Data processing agreement

Roles. The Client is the data controller for personal data on their website, mailboxes and forms. Webee (Ioannis Krokos, AFM 143425411, ΓΕΜΗ 138512438000) is the data processor.

1. Subject and duration. Processing needed to host, maintain, back up, monitor and support the Client's website and mailboxes, and, where the Social addendum applies, the Client's social and ad accounts, for as long as the service runs.

2. Nature and purpose. Storage, backup, transmission, display, monitoring, support access on request. Webee does not use Client data for any other purpose.

3. Data and data subjects. Website visitors, customers and guests of the Client, the Client's staff. Typical data: names, emails, phones, booking or order details, IP addresses and logs, form submissions.

4. Webee's duties. Process only on the Client's documented instructions; keep staff and tools under confidentiality; apply appropriate security (access control, encryption in transit, backups, monitoring, least privilege); help the Client answer data subject requests and security incidents; notify the Client of a personal data breach without undue delay and at the latest within 48 hours of becoming aware; delete or return data at the end of the service; make available the information needed to show compliance; tell the Client if, in Webee's view, an instruction breaks the GDPR or other data protection law.

5. Sub processors. The Client gives general authorisation for the sub processors below. Webee informs the Client of changes by email and by updating this list and the version number; the Client may object within 14 days. If no workable alternative is found, the Client may end the affected service without penalty, with a pro rata refund of prepaid fees. Webee passes the same data protection duties on to each sub processor in writing and stays fully responsible to the Client for them.

Meta acts as joint controller for Page Insights under its own terms. Tools Webee uses for its own business (invoicing, its telephone line, its support voice agent) are not sub processors; Webee is the controller for the Client's contact data there, under the Webee privacy policy.

6. Transfers. Where a sub processor is outside the EEA, transfers rely on an adequacy decision (including the EU US Data Privacy Framework for certified US providers) or on the EU Standard Contractual Clauses with supplementary measures where needed.

7. Audits. Once a year, on 30 days notice, the Client may request a written description of Webee's measures and evidence (certifications or reports of the sub processors). If this is not enough to show compliance, the Client or an independent auditor bound by confidentiality may audit at the Client's cost, during business hours, without disrupting other clients. Webee also cooperates with supervisory authorities.

8. End of service. Data is returned on request and deleted from live systems within 30 days and from backups within the backup window, unless EU or Greek law requires longer retention.

9. Client duties. The Client is responsible for the lawful basis of its processing, its privacy policy and cookie consent on the website, and its instructions to Webee. Webee can set up a cookie banner or privacy page on request as a quoted extra.

10. Liability. Liability between the parties under this DPA follows clause 8 of the Terms. Nothing here limits the rights of data subjects under GDPR art. 82.