Legal
Data Processing Addendum
This Data Processing Addendum ("DPA") is part of the terms between Best Business Brands LLC ("we", the processor) and each client ("you", the controller) whose personal data we process to provide our services, including SiteJetty hosting, website builds and custom software. It meets the requirements of Article 28 of the EU General Data Protection Regulation (GDPR) and the UK GDPR, and applies to the extent those laws or similar US state laws apply. It takes effect when you accept your order or our terms. You do not need to sign anything separately; if you need a signed copy, email [email protected].
1. Roles
You decide what personal data your site or software collects and why, so you are the controller. We process it only to provide the services, so we are your processor. For our own business data (your account, billing and our correspondence) we are an independent controller under our privacy policy.
2. What we process (Annex 1)
- Subject matter and duration: hosting, building and maintaining your site or software, for the length of your order plus the 30-day export period.
- Nature and purpose: storage, hosting, backup, delivery, email sending, technical support and maintenance.
- Data subjects: your site's visitors, customers, subscribers and form senders, and your staff who use the client area.
- Personal data: what your site collects, such as names, email addresses, messages, form fields, newsletter subscriptions, IP addresses and technical logs.
- Special categories: none, unless you tell us in writing and we agree the extra safeguards first.
3. Our commitments
- We process personal data only on your documented instructions (these terms, your order and your settings), unless the law requires otherwise; then we tell you first unless the law forbids it. We tell you if we think an instruction breaks data protection law.
- Everyone who can access the data is bound by confidentiality.
- We apply the security measures in Annex 2.
- We help you answer requests from data subjects (access, deletion and the rest) and with security, breach notification, data protection impact assessments and consultations with authorities, as far as our role allows.
- We notify you of a personal data breach affecting your data without undue delay and within 48 hours of becoming aware of it, with the information we have, so you can meet your own 72-hour deadline.
- At the end of the services, we return your data (export) and then delete it within 30 days, and from backups as they expire (at most 6 months), unless the law requires us to keep it.
- We make available the information needed to show we comply, and allow audits by you or an auditor you choose, with reasonable notice, at most once a year unless there is a breach, under confidentiality. A written questionnaire comes first.
4. Subprocessors
You authorise us to use the subprocessors below. We bind each one by contract to data protection duties at least as strict as this DPA and remain responsible for them. We give at least 30 days' notice of a new subprocessor by updating this list and emailing clients; you can object on reasonable data protection grounds, and if we cannot address the objection you may end the affected service and receive a refund of prepaid fees for the remaining term.
| Subprocessor | What it does | Data | Location | Transfer safeguard |
|---|---|---|---|---|
| Hetzner Online GmbH | Servers that host client sites, the client area and their encrypted backups | All client site content and data, accounts, backups | Germany (EU) | EU company, EU data centres |
| Cloudflare, Inc. | Content delivery, DNS, HTTPS, attack protection, Access, Turnstile, media storage (R2), video calls (Realtime) | Visitor IP addresses and requests, cached pages and media, call media in transit | Global network; US company | Data Privacy Framework or Standard Contractual Clauses (Cloudflare DPA) |
| Resend (Plus Five Five, Inc.) | Sending sign-in links, notifications and, where ordered, newsletters | Recipient email addresses, message content and delivery logs | United States | Data Privacy Framework; Standard Contractual Clauses |
| GitHub, Inc. (Microsoft) | Private repositories holding each client site's code and build files | Site code and content files; no visitor data | United States | Data Privacy Framework or Standard Contractual Clauses (GitHub DPA) |
| Anthropic, PBC | AI drafting assistance and, when the host turns it on, meeting notes from transcript text | Text we choose to send (never call audio); not used for model training | United States | Standard Contractual Clauses (Anthropic DPA) |
| Functional Software, Inc. (Sentry) (not yet in use) | Error reports from the client area, with personal data removed before sending | Technical error details | To be confirmed at activation | Data Privacy Framework or Standard Contractual Clauses (Sentry DPA) |
| Stripe, Inc. (not yet in use) | Card payments for our own plans and, if you add a shop, for your own Stripe account | Billing name, email, payment details (handled by Stripe, never stored by us) | United States | Data Privacy Framework or Standard Contractual Clauses (Stripe DPA) |
Tools you connect to your own site with your own accounts (for example Google Analytics, your own Stripe account, or a newsletter service you choose) are your providers, not our subprocessors.
5. International transfers
Your site's data is hosted in Germany. Where a subprocessor processes personal data from the EU, EEA, UK or Switzerland in a country without an adequacy decision, the transfer relies on the EU-US Data Privacy Framework where the subprocessor is certified, and otherwise on the European Commission's Standard Contractual Clauses (Module 3, processor to processor) with the UK Addendum where relevant. Because we are a US company, transfers from you to us are covered by the Standard Contractual Clauses (Module 2, controller to processor), which are incorporated by reference into this DPA with these choices: clause 7 (docking) applies; clause 9 option 2 (general authorisation, 30 days' notice); clause 11 optional language does not apply; clauses 17 and 18: the law and courts of Ireland. The annexes of the clauses are completed by Annex 1 and Annex 2 of this DPA and the list in section 4. A second, encrypted backup copy kept in the United States on equipment we own and control (not yet in use) is processing by us, not a subprocessor: it is encrypted on the EU server before it leaves, the keys stay with us, and it is covered by these clauses.
6. US state privacy laws
Where the CCPA or a similar US state law applies, we act as your service provider or processor: we do not sell or share the personal data, do not retain, use or disclose it outside our direct business relationship with you or for any purpose other than the services, and do not combine it with other data except as those laws allow.
Annex 2: Technical and organisational security measures
- Encryption in transit (HTTPS/TLS) on every site and service; backups encrypted before they leave the server.
- Hosting in Hetzner data centres in Germany; daily backups to a separate storage system in Germany, with restore tests; once in use, an encrypted second copy on our own equipment in the United States (client-side encryption plus encrypted drives).
- Each client's data separated in the database (row-level security) and in separate site deployments.
- Staff access to servers and admin tools through SSH keys and Cloudflare Access, on a least-privilege basis; client sign-in by one-time email link (valid 10 minutes), with optional two-factor authentication and passkeys.
- Bot and attack protection in front of every site (Cloudflare); rate limits on forms and sign-in.
- Security updates applied to servers and dependencies, with automated vulnerability scanning of code and container images.
- Uptime and security monitoring with alerting; logged administrative actions.
- Personal data removed from error reports before they leave our servers.
- An incident response procedure with a breach log, and confidentiality duties for everyone with access.
Contact
Best Business Brands LLC20 N Wacker Dr #1000
Chicago, IL 60606, USA
[email protected]
SiteJetty support: [email protected]. Privacy and legal requests: [email protected].