Test environment: the legal texts are drafts.

Data Processing Agreement

Version 0.3, in force from 13 November 2026

Draft for legal review. This text is not in force yet.

This agreement is part of our Terms of Service. It applies where, in providing SiteCare Lab, we process personal data on your behalf (Art. 28 of Regulation (EU) 2016/679, the GDPR). You are the controller; Es Key Tech Ltd, ЕИК 208916463, is the processor.

1. What we process and why

Our checks load your website's pages and record what they show. Pages can contain personal data: names and photos of staff, contact details, reviews, comments. We process such data only as far as it appears in what we check, only to provide the services you ordered, and never to contact the people concerned or to build profiles of them. The details are in Annex 1.

2. Your instructions

We process the data only on your documented instructions: these terms, the services you order and the settings you choose in your account. If we must process data because EU or Bulgarian law requires it, we tell you first, unless that law forbids it. If we believe an instruction breaks data protection law, we tell you.

3. Confidentiality

Everyone who works with the data for us is bound to keep it confidential.

4. Security

We take the measures in Annex 2, suited to the risk, and keep them up to date.

5. Sub-processors

You allow us to use the sub-processors in Annex 3. We tell you by email at least 30 days before we add or replace one. If you object for a reason related to data protection and we cannot solve it, you can end the affected services, and we refund the unused part of any prepaid period. We bind each sub-processor to the same data protection duties as this agreement, and we remain responsible to you for its work.

6. Helping you

We help you, as far as we reasonably can, to answer requests from people who use their rights, and to meet your duties on security, data breaches, impact assessments and prior consultation (Art. 32–36 GDPR). If someone asks us directly about data we process for you, we pass the request to you and do not answer it ourselves.

7. Data breaches

We tell you without undue delay, and in any case within 48 hours after we learn of a personal data breach that affects your data, with what we know and what we are doing about it, and we keep you informed.

8. When the contract ends

Within 30 days after the contract ends, we delete the personal data we processed for you, unless EU or Bulgarian law requires us to keep it. Save your reports before you ask us to close your account; when we end a contract, we tell you in advance so that you can.

9. Proving that we keep to this agreement

We give you the information you need to see that we keep to this agreement. You may audit us, or have an independent auditor bound to confidentiality do so, once a year, with 30 days' notice, at your own cost, and in a way that does not disturb our work or reveal other customers' data. We may first answer with written information.

10. Your duties

You make sure that the content of your website, and our processing of it, has a legal basis, and that the information you give your visitors mentions such checks where needed. You do not ask us to check pages meant only for signed-in users.

11. Liability and term

Liability under this agreement follows Art. 82 GDPR and the limits in our Terms of Service, where the law allows them. This agreement lasts as long as we process data for you.

Annex 1: Details of the processing

Annex 2: Security measures

Annex 3: Sub-processors