1.1 This Data Processing Addendum ("DPA") forms part of the Terms of Service (the "Terms") between Edevos EOOD, UIC (EIK) 205573828, 68 Saedinenie Str., Shumen, Bulgaria, trading as Sitedote ("Sitedote" or "Processor"), and the Customer ("Customer" or "Controller"). It applies whenever Sitedote processes Customer Personal Data on Customer's behalf while providing the Services.
1.2 In this DPA:
1.3 Scope. This DPA covers Customer Personal Data only. Personal data about Customer's own account, billing and use of sitedote.com, for which Sitedote acts as a controller, is described in the Sitedote Privacy Policy and is not covered by this DPA.
1.4 Acceptance. Customer accepts this DPA when it accepts the Terms. No signature is required. If Customer needs a signed copy, it can request one at [email protected].
2.1 Roles. Customer is the controller (or, where it processes on behalf of its own clients, a processor) of Customer Personal Data, and Sitedote is the processor (or sub-processor). Under the CCPA, Customer is the business and Sitedote is the service provider.
2.2 Instructions. Sitedote will process Customer Personal Data only on Customer's documented instructions. The Terms, the Order, this DPA and Customer's use of the Services are Customer's complete instructions. Any further instruction must be given in writing to [email protected], and Sitedote may charge reasonably for instructions that go beyond the Services.
2.3 Purpose. Sitedote processes Customer Personal Data only to provide, secure, support and improve the Services for Customer, as further described in Annex A. Sitedote will not process it for its own purposes.
2.4 Unlawful instructions. Sitedote will tell Customer if it believes an instruction infringes Applicable Data Protection Laws. It may suspend the affected processing until the instruction is changed or confirmed.
2.5 Customer's responsibilities. Customer confirms that it has a lawful basis for the processing, has given all notices and obtained all consents required, and is entitled to give Sitedote access to the Customer Personal Data. Customer is responsible for the accuracy and legality of the data and for the way it acquired it. Customer will not give Sitedote special-category or highly sensitive personal data (for example payment card numbers in clear text or health records) unless it tells Sitedote in advance and Sitedote agrees in writing.
3.1 Sitedote will keep Customer Personal Data confidential and will give access only to personnel and contractors who need it to provide the Services.
3.2 Everyone with access is bound by written confidentiality obligations that continue after their engagement ends, and receives appropriate training on data protection and security.
4.1 Sitedote will implement and maintain appropriate technical and organisational measures to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of the processing. The measures in place at the date of this DPA are listed in Annex B.
4.2 Sitedote may update the measures from time to time, provided the update does not reduce the overall level of protection.
4.3 Customer is responsible for its own security choices, including the strength and confidentiality of the credentials it gives Sitedote, its own backups, and the security of its hosting environment.
5.1 General authorisation. Customer gives Sitedote general authorisation to engage Sub-processors to provide the Services. Sitedote does not publish its Sub-processors on the Site. The current list is available on request at [email protected].
5.2 Obligations. Sitedote will bind each Sub-processor by a written contract that imposes data protection obligations no less protective than those in this DPA, and remains responsible for the Sub-processor's performance.
5.3 Notice of changes. Sitedote will give Customer at least 30 days' notice before adding or replacing a Sub-processor, on the Site or by email.
5.4 Objection. If Customer does not approve a new or replacement Sub-processor, it may terminate the affected Services without penalty by giving written notice to [email protected] within 10 days of receiving Sitedote's notice, explaining its reasons. Sitedote will refund prepaid fees for the unused period. If the affected Services are part of a bundle or bundled purchase, the termination applies to the whole bundle.
6.1 Taking into account the nature of the processing, Sitedote will help Customer, by appropriate technical and organisational measures, to respond to requests from data subjects to exercise their rights (access, rectification, erasure, restriction, portability, objection, and rights under the CCPA).
6.2 If a data subject contacts Sitedote directly about Customer Personal Data, Sitedote will not respond on the substance, will redirect the person to Customer where it can identify Customer, and will notify Customer promptly, unless the law requires otherwise.
7.1 Sitedote will notify Customer without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data.
7.2 The notice will, to the extent known, describe the nature of the breach (including the categories and approximate number of data subjects and records concerned), the likely consequences, the measures taken or proposed to address it, and a contact point. Where not all information is available at once, Sitedote will provide it in phases.
7.3 Sitedote will take reasonable steps to contain and investigate the breach and will cooperate with Customer so that Customer can meet its own notification duties to authorities and data subjects.
7.4 A notice or Sitedote's response to a breach is not an admission of fault or liability. Customer is responsible for deciding whether and how to notify authorities and data subjects.
8.1 Assistance. Taking into account the nature of the processing and the information available, Sitedote will reasonably help Customer to meet its obligations on security, breach notification, data protection impact assessments and prior consultation with supervisory authorities.
8.2 Information. On written request, no more than once a year unless required by a supervisory authority or after a breach, Sitedote will give Customer the information reasonably needed to show compliance with this DPA, such as a description of its security measures and answers to a reasonable security questionnaire.
8.3 Audits. If that information is not enough to show compliance, Customer may audit Sitedote's compliance with this DPA once a year, on at least 30 days' written notice, during business hours, without disrupting Sitedote's business, and under confidentiality. The audit may be carried out remotely, by Customer or by an independent auditor bound by confidentiality who is not a competitor of Sitedote. Each party bears its own costs, and Customer reimburses Sitedote's reasonable costs of assistance beyond a normal level of effort. Nothing in this Section limits the rights of a supervisory authority.
8.4 Cost of assistance. Sitedote may charge reasonable fees for assistance beyond what is needed to comply with the Applicable Data Protection Laws, if the assistance requires significant effort.
9.1 Processing location. Sitedote is established in Bulgaria (EEA). Sitedote and its Sub-processors may process Customer Personal Data in the EEA and in other countries where they operate. The location of each Sub-processor is included in the list available under Section 5.1.
9.2 Transfers from the EEA. Where Customer Personal Data subject to the GDPR is transferred to a country outside the EEA that is not covered by an adequacy decision of the European Commission, the parties agree to the SCCs, which are incorporated into this DPA as follows: (a) Module Two (controller to processor) applies where Customer is a controller, and Module Three (processor to processor) applies where Customer is a processor; (b) Clause 7 (docking clause) applies; (c) in Clause 9, Option 2 (general authorisation) applies, with the notice period in Section 5.3; (d) in Clause 11, the optional language does not apply; (e) in Clause 17, the law of Bulgaria applies; (f) in Clause 18(b), the courts of Bulgaria have jurisdiction; (g) Annexes I and II of the SCCs are completed by Annexes A and B of this DPA, and the list of Sub-processors for Annex III is provided as set out in Section 5.1; and (h) the competent supervisory authority is the Commission for Personal Data Protection of Bulgaria, unless the data exporter is established in another EU member state, in which case it is the authority of that state.
9.3 Transfers from the UK. For Customer Personal Data subject to the UK GDPR, the SCCs as set out in Section 9.2 apply, as amended by the UK Addendum, whose Tables 1 to 3 are completed by this DPA and whose Table 4 allows either party to end the Addendum in accordance with its terms.
9.4 Transfers from Switzerland. For Customer Personal Data subject to the Swiss FADP, the SCCs apply with the following changes: references to the GDPR mean the Swiss FADP; references to an EU member state or the EU mean Switzerland; the competent supervisory authority is the Federal Data Protection and Information Commissioner; and data subjects in Switzerland may enforce their rights in Switzerland.
9.5 Conflict. If there is a conflict between the SCCs and this DPA or the Terms, the SCCs prevail. If the SCCs stop being a valid transfer mechanism, the parties will agree in good faith on an alternative.
9.6 Transfers by Customer. Customer is responsible for ensuring that it has a lawful basis to transfer Customer Personal Data to Sitedote.
10.1 This Section applies to the extent Customer Personal Data is "personal information" subject to the CCPA or another US state privacy law. Customer is the business (or controller) and Sitedote is the service provider (or processor).
10.2 Sitedote will not: (a) sell or share Customer Personal Data; (b) retain, use or disclose it for any purpose other than the business purposes specified in this DPA and the Terms, or as otherwise permitted by the CCPA; (c) retain, use or disclose it outside the direct business relationship between Sitedote and Customer; or (d) combine it with personal information that it receives from or on behalf of another person or collects from its own interaction with individuals, except as the CCPA permits.
10.3 Sitedote will comply with its obligations under the CCPA and give the same level of privacy protection as the CCPA requires. Sitedote will notify Customer if it decides that it can no longer meet its obligations under the CCPA.
10.4 Customer may take reasonable and appropriate steps to ensure Sitedote uses Customer Personal Data consistently with Customer's CCPA obligations, and, on notice, to stop and remediate unauthorised use. Sitedote will help Customer respond to verifiable consumer requests as described in Section 6.
10.5 Sitedote certifies that it understands and will comply with these restrictions. Customer discloses Customer Personal Data to Sitedote only for the limited and specified business purposes described in Annex A.
11.1 When the Services end, or earlier on Customer's written request, Sitedote will delete or return Customer Personal Data in its possession, at Customer's choice, within 30 days.
11.2 Sitedote may keep copies in routine backups for up to 90 days after deletion, after which they are overwritten. Those copies stay subject to this DPA and are not used for any other purpose.
11.3 Sitedote may keep Customer Personal Data for longer where the law requires, and will then protect it and process it only for that purpose.
11.4 On request, Sitedote will confirm in writing that deletion has been completed.
12.1 Liability. Each party's liability under this DPA is subject to the limitations and exclusions in Section 9 of the Terms, to the extent permitted by law. Nothing in this DPA limits liability that cannot be limited under the Applicable Data Protection Laws or the SCCs, or the rights of data subjects.
12.2 Term. This DPA takes effect on the Effective Date of the Terms and stays in force for as long as Sitedote processes Customer Personal Data. Sections that by their nature should survive (including Sections 7, 11 and 12) survive termination.
12.3 Changes. Sitedote may update this DPA to reflect changes in law or in the Services. For material changes it will give at least 30 days' notice, and Customer may cancel before the change takes effect as set out in the Terms.
12.4 Order of precedence. If there is a conflict on the processing of Customer Personal Data, the order is: (1) the SCCs (where they apply); (2) this DPA; (3) the Terms.
12.5 Governing law. This DPA is governed by the law that governs the Terms, except that the SCCs are governed as stated in Section 9.
12.6 Contact. Data protection questions and requests go to [email protected]. Edevos EOOD, 68 Saedinenie Str., Shumen, Bulgaria.
12.7 Related documents. This DPA is available at sitedote.com/dpa. It is read together with our Terms of Service, our Privacy Policy and our Cookie Policy.
| Item | Description |
|---|---|
| Data exporter (controller) | The Customer identified in the Order |
| Data importer (processor) | Edevos EOOD (Sitedote), UIC (EIK) 205573828, 68 Saedinenie Str., Shumen, Bulgaria. Contact: [email protected] |
| Subject matter | Provision of WordPress security, malware cleanup, repair and maintenance services for the Customer Sites |
| Nature of processing | Accessing, scanning, copying, backing up, restoring, modifying, storing and deleting Customer Site files and databases; monitoring and support |
| Purpose | To provide, secure and support the Services ordered by the Customer |
| Duration | The term of the Terms, plus the deletion period in Section 11 |
| Categories of data subjects | Customer's website visitors, users, customers, employees and other individuals whose data is stored on or collected through the Customer Sites |
| Types of personal data | Names, email addresses, phone numbers, postal addresses, usernames, hashed passwords, IP addresses, order and form data, and other data that the Customer Sites hold. No special-category data is intended (see Section 2.5) |
| Frequency of transfer | Continuous, for the duration of the Services |
| Retention | Deleted or returned as set out in Section 11 |
| Business purposes (CCPA) | Security and integrity of the Customer Sites; debugging and repair; maintenance and support; performing the Services |
| Competent supervisory authority | Commission for Personal Data Protection (Bulgaria), or as set out in Section 9.2 |
Last updated: 19 September 2026.
Sitedote does not publish its list of Sub-processors on the Site. Customers can request the current list, including the purpose and location of each Sub-processor, at [email protected].