1. Parties and documents
- Controller: the Agency (or the Direct customer or Client, see section 2).
- Processor: SiteManager NV, Dreefstraat 7A, 9260 Wichelen, Belgium, enterprise and VAT number BE-0656.994.559, privacy contact privacy@sitemanager.io.
- This DPA forms part of the Memory service terms. On personal data it prevails over them.
- Base text: Commission clauses (Decision (EU) 2021/915), modules for controller to processor, with Annexes I to IV below. Where the Agency itself acts for its client, SiteManager is a sub-processor and the Agency passes on the same obligations (the "docking clause" lets a client join if needed).
2. Roles per processing activity
| # | Activity | People concerned | Controller | SiteManager | Notes |
|---|---|---|---|---|---|
| 1 | Memory accounts, sign-in, security, service mails, usage limits | Agency staff, clients' staff, direct customers | SiteManager | Controller | Privacy notice 4.1, 4.2, 4.9; outside this DPA |
| 2 | Memories the agency creates for its own or its clients' websites: crawl, business profile, llms.txt, SEO data, strategy, reports, website copy |
People named on the websites | Agency; where the agency works for its client, the client, with the agency as its processor | Processor (or sub-processor) | Core of this DPA |
| 3 | A client's memory requested through the agency's embed (client "remains the holder", agency is "technical contact") | As 2 | Agency, as in row 2 [to approve] | Processor | The embed's wording must match the roles chosen, or the wording changes |
| 4 | Embed leads: requester e-mail, website, confirmation, notification mail to the agency | Requesters | Agency | Processor | SiteManager is controller for the account it then creates (row 1) |
| 5 | SiteManager's own embed (landing page) | Requesters | SiteManager | Controller | Outside this DPA; code supports it, none in production |
| 6 | Google reviews: capture, raw text, themes | Reviewers, people mentioned | As for the memory (row 2); SiteManager for its own memories [to approve] | Processor; controller for its own memories | Legitimate interest with minimisation; health details: article 9(2)(e) (privacy notice 4.5) |
| 7 | Chat conversations and reports about an agency memory | The user; people mentioned | Agency (content); SiteManager (account and security) | Processor for content | Conversations are personal to the user; the agency cannot see them in the app, and SiteManager gives them to the agency only with the user's consent or where the law requires it [to approve] |
| 8 | SEO data for a memory | Normally none (domains, keywords) | As 2 | Processor | A domain can identify a sole trader |
| 9 | Company register copy (KBO) | Legal persons only | SiteManager | Controller | Not agency data; licence terms |
| 10 | Usage, cost and audit records; provider usage events | Users (pseudonymous ids) | SiteManager | Controller | Content-free |
| 11 | Payments when enabled | Payer contacts | SiteManager | Controller | Recurly is SiteManager's processor |
| 12 | Staff support access to an agency workspace (read-only) | As 2 | Agency | Processor acting on its instructions | Staff views are not logged yet |
| 13 | Quality evaluation on copies of project data | As 2 | SiteManager | Controller [to approve] | Not a processor activity: SiteManager's legitimate interest in a reliable service (privacy notice 4.13) |
| 14 | SiteManager's internal projects (own sales prospects, SiteManager Studio clients, Notion project documents) | People on those websites | SiteManager; or the Studio client under SiteManager's existing data processing terms | Controller or processor | Outside this DPA |
| 15 | Rights requests from people named on websites or in reviews | Those people | As the activity concerned | Assists the controller | Section 3.6 |
3. Clause outline
3.1 Subject and duration. Processing to provide Memory to the Controller, for as long as SiteManager processes the Controller's personal data under the terms.
3.2 Instructions. The terms; the Controller's use of Memory's features (adding a website, starting or confirming a scan, deleting a conversation, configuring an embed); and written instructions to privacy@sitemanager.io. SiteManager tells the Controller if an instruction appears to break data protection law.
3.3 Confidentiality. Only staff who need access, bound by confidentiality. Staff access to customer workspaces is read-only and limited to SiteManager staff accounts [to approve: a named support group].
3.4 Security. The measures in Annex III. SiteManager may improve them but not reduce the overall level.
3.5 Sub-processors. General authorisation for the providers in Annex IV. SiteManager informs the Controller at least 30 days [to approve] before adding or replacing one. The Controller may object on reasonable data protection grounds; if no solution is found, the Controller may end the affected service without penalty. SiteManager imposes the same data protection obligations on each sub-processor and remains liable for them.
3.6 Assistance. SiteManager forwards requests from data subjects within 5 working days [to approve] and helps the Controller answer them: export of a person's data, correction, deletion, restriction and exclusion from later scans, run by staff. SiteManager helps with impact assessments and consultations where needed.
3.7 Personal data breach. SiteManager notifies the Controller without undue delay after becoming aware, with a target of 48 hours [to approve], and provides what is known (nature, categories and approximate numbers, likely consequences, measures), then updates. SiteManager keeps a register of breaches.
3.8 End of the service. The Controller chooses export or deletion; both are run by SiteManager staff on request. Export within 30 days after the end (memory documents, reports, saved results, structured data). Deletion within 30 days after the export period. [to approve] Backups expire within 14 days plus 7 days of recovery logs; deletions are re-applied if a backup is restored. Provider copies follow Annex IV. SiteManager confirms deletion in writing on request.
3.9 Audits. SiteManager provides the information needed to show compliance (this DPA's annexes, supplier DPAs, test evidence) and answers reasonable questionnaires. An on-site or remote audit at most once a year with 30 days' notice, at the Controller's cost unless it finds a material breach.
3.10 International transfers. Only to the sub-processors in Annex IV, with the safeguards listed there (EU-US Data Privacy Framework for certified recipients, otherwise the Commission's standard contractual clauses, Decision (EU) 2021/914, module 3 between SiteManager and the sub-processor).
3.11 Liability. As in clause 14 of the service terms. [to approve]
Annex I: parties
| Controller | Processor | |
|---|---|---|
| Name | [AGENCY NAME] | SiteManager NV |
| Address | [AGENCY ADDRESS] | Dreefstraat 7A, 9260 Wichelen, Belgium |
| Contact | [AGENCY CONTACT] | privacy@sitemanager.io |
| Role | Controller (or processor for its client) | Processor (or sub-processor) |
Annex II: description of the processing
| Item | Activity 2 and 3: memories | Activity 4: embed leads | Activity 7: chat content |
|---|---|---|---|
| People | Staff, contact persons and others named on the website; people in testimonials; reviewers and people mentioned in reviews (if activity 6 is the Controller's) | People who request a memory through the agency's form | The user; people the user mentions |
| Personal data | Names, job titles, business contact details and other text on public pages; page metadata; review text, rating, date, language (no reviewer names requested) | E-mail address, website address, request time and status | Questions, answers, reports, action records |
| Special categories | None intended. Review text can reveal health details; not extracted or shown (privacy notice 4.5) | None | None intended; users are asked not to enter them |
| Nature | Automated reading of public pages (HTML only, robots.txt respected), extraction and summarising with AI models, indexing for search, storage, display to authorised users, export | Collection through the form, confirmation e-mail, notification e-mail to the agency | Storage, AI answering, display to the user only |
| Purpose | Describe the business and produce the documents the Controller asks for | Handle the agency's memory requests | Answer the user's questions about the memory |
| Duration | While the memory exists; see retention | Unconfirmed: e-mail address deleted 7 days after the 24-hour link expires; confirmed: with the memory | Until the user deletes it or the memory is deleted; proposal: at most 90 days after last activity [to approve; not automatic yet] |
| Location | Google Cloud europe-west1 (Belgium); providers in Annex IV | Same | Same |
Annex III: technical and organisational measures (with known gaps)
| Area | Measure |
|---|---|
| Hosting | Cloud Run and Cloud SQL in europe-west1; customer deployment refuses a non-EU region |
| Tenant isolation | Every read and write scoped to a tenant and its sites; foreign ids answer "not found"; a two-agency isolation test runs on every push |
| Customer accounts | Argon2id passwords; random sessions stored as SHA-256 digests; 12-hour server expiry; reset links single-use, 15 minutes, revoke sessions |
| Web security | Signed CSRF tokens with Origin and Fetch-Metadata checks; strict Content Security Policy; nosniff; Referrer-Policy: no-referrer; framing only on registered embed origins |
| Abuse limits | Sign-in: 30 per IP and 10 per e-mail per 15 minutes; mail limits per address |
| Staff access | Staff apps behind Google Identity-Aware Proxy with an allow-list of SiteManager accounts [to approve: a named support group]; each request's signed header verified; customer workspaces read-only for staff |
| Secrets | Secret Manager; values never in Terraform state; least-privilege service accounts (the customer app has no crawler, Notion or SiteManager credentials) |
| Logging | Allowlisted fields only, key-name redaction; page and model content not logged; legacy e-mail-link URLs excluded from request logs |
| AI inputs | Website text passed to models as data, outputs validated against strict schemas; store=false on OpenAI Responses calls |
| Minimisation | Reviews requested without personal data, only rating, text, date and language kept, review datasets deleted at the provider after capture; register data for legal persons only |
| Backups | Daily backups kept 14, point-in-time recovery 7 days, deletion protection |
| Known gaps (must close or be disclosed) | No alerting or uptime checks; no tested restore with deletion replay; deletion and export run by staff on request, not self-service; crawl copies at Apify deleted only with the memory; logs in Google's global location; no log of staff views; MFA for staff Google accounts not verified |
Annex IV: sub-processors
See Sub-processors: Google Cloud, OpenAI, Apify, SE Ranking, Google Workspace (mail); Recurly when payments start. Notion is used only for SiteManager's own projects and is not a sub-processor for agencies.