Data Processing Agreement

This Data Processing Agreement (the “DPA”) is part of the Husly Terms of Service. It applies when you use Husly to process personal data of other people, for example the visitors of your site or the people who fill in your forms. It contains the terms that Article 28(3) of the EU General Data Protection Regulation (EU 2016/679, the “GDPR”) requires.

When you accept the Terms of Service, you also conclude this DPA. You do not need to sign anything else. If the Terms of Service and this DPA say different things about personal data, this DPA applies.

1. Controller and processor

• You are the controller. “You” is the customer who has a Husly account and uses it to run one or more sites. You decide why and how personal data is collected on your sites.
• Husly is the processor. The processor is WebAdmin OÜ, registry code 14698205, Hauka 13, 11315 Tallinn, Eesti (“Husly”, “we”). We process that data only to provide the Service to you.

This DPA does not cover data that we process for our own purposes, for example your account, billing and the security of the platform. There we are the controller, and our Privacy Policy applies.

2. Subject and duration

The subject of the processing is the hosting of your sites and the running of the features that you use in the Service. The processing lasts as long as the Terms of Service are in force between us, and after that until we have deleted or returned the data as set out in section 12.

3. Nature and purpose of the processing

We store, organise, show, send, back up and delete personal data, as far as that is necessary to:

• host your sites and show their pages to visitors;
• receive and keep form answers and the files that people send with them, and send you a notice by email;
• run the features that you switch on, for example bookings, the AI chatbot and cookie consent;
• protect your sites and the Service against spam, bots and other abuse;
• give you support when you ask for it.

We do not use this data for our own purposes, we do not sell it, and we do not use it to train AI models.

4. Types of personal data

Which data we process depends on the features that you use and on what you ask your visitors. It can include:

• contact details: name, email address, phone number, address;
• the content of messages and form answers, and the files that people send;
• booking details;
• messages that people write to the AI chatbot on your site;
• technical data: IP address, browser and device data, cookie consent choices, page visits;
• the names and email addresses of the team members to whom you give access to your account;
• any other personal data that you decide to collect with the Service.

The Service is not made for special categories of personal data (Article 9 of the GDPR, for example health data) or for data about criminal convictions (Article 10). If you still collect such data, you must have a legal basis for it, and you must check that the measures in this DPA are sufficient for it.

5. Categories of data subjects

• visitors of your sites;
• people who fill in your forms or book a time;
• people who write to the AI chatbot on your site;
• your customers and other contacts whose data you add to the Service;
• your team members who use your account.

6. Your instructions

We process the personal data only on your documented instructions, also when the data goes to a country outside the EU/EEA. Your instructions are this DPA, the Terms of Service, and the settings and actions that you make in the Service. You can send other instructions in writing to [email protected].

If we think that an instruction breaks the GDPR or other data protection law, we tell you at once. If EU or Member State law requires us to process the data in another way, we tell you before we do so, unless that law forbids it.

You are responsible that the processing you instruct is lawful. This means a legal basis for each purpose, a privacy notice for your visitors, and consents where the law requires them.

7. Confidentiality

Only people who need access for their work (to run, support or protect the Service) can access your data. Each of them has a duty of confidentiality by contract or by law. We do not look at the personal data on your sites, except when that is necessary for support that you asked for, to fix a fault, or to protect the Service.

8. Security measures

We take technical and organisational measures that suit the risk (Article 32 of the GDPR). Today these are:

• all connections to the Service and to your sites are encrypted with HTTPS (TLS);
• we store passwords only as one-way hashes (bcrypt), and you can turn on two-step sign-in with an authenticator app;
• sign-in attempts are limited, and forms are protected against bots and spam;
• access is based on roles: a user sees only the sites of which they are a member;
• we store the keys and tokens of integrations encrypted (AES-256-GCM);
• before every update of the Service, a backup of the database is made to a separate disk, so that the Service can be restored after a fault;
• we install software updates and security fixes, and we watch the error logs.

Your sites and their database run on our own server in Estonia (EU). No other company runs that server. We review the measures when the Service or the risks change. No system is completely secure. If an incident happens, section 11 applies.

9. Sub-processors

You give us a general written authorisation to use sub-processors. A sub-processor is another company that processes your data for us, for example to send email or to store files. The current list, with the purpose, data, location and transfer basis of each company, is on the Sub-processors page.

With each sub-processor we have a written contract with the same data protection obligations as in this DPA, in particular sufficient guarantees about security. We stay responsible to you for the work of our sub-processors.

Notice of changes. At least 30 days before we add a new sub-processor or replace one, we update the list of sub-processors with the planned date and send an email notice to everyone who has asked for notices. To get the notices, send an email to [email protected] with the subject “Sub-processor notices”, from the address that should get them.

Your right to object. You can object to a change within those 30 days, in writing to [email protected], if you have a reasonable reason related to data protection. We then look for a solution with you in good faith. If we cannot find one, you can end your subscription before the change takes effect, and we refund the fees you paid in advance for the time after the end.

If we must replace a sub-processor faster to keep the Service secure or running (for example, when the provider stops its service), we tell you as soon as we can. Your right to object stays the same.

Integrations that you connect yourself, with your own account, are not our sub-processors. Examples are Mailchimp, Smaily, Brevo, MailerLite, HubSpot, Pipedrive, Slack, Microsoft Teams, Discord, Telegram, Google Sheets, Google Search Console, Canva, your own analytics (PostHog, Google Analytics, Meta Pixel), your own Stripe account and webhooks. You choose them, they work on your account and their own terms, and the data goes to them on your instruction. Name them in your own privacy notice.

10. Help with the rights of data subjects

If a person contacts us about their data on your site, we send the request to you without undue delay. We do not answer it ourselves unless you tell us to. In the Service you can find, export and delete form answers. If that is not enough to answer a request, we help you on request, as far as we can, taking into account the nature of the processing.

11. Breaches, impact assessments and other help

Personal data breach. If we become aware of a personal data breach that affects your data, we tell you without undue delay, and at the latest within 48 hours. We send the notice to the email address of your account owner. It says what we know at that time: what happened, which data and how many people it affects, the likely consequences, and what we have done or plan to do. We add details when we learn more. This helps you to notify the supervisory authority within 72 hours where Article 33 of the GDPR requires it.

Impact assessment and consultation. If you do a data protection impact assessment (Article 35) or consult a supervisory authority (Article 36), we give you the information about the Service that you need for it.

12. End of the processing: deletion or return

Before the end, you can download your content as the Terms of Service describe, and export your form answers. If you ask before the end, we return the personal data to you in a common file format.

When the Terms of Service end between us (you delete your account, or we close it under the Terms of Service), we delete or anonymise the personal data that we process for you at the latest 90 days after the end, unless EU or Member State law requires us to keep it. Copies in backups are deleted when the backup expires, at the latest 12 months after it was made. Until then the backups stay protected, and we use them only to restore the Service after a fault.

13. Information and audits

We give you all information that you need to show that we meet the obligations of Article 28 of the GDPR. Send questions to [email protected]. If the written information is not enough, you or an auditor that you choose can audit us. The auditor must be bound by confidentiality and must not be our competitor. Tell us about the audit at least 30 days in advance. An audit can happen at most once in 12 months, unless a breach or a supervisory authority makes another one necessary. It must not harm the security of the Service or the data of other customers. Each party pays its own costs.

14. Transfers outside the EU/EEA

Your sites and their database run on our own server in Estonia (EU). No other company runs that server. Some sub-processors can process data outside the EEA. We transfer data there only on a basis that Chapter V of the GDPR allows: an adequacy decision of the European Commission (for example the EU-US Data Privacy Framework for certified companies), or the Standard Contractual Clauses of the European Commission with the additional measures that are necessary. The list of sub-processors shows the basis for each company.

15. Liability, changes and governing law

The limits of liability in the Terms of Service also apply to this DPA, as far as the GDPR (in particular Article 82) allows. We can change this DPA when the law, the Service or our sub-processors change. We tell you about material changes in advance, in the same way as for the Terms of Service. A change does not lower the protection of your data. This DPA is governed by the law of the Republic of Estonia.

16. Contact

Send questions about this DPA to [email protected].