Data Processing Agreement

This agreement is part of the Terms of Service and applies whenever a site you run on Cliux holds personal data about other people: your visitors, members and customers, the people who book, buy or donate, and anyone who writes to you through a form, a comment or the chat. For that data you are the controller and Cliux is your processor under Article 28 of the GDPR and, for people in Turkey, the data processor under Article 12(2) of Law No. 6698 (KVKK). It takes effect when you accept the Terms and lasts as long as we hold that data for you.

We process the data only to host, serve, back up and secure your sites and to run the features you switch on, and only on your documented instructions: the Terms, this agreement and the settings you choose in the console. We do not sell it, use it for advertising, or use it to train a model. If we think an instruction breaks the law, we tell you instead of following it. If the law makes us disclose the data to an authority, we tell you first unless the law forbids that.

• People: the visitors, members, customers, guests, donors and correspondents of your sites, and your own team members whom you invite.
• Data: contact details; what people send through forms, orders, bookings, comments and chat; member account details; and the technical data needed to serve and protect a site, such as an IP address and a browser.
• Special categories: only what you choose to collect, for which you need a basis of your own.
• Duration: the life of your account, then the deletion periods below.

Everyone at Cliux who can reach the data is bound to keep it confidential, and only the people who run the service can reach it at all. We keep at least the measures the security page describes for the life of this agreement, and a change to them may never lower the protection they give.

You authorise the providers the privacy policy names as processing data for Cliux. We bind each of them to data protection terms at least as protective as these, and we stay responsible to you for what they do.

When we add or replace one, the list in the privacy policy changes and the policy shows the day the change takes effect. If you object on reasonable data protection grounds within thirty days of that day and we cannot meet the objection, you may end the plans it affects, and we refund the part of them you have not used.

Cliux operates from Turkey, which has no EU adequacy decision. For data that comes to us from the European Union or the European Economic Area, the EU Standard Contractual Clauses (module two, controller to processor) are part of this agreement, with you as the data exporter and Cliux as the data importer; the governing law and the forum they ask for are those of the EU member state where you are established. Onward transfers to our providers rely on the transfer terms in their own agreements, as the privacy policy describes. For people in Turkey, a transfer abroad follows Article 9 of the KVKK.

The console shows what your sites hold about a person: form submissions, orders, bookings, members and conversations. When somebody asks you for their data, or for its deletion, and the console cannot do it, ask [email protected] and we do it for you within thirty days. If somebody asks us directly about data one of your sites holds, we pass the request to you and do not answer it ourselves. Where you need it, we help you with an impact assessment or a consultation with an authority, as far as what we know allows.

If personal data your sites hold is lost, disclosed or reached by someone who should not have it, we tell you without undue delay after we learn of it, with what we know, what it means for the people concerned, and what we are doing, and we keep telling you as we learn more. It is then yours, as the controller, to decide whether to notify an authority and the people affected; we give you what you need to do it.

When you delete a site, or your account, the site's data is deleted for good 90 days later, or at once when you choose Delete forever, and the encrypted off-site backups that still hold it expire within ninety days after that. Before then you can export what the console exports, and ask [email protected] for a copy of the rest; we send it within thirty days. Afterwards we keep only what the law makes us keep, the delivery records of your sites' emails until they expire (each address masked), the full payment notices Stripe sent us for your sites (they can carry a buyer's name, email address and billing address), and the weekly off-site copy of your sites' uploaded files; no job of ours deletes those last two.

We give you the information you need to show that this agreement is kept, and we answer your written questions about it. If that is not enough, or an authority asks, you or an independent auditor bound to confidentiality may audit what concerns your data, on thirty days' notice, during working hours, at your cost, and not more than once a year unless there has been a breach.

Liability under this agreement follows the Terms of Service. Where this agreement and the Terms disagree about personal data, this agreement prevails, and the Standard Contractual Clauses prevail over both.

Write to [email protected] about anything in this agreement, or use the contact form.