1. When this applies
This Data Processing Addendum ("DPA") applies where 3TS Group LLC (dba 99websites.co) ("Processor," "we") processes Personal Information on behalf of a Client ("Controller," "you") in providing the service — principally the delivery and storage of contact-form submissions from your website's visitors. It does not apply to information we control as described in our Privacy Policy.
2. Definitions
"Personal Information," "Controller," "Processor," "Process," and "Data Subject" have the meanings given by applicable U.S. state privacy law. "Applicable Law" means the privacy and data-protection laws of the United States and its states that apply to the processing.
3. Roles of the parties
For form submissions and other visitor data collected through your website, you are the Controller and we are the Processor. You are responsible for the lawfulness of the data you collect, for your own privacy notice to your visitors, and for having a lawful basis to collect and use the data.
4. Processing on your instructions
We will process Personal Information only: (a) to provide and support the service; (b) as further documented in the Terms, this DPA, and your configuration choices; and (c) as required by law, in which case we will inform you unless legally prohibited. We will not sell Personal Information, retain it for our own purposes, or combine it with other data except to provide the service. If we believe an instruction violates Applicable Law, we will tell you.
5. Confidentiality
We limit access to Personal Information to personnel and contractors who need it to provide the service and who are bound by confidentiality obligations.
6. Security
We maintain technical and organizational measures appropriate to the risk, including encryption in transit and at rest, access controls, network protection, rate-limiting and abuse prevention, logging, and routine backups. Details are in our Privacy Policy §10. You are responsible for security on your side, including protecting any credentials and securing devices used to access leads.
7. Subprocessors
You authorize us to engage the subprocessors listed at 99websites.co/subprocessors. Each subprocessor is bound by terms no less protective than this DPA for the processing it performs. We remain responsible for their performance. We will update the list before adding a subprocessor for a material new purpose; you may object on reasonable data-protection grounds, and if we can't resolve the objection you may terminate the affected service.
8. Assisting you
Taking into account the nature of the processing, we will provide reasonable assistance to help you: (a) respond to Data Subject requests to access, correct, or delete their data — noting that you can retrieve and manage form submissions directly through your project; (b) meet your security, breach-notification, and assessment obligations. Assistance beyond routine support may be chargeable at our then-current rates.
9. Breach notification
We will notify you without undue delay, and in any case within 72 hours, after becoming aware of a confirmed breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of Personal Information we process for you, and will provide the information you reasonably need to meet your own notification obligations.
10. Return & deletion
On termination of the service, or on your written request, we will delete Personal Information we process on your behalf within 60 days, except where retention is required by law or the data exists only in routine backups, which are deleted on their normal cycle (see Privacy Policy §9). On request before deletion we will make the form-submission data available to you for export.
11. Records & audits
We will keep records of our processing and make available, on reasonable written request and no more than once per year, the information reasonably necessary to demonstrate compliance with this DPA. Given the scale of the service, this will normally take the form of written responses and our security documentation rather than an on-site audit.
12. Liability
Each party's liability under this DPA is subject to the limitations and exclusions in the Terms of Service. This DPA does not increase either party's aggregate liability beyond that cap.
13. How to put this in place
This DPA is automatically incorporated into your agreement with us when your website collects Personal Information from visitors. If your business needs a countersigned copy, email privacy@99websites.co with "DPA request" and your business details, and we'll arrange it.