← Home
Legal
Data processing agreement.
Last updated 9 October 2026
What this covers
This agreement forms part of our Terms. It applies when Sitewright MB Ltd ("we") handles personal data on behalf of a client ("you"), for example when we send review requests to your customers on the Grow plan. For that data, you are the data controller and we are your data processor under UK GDPR and the Data Protection Act 2018. You accept this agreement when you tick the box in your Sitewright portal, or sign up to a plan that links to it.
The processing
| Subject matter | Sending review requests and similar service messages to your customers on your behalf. |
|---|
| Duration | For as long as the service is switched on, plus the deletion period below. |
|---|
| Nature and purpose | Receiving, storing and using customer contact details to send the messages you've asked for, and recording whether they were delivered. |
|---|
| Types of personal data | Name, email address, and the date of their order or job. |
|---|
| Whose data | Your customers. |
|---|
What we promise
- Your instructions only. We only use the data to provide the service you've switched on, and never for our own purposes or anyone else's. If we think an instruction breaks data protection law, we'll tell you.
- Confidentiality. Anyone at Sitewright who can access the data is bound to keep it confidential.
- Security. We protect the data with appropriate measures, including encryption in transit, access limited to the people who need it, and secure, reputable providers.
- Data breaches. If we become aware of a breach affecting your data, we'll tell you without undue delay and give you the information you need to meet your own obligations.
- Your customers' rights. If one of your customers asks to see, correct or delete their data, or to stop receiving messages, we'll help you respond. Every message includes a simple way to opt out, and we stop contacting anyone who does.
- Helping you comply. We'll give you reasonable help with data protection impact assessments and with questions from the Information Commissioner's Office, and the information you need to show this agreement is being followed.
- Deletion. When the service ends, or you ask, we delete your customers' data within 30 days, or return it to you first if you ask. We'll keep only what the law requires us to keep.
Who else handles the data
You give general permission for us to use the sub-processors below. Each is bound by data protection terms at least as protective as these. We'll tell you before we add or replace one, and you can object.
| Provider | What for | Where |
|---|
| Resend | Sending emails | EU |
| Vercel | Running the sending service | USA |
Where data is processed outside the UK, it is covered by UK adequacy regulations or appropriate safeguards, such as the UK International Data Transfer Addendum.
What you promise
- You have a lawful basis for sharing your customers' details with us and for us to contact them on your behalf, including under the Privacy and Electronic Communications Regulations where they apply.
- Your own privacy notice tells customers that you may contact them about their order or job, including to ask for a review.
- You only send us the details we need, and tell us if a customer asks not to be contacted.
Liability
Each of us is responsible for meeting our own obligations under data protection law. The liability terms in our Terms apply to this agreement, except where the law doesn't allow them to.
Contact
Questions about this agreement or your data: hello@sitewright.xyz.