Data processing agreement

In force from 12 October 2026. Last revised 12 October 2026.

Parties and scope

This data processing agreement ("DPA") is between the team that uses PagesPrinter ("you", the controller) and Wonop ApS, Klokagervej 26, 9800 Hjørring, Denmark ("we", the processor). It is part of the terms of service and applies from the moment your team accepts them.

It covers the personal data that your site collects or holds through PagesPrinter, about your visitors, contacts, members and buyers, and any personal data in the content you upload ("your personal data"). It applies to processing subject to the EU General Data Protection Regulation (GDPR), the UK GDPR and other data protection laws that require these terms. It doesn't cover the data we use as controller about the people in your team, which our privacy policy describes.

If this DPA and the terms conflict about personal data, this DPA prevails. If the standard contractual clauses apply (see Transfers), they prevail over both.

Roles and instructions

You are the controller of your personal data and we are your processor. You decide what your site collects and why, and you are responsible for having a lawful basis, for telling your visitors about it, and for the lawfulness of your instructions.

We process your personal data only on your documented instructions, unless the law requires otherwise; if it does, we tell you first unless the law forbids that. Your instructions are these terms, this DPA, and what you set up and do in PagesPrinter: the forms, sign-ups, apps and settings you configure, the actions you take in the dashboard, the API or MCP, and the requests you send to support. If we believe an instruction breaks data protection law, we tell you.

Annex 1 describes the processing.

Our obligations

Confidentiality. Everyone we authorise to process your personal data is bound by confidentiality, and only staff who need it for their work have access.
Security. We take the technical and organisational measures in Annex 2, and we keep them appropriate to the risk as the service changes. We may change them as long as the overall level of protection does not go down.
Helping you with requests. PagesPrinter lets you find, export and delete the data of a contact yourself, and see the orders and access of each buyer. If a person asks us directly about your personal data, we pass the request to you and don't answer it ourselves unless you ask us to. Where you need more help to answer a request, we give it, taking into account the nature of the processing.
Helping you with your own obligations. We give you the information you reasonably need for a data protection impact assessment or a prior consultation with an authority, about the processing we do.
Personal data breaches. We tell you without undue delay, and in any case within [48] hours, after we become aware of a breach affecting your personal data. We tell you what we know about its nature, the categories and approximate number of people and records involved, the likely consequences and the measures we have taken or propose. We send further details as we learn them and help you notify the authority and the people affected where you must.

Sub-processors

You give us general authorisation to use sub-processors. The current list is on our sub-processors page, which is Annex 3 of this DPA.

We give you at least 30 days' notice before we add or replace a sub-processor, by updating that page and emailing your team's Owners. You can object on reasonable grounds relating to data protection within that period, by writing to privacy@pagesprinter.com. We will then discuss it with you in good faith. If we can't address your objection, you may end your use of the affected part of the service, or the terms, without penalty, and we refund any fees you paid for the period after it ends.

We put a written agreement in place with each sub-processor with data protection obligations at least as protective as this DPA, and we remain responsible to you for their performance.

Transfers

Your personal data is stored and processed in the European Union. Some sub-processors may process it outside the European Economic Area, as listed in Annex 3. Where they do, and the country has no adequacy decision, the transfer relies on the EU-US Data Privacy Framework where the recipient is certified, or on the standard contractual clauses adopted by the European Commission (Decision (EU) 2021/914), with the additional safeguards the recipient offers.

If you are outside the European Economic Area and our processing for you is itself a transfer that needs safeguards, the standard contractual clauses, module two (controller to processor), are incorporated into this DPA, with these choices: clause 7 (docking) applies; under clause 9 the general authorisation and notice period above apply; the option in clause 11 does not apply; clauses 17 and 18 choose the law and courts of Denmark; Annex I is Annex 1 of this DPA, Annex II is Annex 2 and Annex III is Annex 3. [Confirm whether a UK addendum is needed.]

Deletion and return

You can download your site's files through the API and export contacts and answers as CSV at any time while your account exists.

When you delete a contact, a site or your account, we delete the related personal data as described in the terms:

a site with no buyers and no licence keys in use is deleted at once, with its files and its visitors' data;
a site with buyers closes and is deleted 90 days later, so buyers keep access to what they bought for that time;
licence key records for keys in use stay for up to 24 months, so that your customers' software keeps working;
when a contact is deleted, we keep only a hash of their address, so that they are not mailed again.

Copies in backups are deleted as the backups expire, [within 30 days]. We keep personal data longer only where the law requires us to, and then only for that purpose.

Audits

We make available to you the information you reasonably need to show that we meet our obligations under Article 28 GDPR, such as this DPA, our security measures and our sub-processors' certifications. If that is not enough, you may audit us, or have an independent auditor bound by confidentiality do so, once a year, with at least 30 days' notice, during business hours and at your cost, in a way that does not disrupt the service or expose other customers' data. An audit an authority requires is not limited to once a year.

Liability and term

Each party's liability under this DPA is subject to the limits in the terms, except where the law does not allow it. This DPA lasts as long as we process your personal data for you.

Annex 1: Details of the processing

Controller. The team that uses PagesPrinter; its contact is the team's Owners, at the email address of their account.

Processor. Wonop ApS, Klokagervej 26, 9800 Hjørring, Denmark. Contact: privacy@pagesprinter.com. Data protection officer: none is appointed; write to privacy@pagesprinter.com.

Subject matter and duration. Hosting your site and running its apps, for as long as you use PagesPrinter, plus the deletion periods above.

Nature and purpose. Storing, serving, organising, sending mail from fixed templates, checking for abuse, and deleting personal data, to provide PagesPrinter to you as described in the terms: forms and sign-ups, contacts and newsletter consent, member sign-in, posts, pages, books and courses, sales, memberships and licence keys, and the files you host.

Categories of data subjects. Visitors of your site; people who fill in your forms or sign up; your contacts and newsletter subscribers; your members; your buyers and subscribers; users of software that activates your licence keys; people who appear in the content you upload.

Categories of personal data.

Feature	Personal data
Forms and sign-ups	The answers you ask for (which may include names, email addresses and free text), the page the form was on, spam signals, and a code derived from the IP address with a key that changes daily (removed after 7 days)
Contacts and consent	Email address, name, first source, confirmation and stop dates; the consent wording agreed to, against a hash of the address
Members	Email address; sign-in codes and links (deleted after 24 hours); access granted and its source; lessons completed; download counts
Buyers and subscribers	Email address, Stripe customer ID, billing country, amounts, orders, subscriptions, invoices, refunds and dispute status
Licence keys	The key in encrypted and hashed form; for each activation, the name the software sends, a hash of the device fingerprint, and activation and last-seen dates
Mail	Recipient address (removed after 30 days), message kind and delivery status; hashes of addresses that bounced, complained or asked to stop
Hosted content	Whatever personal data you choose to publish in your site's files
Network	IP addresses and request details, processed by our network provider and infrastructure to deliver and protect your site

Special categories. None are intended. Your forms must not ask for them unless you have a lawful basis and tell the visitor (see the acceptable use policy).

Frequency. Continuous, while your site is online.

Retention. As set by you and described in the privacy policy: for example, unfinished answers 7 days, spam 30 days, finished answers for the keep-time you choose (by default 24 months, or 12 months unless you say the answers are not sensitive).

Annex 2: Technical and organisational measures

Hosting and location

All servers, the database, file storage, queues and email run with Scaleway in Amsterdam, the Netherlands.
Files are kept in a private storage bucket, under a separate prefix for each team and site; visitors reach them only through our edge server.
[Confirm and state encryption at rest for the managed database and object storage, and the database backup schedule and retention.]

Encryption and minimisation

All traffic to PagesPrinter and to hosted sites uses TLS.
Sign-in codes are stored only as Argon2 hashes; API keys and invitation tokens only as SHA-256 hashes.
Licence keys are stored encrypted, with a keyed hash for lookup; device fingerprints only as keyed hashes.
Instead of visitors' IP addresses we store, for 7 days, a code derived with a key that changes daily.
Suppression lists keep hashes of addresses, not the addresses.
Recipient addresses are removed from mail records after 30 days, and sign-in codes and purchase links are removed from sent messages after 30 minutes and 1 day.
Unfinished uploads, expired sign-in codes and sessions are removed automatically.

Separation of customers and of content

Previews are served on a separate registrable domain (pagesprinter.page) and production on the customer's own domains, so a hosted page never shares an origin or cookies with the dashboard.
The dashboard's session cookie is scoped to pagesprinter.com only.
Cookies on hosted sites use the __Host- prefix, so they are bound to that one site.
Every query is scoped to the team that owns the data.
Our servers fetch outside addresses (fonts, brand import, link checks) through a guard that refuses internal and private network addresses.

Access control

People sign in with one-time codes sent by email.
Team roles decide who may invite people, create keys, accept terms or delete sites.
API keys carry scopes and can be revoked at any time.
Deleting a site and refunding a buyer need a confirmation from the Owner's email.
PagesPrinter staff actions on customer content (takedowns, limits, report handling) are limited to named staff accounts and need a fresh emailed code each time.
Production secrets are kept outside the source code.

Integrity and accountability

Every change to a site is logged with who made it and through which channel.
Production releases are immutable, and earlier releases can be restored instantly.
Changes to PagesPrinter go through code review, automated tests and policy checks before release.

Abuse prevention

Rate limits on sign-in, forms, reports and the licence service.
Outside links and new domains are checked against Google Web Risk.
Uploaded files are scanned for malware when our scanner is running ([confirm it is active before publishing]).
A site's mail pauses automatically when its bounce or complaint rate is too high.
New teams have limits on how much mail they can send.
One-click unsubscribe in every message.

Availability

Services run in a managed Kubernetes cluster with automatic restarts.
[State the database backup and restore procedure once confirmed.]

People and incidents

Staff with access are bound by confidentiality.
Access is removed when it is no longer needed.
We have a process for reports and takedowns and for personal data breaches, including notifying controllers as set out above.

Annex 3: Sub-processors

The sub-processors, what they do and where are listed on our sub-processors page, which forms this annex.