Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between StaticHero (“Processor”) and the customer (“Controller”) where StaticHero processes personal data on the customer’s behalf.

1. Scope

StaticHero processes personal data contained in (a) form submissions received by the customer’s sites and (b) technical data used to provide analytics and hosting for those sites.

2. Instructions

We process personal data only on the customer’s documented instructions — the configuration of the Service — and as required by law.

3. Confidentiality and security

Personnel with access are bound by confidentiality. We implement appropriate technical and organisational measures, including encryption in transit (HTTPS), access controls, least-privilege administration, and data minimisation such as never storing raw visitor IP addresses for analytics.

4. Sub-processors

The customer authorises the use of sub-processors needed to run the Service (infrastructure, email delivery, payments). We remain responsible for their performance and will give notice of new sub-processors with an opportunity to object.

5. Assistance

We will reasonably assist the customer in responding to data subject requests (most can be handled with self-service export and deletion), and with security incident notifications, which we will provide without undue delay after becoming aware of a personal data breach.

6. Deletion

On termination, we delete personal data processed on the customer’s behalf within 30 days unless retention is legally required.

7. Transfers

Where personal data is transferred outside the EEA/UK, the parties rely on the Standard Contractual Clauses or another valid transfer mechanism.

8. Audits

We will make available information reasonably necessary to demonstrate compliance with this DPA.

For a countersigned copy, contact privacy@statichero.com.