customers, staff and other people whose data you place in the service, you are the controller and ControlCMS is the processor, within the meaning of the EU General Data Protection Regulation (GDPR), in particular Article 28.
2. Subject matter, duration and purpose
The subject matter is the hosting and processing of personal data needed to provide the service to you, such as storing records, displaying them in your panel and on your storefront, sending the messages you trigger, and handling orders, bookings and payments. Processing lasts for as long as you use the service and until the data is deleted as described below.
3. Data subjects and categories of personal data
Data subjects may include your customers and prospective customers, visitors to your website or storefront, your staff members and your suppliers. Personal data may include names, contact details (such as email address, phone number and postal address), account and sign-in data, order, booking and payment records (full card numbers are handled by the payment providers, not stored in the service), messages, notes you record, identity or licence documents where your type of business requires them, and technical data such as IP addresses. You should only place special categories of personal data in the service where this is necessary and lawful for your business.
4. Processing on documented instructions
Personal data is processed only on your documented instructions. Your instructions are given by these agreements and by the way you configure and use the service. Processing for other purposes takes place only where required by EU or Member State law, in which case you will be informed beforehand unless that law prohibits it. If an instruction appears to infringe data protection law, you will be informed.
5. Confidentiality
Access to your personal data is limited to the personnel of ControlCMS who need it to provide, maintain and support the service. All such persons are bound by an obligation of confidentiality.
6. Security measures
Appropriate technical and organisational measures are applied to protect personal data, taking into account the state of the art and the risks involved. These include encryption in transit, separation of each customer's data, role-based access controls, protection of stored secrets, masking of sensitive values in logs, audit trails for sensitive actions, regular backups, and monitoring of the service. The measures are reviewed and improved over time.
7. Sub-processors
You give a general authorisation for the use of sub-processors in the following categories: hosting and infrastructure providers (servers, storage, networking and security), email and message delivery services, and, when you use AI-assisted features, providers of the AI models that process the content you submit to those features. Payment, delivery and other third-party services that you choose to connect act under your own agreement with them. Each sub-processor is bound by data protection obligations equivalent to those in this agreement. You will be informed of any intended addition or replacement of a sub-processor and may object on reasonable data protection grounds; if no solution can be found, you may terminate the affected service.
8. Assistance with data subject requests
Taking into account the nature of the processing, ControlCMS assists you in responding to requests from individuals exercising their rights, such as access, correction, deletion, restriction, portability and objection. The service lets you view, edit, export and delete the records you hold. If a request is received directly, it will be forwarded to you without responding to it on your behalf, unless you instruct otherwise.
9. Personal data breaches
If a personal data breach affecting your data is discovered, you will be notified without undue delay, with the information available at the time about its nature, likely consequences and the measures taken or proposed. You will also receive reasonable assistance with your own notifications to supervisory authorities and affected individuals, and with any data protection impact assessments relating to the service.
10. Deletion and return of data
When the service ends, you can export your data for a reasonable period. After that period, the personal data is deleted, unless EU or Member State law requires it to be kept. Copies in backups are removed as the backups expire in their normal rotation and remain protected until then.
11. Audits and information
On request, you will be provided with the information reasonably necessary to demonstrate compliance with this agreement. Audits, including inspections by you or an independent auditor appointed by you, are allowed with reasonable prior notice, during normal business hours, subject to confidentiality and in a way that does not compromise the security of other customers. Unless required by a supervisory authority or following a personal data breach, audits are limited to once a year and carried out at your expense.
12. International transfers
Where personal data is transferred to a country outside the European Economic Area that does not benefit from an adequacy decision, the transfer is protected by the Standard Contractual Clauses adopted by the European Commission, together with any supplementary measures that are required.
13. Liability, precedence and governing law
The limitations of liability in the Terms of Service apply to this agreement, as far as permitted by law. In case of conflict between this agreement and the Terms of Service regarding personal data, this agreement prevails. This agreement is governed by Belgian law.