Data processing agreement

1. Roles

For the personal data in your sites’ records, you are the controller and WP Logbook is your processor. If you manage a site for a client, your client is usually the controller and you are their processor; we are then your sub-processor, and you may pass this agreement on to your client as proof of how we work.

For your own team’s account details (name, work email, logins to WPLogbook), we are the controller. That’s covered by our privacy statement, not by this agreement.

2. What we process, and why

We process personal data only to provide WPLogbook to you: recording what happens on your sites, showing it, alerting you, running the actions you choose, writing reports and running Tally. We do this for as long as your account runs, plus the deletion periods in section 10.

Per site, you can switch off recording IP addresses or query strings, and record WordPress user IDs instead of names. These settings are part of your instructions in section 3. A change applies from that moment on; to remove earlier entries about a person, use the erase function described in section 9.

We don’t process special categories of personal data (such as health data) and you shouldn’t configure WPLogbook to send them to us.

3. Only on your instructions

We process the data only on your documented instructions. Your settings in WPLogbook and the actions you take in it count as those instructions. If we believe an instruction breaks data protection law, we tell you. We never sell the data or use it for our own purposes, with one exception: you instruct us to turn it into anonymous, aggregated statistics for Update Weather and benchmarks, as described in section 8 of the terms of service. We remove personal data before anything is combined, and you can switch this off in your account settings.

4. Confidentiality

Everyone at WPLogbook who can access the data is bound to confidentiality, and only gets the access their work needs. Every access by our staff to a customer’s record is itself logged.

5. Security

We take appropriate technical and organisational measures to protect the data, described on our security page. They include encryption in transit and at rest, EU-only hosting, two-step verification for staff, least-privilege access and encrypted backups. We may improve these measures, never weaken them.

6. Sub-processors

You give us general permission to use sub-processors. The current list is on our security page. Every sub-processor is based in the EU and bound by the same obligations as we are. We tell you at least 30 days before we add or replace one; if you object for a good reason and we can’t solve it, you can end your account without cost.

7. No transfers outside the EU

We store and process the data only inside the European Economic Area. We don’t use providers that are subject to laws which could force them to hand data to authorities outside the EU without an EU legal process.

8. Tally and AI processing

• Tally only reads the record of your own sites, and only to do the work described in the terms.
• Tally runs on AI models hosted in the EU, through sub-processors on our list. They use the data only to return an answer, keep it for at most 30 days to detect abuse, and don’t use it to train models. Neither do we.
• Tally’s output is stored in your record, marked as written by Tally, and deleted with it.
• You can switch Tally off per site or for your whole account.

9. Data breaches and your obligations

If we discover a personal data breach that affects your data, we tell you without undue delay and at the latest within 24 hours, so you can meet your own 72-hour deadline. We tell you what happened, which data and people are affected, what we’ve done and what you may need to do.

We help you answer requests from people who want to see, correct or delete their data. WPLogbook lets you find every entry about a person and erase or export it yourself. We also help, where reasonable, with data protection impact assessments.

10. Retention and deletion

• Entries are kept for the history period of your plan, then deleted, unless you export them first.
• When your account ends, we delete the data within 30 days of the export window closing. Encrypted backups are overwritten within a further 90 days.
• Our record is tamper-evident: entries are chained so a gap or an edit shows. Personal data is stored separately from that chain, so we can erase a person’s data on request without breaking the proof that the rest of the record is intact.

11. Checks and audits

We give you the information you need to show we meet this agreement. Once a year, or after a breach, you may have an independent auditor check our compliance, with at least 30 days’ notice, during working hours and under confidentiality. The audit is at your cost, unless it shows we fall seriously short.

12. Liability and duration

Liability under this agreement follows the terms of service. This agreement runs for as long as we process personal data for you. If it conflicts with the terms of service, this agreement wins on anything to do with personal data.

WPLogbook is a service of WP Logbook, Pastoor Jansstraat 5, 6658 AZ Beneden-Leeuwen, the Netherlands, registered with the Dutch Chamber of Commerce (KvK) under number 84342145. Questions about this agreement: privacy@wplogbook.com.