Sign inStart for free

Data processing agreement

Version of 10 November 2026, third version

This is a convenience translation. The German version is legally binding.

under Art. 28 General Data Protection Regulation (GDPR)

Parties

Customer is the organisation that accepts this agreement in Cleverpage when activating a website. Whoever accepts it confirms that they are authorised to represent the organisation.

Processor (hereinafter "Provider") is:

wamedia ITC Markus Anspach & Michael Wischang GbR
Europaallee 10, 67657 Kaiserslautern, Germany
hello@cleverpage.ai

Role of the customer

If the customer runs a website for itself, it is the controller for that website within the meaning of the GDPR, and the Provider is its processor.

If the customer runs a website for a third party, for example as an agency for its clients, that third party is the controller. The customer is then its processor, and the Provider is a further processor of the customer (Art. 28(2) and (4) GDPR). In this case the following also applies:

  • The customer has concluded its own agreement under Art. 28 GDPR with the controller, which permits the use of the Provider and of the sub-processors listed in section 6.
  • The customer passes the controller's instructions on to the Provider. The Provider fulfils its obligations under this agreement towards the customer; the controller exercises its rights through the customer.

1. Subject matter and duration

The Provider operates the Cleverpage software for the customer, with which websites are created, stored, maintained and delivered. In doing so, it processes personal data on behalf of the customer. This agreement applies for as long as the customer uses Cleverpage and ends with the deletion of its data under section 9.

2. Nature, purpose and scope of the processing

Data is processed to the extent necessary to operate the customer's websites:

  • delivery of the websites to visitors, including the IP address and the information the browser sends;
  • the website's anonymous visitor count, without cookies and without stored IP addresses;
  • submissions from the website's forms, their storage for the retention period the customer sets, and their forwarding by e-mail to the recipients the customer specifies;
  • website content that may contain personal data, such as names and photos of employees;
  • the accounts of the people the customer invites to Cleverpage (name, e-mail address, permissions, sign-ins);
  • change requests received by e-mail or via connected channels, and tasks given to AI features the customer uses.

Data subjects are visitors to the websites, people who submit forms, people whose data appears in the content, and the customer's users and contact persons.

3. Instructions

The Provider processes the data only on documented instructions from the customer. This agreement and the customer's settings and actions in Cleverpage count as instructions. The customer gives further instructions in text form. If the Provider considers an instruction to be unlawful, it informs the customer without delay. If the Provider processes data because Union or Member State law requires it to, it informs the customer beforehand, unless that law prohibits it.

4. Obligations of the Provider

  • It commits everyone who has access to the data to confidentiality.
  • It takes the technical and organisational measures under Art. 32 GDPR described in section 8 and adapts them to the state of the art without lowering the level of protection.
  • It supports the customer with appropriate measures in responding to requests from data subjects under Art. 12 to 23 GDPR, and in the obligations under Art. 32 to 36 GDPR.
  • It notifies the customer of a personal data breach without undue delay after becoming aware of it, with the information the customer needs for its own notification.
  • It makes available to the customer all information necessary to demonstrate compliance with these obligations, and allows audits by the customer or an auditor it appoints, by arrangement and with reasonable notice.

5. Obligations of the customer

The customer, as controller or in relation to its client, is responsible for the lawfulness of the processing, in particular for the content of its websites, the questions in its forms, the retention periods it sets, and informing data subjects in its privacy policy.

6. Sub-processors

The customer agrees to the use of the following sub-processors. The Provider contractually binds them to a level of protection that corresponds to this agreement.

  • Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany: operation of the server in a data centre in Germany on which websites, media, form submissions and accounts are stored.
  • Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA: delivery of published websites on their own domain, once a website is public.
  • Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg (Amazon SES and Amazon S3, Frankfurt region): sending notifications about form submissions, receiving change requests by e-mail and storing the encrypted backups.
  • Anthropic (USA): AI features in Cleverpage, such as editing texts and pages, when the customer uses them.
  • fal.ai and Replicate (USA): generation of images, videos, speech and music, when the customer uses these features.

If the Provider wants to add or replace a sub-processor, it informs the customer in text form at least 30 days in advance. The customer may object for an important reason relating to data protection law. If the parties cannot agree, the customer may terminate the affected service.

7. Processing outside the EU

Where a sub-processor processes or may process data in the USA, this takes place on the basis of the EU-U.S. Data Privacy Framework, insofar as the sub-processor is certified under it, and otherwise on the basis of the European Commission's Standard Contractual Clauses.

8. Technical and organisational measures

  • The server is located in a data centre in Germany. Only authorised staff of the Provider have access to the server, using personal keys.
  • All connections to Cleverpage and to the websites are encrypted (HTTPS).
  • Sign-in to Cleverpage uses links that are valid only once. What a person may do is governed by permissions the customer assigns. External users only see the website they were invited to.
  • The server stores requests only with a truncated IP address (IPv4 without the last byte, IPv6 after the first 48 bits) and deletes this log after 7 days. The upstream web server logs no ordinary request. Requests for paths that only attack tools ask for (such as /.env or /wp-login.php, never a page of a website) are stored with the full IP address for at most two days, in order to block such senders.
  • The visitor count sets no cookies and stores no IP addresses. It respects "Do Not Track" and "Global Privacy Control".
  • Form submissions are deleted after the period the customer sets, or not stored at all if the customer chooses so.
  • Changes to websites are versioned and can be undone.
  • An encrypted backup of all data is made every day and kept in a data centre in Frankfurt am Main. Deleted data is removed from it after 42 days at the latest and can be restored for up to 30 more days before it is deleted for good.

9. End of the agreement

When use ends, the Provider deletes all of the customer's personal data, unless there is a legal obligation to retain it. It disappears from the backups after the periods in section 8. Before that, the customer can export its websites in full at any time.

10. Final provisions

This agreement is concluded in electronic form (Art. 28(9) GDPR). It takes precedence over other agreements between the parties insofar as they concern the protection of personal data. If a provision is invalid, the rest of the agreement remains valid. German law applies.