Data processing agreement

Last updated 11 October 2026

When we host and run a website for you, some personal data passes through our hands on your behalf: the messages people send through your contact form, for example. This agreement sets out how we handle that data, as required by Art. 28 of the GDPR.

It is part of our Terms and applies automatically once you accept our offer. For anything to do with data protection, this agreement takes precedence over the Terms. You are the controller, and Spectrum IT Solutions GmbH, Kurbadstraße 8/1604, 1100 Vienna, Austria (“we”) is your processor.

1. What we process and why

We process personal data only to host, maintain and update your website and to deliver the messages sent through its contact form.

  • Visitors to your website: technical data of each request, such as the IP address, the time, the page requested and browser information.
  • People who use your contact form: whatever they enter, usually a name, an email address, a phone number and a message.
  • People shown on your website: names, photos and other details you give us to publish, for example of your team.

Contact form messages are passed straight on to your inbox. We do not keep a copy. Technical logs are deleted automatically after at most 7 days. The content of your website, including any personal data in it, is kept for as long as the website runs, together with its version history.

This agreement runs for as long as our contract does, and ends with the handover and deletion described in section 9.

2. Your instructions

We process the data only on your documented instructions. These are the contract itself and anything you ask of us in writing, for example by email. If we believe an instruction breaks data protection law, we tell you. If EU or Austrian law requires us to process data in another way, we tell you before we do, unless the law forbids it.

3. Confidentiality

Everyone at Spectrum IT who can access the data is bound to confidentiality, including under § 6 of the Austrian Data Protection Act (DSG). Access is limited to the people who need it to do the work.

4. Security

We protect the data with the technical and organisational measures in the annex below, in line with Art. 32 GDPR. We may improve these measures over time, but never lower the level of protection.

5. Sub-processors

You authorise us to use the sub-processors listed below. We bind each of them by contract to data protection obligations equivalent to this agreement, and we remain responsible to you for their work.

  • Cloudflare, Inc., San Francisco, USA: hosting and delivery of your website, security, delivery of contact form messages, technical logs.
  • GitHub, Inc., San Francisco, USA: storage of your website’s files and their version history, and publishing changes.
  • Anthropic PBC, San Francisco, USA: AI assistance when we build and change websites, which can include material you send us.
  • Google Cloud EMEA Limited, Dublin, Ireland, and Google LLC, Mountain View, USA: shared folders for exchanging documents and files with you (Google Drive), and AI tools for creating and editing images (Gemini).

We may also use AI image tools from other providers, such as Midjourney, to create images for your website. We never send them photos of people or any other personal data.

We tell you at least 30 days before we add or replace a sub-processor. You can object on reasonable data protection grounds. If we cannot find a solution together, you can end the contract when the change takes effect, and we refund the unused part of the current subscription year.

6. Transfers outside the EU

Personal data is transferred outside the EU and EEA only to the sub-processors listed above. These transfers rely on the providers’ certification under the EU-US Data Privacy Framework or on the EU Standard Contractual Clauses in their data processing terms.

7. How we help you

  • If someone contacts us to exercise their data protection rights about data on your website, we forward the request to you without delay and help you answer it as far as our service allows.
  • We help you meet your obligations on security, data breaches, data protection impact assessments and consultations with the authority (Art. 32 to 36 GDPR), taking into account what we can know as your processor.
  • If we become aware of a personal data breach affecting your data, we tell you without undue delay and within 48 hours at the latest, with the information we have at that point.

8. Proof and audits

We give you the information you need to show that this agreement is being kept. You, or an auditor bound to confidentiality, may inspect our compliance with 30 days’ notice, during business hours and at your own cost, at most once a year unless there has been a breach. Certifications and audit reports of our sub-processors, such as ISO 27001 or SOC 2, may serve as evidence.

9. When the contract ends

After the handover described in our Terms, we delete the personal data we processed on your behalf within 30 days, including copies in version history, unless the law requires us to keep it. Technical logs expire on their own.

10. Final provisions

This agreement is concluded in electronic form, which satisfies Art. 28(9) GDPR. Austrian law applies, and the court with subject-matter jurisdiction in Vienna has exclusive jurisdiction. If a clause is invalid, the rest remain in force.

Annex: technical and organisational measures

  • Access: only the people who need access have it, through their own password-protected accounts. Each website and tool uses its own keys with the minimum permissions.
  • Encryption: all traffic to and from your website and our admin tools is encrypted (HTTPS). Contact form messages are sent as authenticated email.
  • Data minimisation: no database of form messages, no analytics and no tracking cookies by default. Technical logs are deleted after at most 7 days.
  • Integrity and availability: every change is kept in version history and can be undone within minutes. Websites run on Cloudflare’s global network with protection against attacks.
  • Separation: each client website has its own repository and its own configuration.
  • Organisation: confidentiality obligations for everyone with access, changes only on written request, and a review of sub-processors before we use them.