Legal
Data processing agreement for websites
Version dpa-websites-2026-10-20, in force from 20 October 2026
This agreement is part of the contract for every Cyclop Studio website, together with the general terms of sale for websites and the accepted quote. It applies as soon as the quote is accepted, without a separate signature. Where it differs from the terms on personal data, this agreement prevails.
The controller is the client named on the quote ("the Client"). The processor is Cyclop Technologies OÜ, a private limited company registered in Estonia (registry code 17628116, Sepapaja tn 6, 15551 Tallinn), represented by Bilel Rahmouni, member of the management board ("Cyclop"). A copy signed by both parties is available on request.
This agreement goes with the general terms of sale for websites.
1. Subject
Cyclop designs, hosts, maintains and monitors the Client's website and the related services listed on the quote. To do so, Cyclop processes personal data on behalf of the Client, as described in annex 1.
2. Duration
The agreement runs for as long as Cyclop provides a service to the Client, then until the data is returned and deleted under article 11.
3. The Client's instructions
Cyclop processes the data only on the Client's documented instructions. The quote, the terms, this agreement and the requests made from the project page, by email or as a change request are instructions.
If an instruction seems to breach the GDPR or another data protection rule, Cyclop tells the Client without delay and may suspend it until it is confirmed or changed.
If Union or Member State law requires Cyclop to process data without an instruction, Cyclop tells the Client before doing so, unless that law forbids it.
4. Confidentiality
The people authorised to process the data at Cyclop are bound to confidentiality, by contract or by law. Today only the managing director has access; anyone new signs a confidentiality undertaking before getting access.
5. Security
Cyclop applies the measures of annex 2, keeps them in line with the state of the art and the risks, and does not lower them during the contract without telling the Client.
6. Sub-processors
The Client gives a general authorisation for the sub-processors listed in annex 3.
Cyclop tells the Client by email at least 30 days before adding or replacing one. Within that time the Client may object on reasonable data protection grounds; without agreement, either party may end the service concerned without penalty.
Cyclop binds each sub-processor to data protection obligations equivalent to this agreement and remains liable to the Client for them.
7. Transfers outside the EEA
The site's data (database, files, mailboxes, backups) stays in the European Union.
A transfer outside the EEA happens only to the sub-processors of annex 3 marked as such, and only on the basis of an adequacy decision (including the EU-US Data Privacy Framework, Commission Implementing Decision (EU) 2023/1795, for a certified recipient) or of the European Commission's standard contractual clauses (Decision (EU) 2021/914).
8. Helping the Client with people's rights
If someone contacts Cyclop to exercise a right over data of the Client's site, Cyclop forwards the request to the Client within 5 working days and does not answer it itself unless instructed.
Cyclop helps the Client answer (extraction, correction, deletion in the database, the mailboxes and the backups) within the one-month time limit of article 12(3) GDPR. Help beyond 2 hours a year may be billed at the quote's rate, after the Client agrees.
9. Personal data breaches
Cyclop notifies the Client of any personal data breach affecting the site without undue delay and at the latest 24 hours after becoming aware of it, by email and by phone to the Client's contact.
The notice gives what Cyclop knows at that point: nature of the breach, categories and approximate number of people and records, likely consequences, measures taken or proposed, contact. The rest follows as soon as it is known.
Cyclop helps the Client notify the supervisory authority within 72 hours (article 33 GDPR) and, where needed, the people concerned (article 34).
10. Impact assessments
Cyclop gives the Client the information it holds for a data protection impact assessment (article 35 GDPR) or a prior consultation (article 36).
11. End of the contract
When the service ends, at the Client's choice expressed within 30 days, Cyclop either returns a full copy (database dump in SQL, files, mailboxes in Maildir or mbox) and then deletes the data, or deletes it directly. Without an answer, the data is deleted at the end of those 30 days.
Backups are deleted at the end of their rotation cycle. Cyclop confirms the deletion in writing on request.
Cyclop keeps only what the law obliges it to keep (its own invoices, for example), which does not contain the data of the site's visitors.
12. Audits
Cyclop makes available the information needed to show compliance with article 28 GDPR and accepts an audit, by the Client or an auditor bound to secrecy, once a year, on 30 days' notice, at the Client's cost. An audit after a breach is not limited in number.
13. Liability and law
Each party is liable for its own breaches under article 82 GDPR. The liability cap of the terms of sale for websites applies, except for intentional breach or gross negligence. The governing law and the courts are those of the terms of sale for websites.
Annex 1. Description of the processing
Annex 2. Security measures
Isolation: one virtual server per client, nothing shared between clients.
System: security updates applied; services in containers; a front web server with TLS certificates for every connection.
Administrator access: by SSH key only; the Cyclop team reaches servers through a private network; the Client's account passwords are kept in a password vault dedicated to the Client, never in a code repository.
Database: not exposed to the Internet, reachable only from the site's container.
Backups: every night Cyclop's backup server pulls a full copy (configuration, files, mailboxes, database dump) over SSH with a forced command that can do nothing else; an alert is raised if the latest copy is more than 36 hours old.
Monitoring: availability probe, hourly check of the site, the disk, and the domain's SPF, DKIM and DMARC records.
Changes: every change goes through the site's Git repository, is reviewed, then deployed. A change request is handed to an AI assistant only after Cyclop has approved it, and the assistant has no access to secrets, container files or database migrations.
Staff: access limited to the managing director; a confidentiality undertaking for anyone new.
Incidents: a written procedure, and notice to the Client within 24 hours.