Data Processing Addendum

Customer Personal Data means personal data in Customer Data (as defined in the Agreement) that NETCETERA OÜ processes on the Customer's behalf. Sub-processor means a third party NETCETERA OÜ engages to process Customer Personal Data. Security Incident means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access to Customer Personal Data. Other terms such as controller, processor, personal data and processing have the meanings in the GDPR.

The Customer is the controller (or a processor acting for its own customers) and NETCETERA OÜ is the processor (or sub-processor) of Customer Personal Data. NETCETERA OÜ is a separate controller for account, billing and usage data, as described in its Privacy policy. The details of the processing are in Annex 1. This DPA lasts as long as NETCETERA OÜ processes Customer Personal Data.

NETCETERA OÜ processes Customer Personal Data only on the Customer's documented instructions: the Agreement, the Customer's settings and use of DRSite (for example which sites to back up, how often, where standby copies live and when to fail over), and other written instructions we agree. If the law requires other processing, we will tell the Customer first unless the law forbids it. We will tell the Customer if we believe an instruction breaks data protection law.

NETCETERA OÜ ensures that people authorised to process Customer Personal Data are bound to confidentiality, and applies the technical and organisational measures in Annex 2, which we may update provided the overall level of protection is not reduced.

NETCETERA OÜ will notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a Security Incident, with the information available then and more as it becomes known, and will take reasonable steps to contain it and help the Customer meet its own notification duties. Notifying an incident is not an admission of fault.

The Customer authorises the Sub-processors listed in Annex 3. NETCETERA OÜ imposes data protection terms on each that are no less protective than this DPA and stays responsible for them. We will give at least 30 days' notice of a new Sub-processor by email or in DRSite. The Customer may object on reasonable data protection grounds within that time; if we cannot reasonably accommodate the objection, the Customer may end the affected Services and receive a pro rata refund of prepaid fees.

Taking into account the nature of the processing, NETCETERA OÜ will help the Customer, by appropriate measures and as far as possible, to answer requests from data subjects, and with security, impact assessments and consultations with authorities. If a data subject contacts us directly about Customer Personal Data, we will refer them to the Customer. Help beyond the normal features of DRSite may be charged at reasonable cost.

Customer Personal Data may be processed in the countries listed in Annex 3. Where this involves a transfer from the EEA, UK or Switzerland to a country without an adequacy decision, the parties rely on the EU Standard Contractual Clauses (Commission Decision 2021/914), Module 2 (controller to processor) or Module 3 (processor to processor), which are incorporated by reference with: the optional docking clause 7 included; clause 9 option 2 (general authorisation, with the notice in clause 6 above); the optional language in clause 11 omitted; clauses 17 and 18 governed by Estonian law and the courts of Estonia; and Annexes I to III completed by Annexes 1 to 3 of this DPA. For UK transfers, the UK International Data Transfer Addendum applies; for Swiss transfers, the clauses are read with references to the Swiss law and authority. Transfers to US recipients certified under the EU-US Data Privacy Framework may rely on it instead.

NETCETERA OÜ does not use Customer Personal Data to train AI models. Instasite sends to its AI provider only what the Customer submits to it (a brief, a site name, the public text of a website and brand details the Customer chooses to use), solely to produce the requested output. DRSite does not use AI for decisions about data subjects.

NETCETERA OÜ will make available the information needed to show compliance with this DPA, including answers to reasonable security questionnaires and summaries of relevant reports. If that is not enough, or an authority requires it, the Customer may audit NETCETERA OÜ's compliance once a year, with at least 30 days' notice, during business hours, by an independent auditor bound to confidentiality, at the Customer's cost and without access to other customers' data.

The Customer can download or restore its backups at any time during the Agreement and for 30 days after it ends. After that, NETCETERA OÜ deletes Customer Personal Data, including standby copies, within a further 60 days, except where the law requires us to keep it. Copies in routine backups are deleted as those backups expire and stay protected by this DPA until then.

Liability under this DPA is subject to the limits in the Agreement, except where the law does not allow them. If this DPA conflicts with the Agreement, this DPA applies to the processing of Customer Personal Data; if the Standard Contractual Clauses apply, they prevail over both. This DPA is governed by the laws of Estonia.