Website
Data Processing Agreement — Website Hosting and Mailbox Services
WebsitePublisher.ai · legal entity: M25 · Version 1.2 · 4 November 2026
This agreement applies to website hosting, forms, DNS and mailboxes on WebsitePublisher.ai. To put it in place for your account, sign it and return it to privacy@websitepublisher.ai; we countersign. How we process the data in practice is described in the privacy factsheet. The Email Archive add-on has its own agreement.
Parties
Controller (the Customer)
Name: ............................................................
Address: .........................................................
Company number: ..................................................
Represented by: ..................................................
Processor (M25)
M25 · Brandemaat 78, 7943 EX Meppel, Netherlands · KvK 04072374 · VAT NL001629875B23
Trading as WebsitePublisher.ai
Privacy contact: privacy@websitepublisher.ai
Recitals
- M25 provides website hosting, form handling, DNS and mailbox hosting (the Services).
- In doing so M25 processes personal data on behalf of the Customer.
- The Customer is controller and M25 is processor within the meaning of Article 28 GDPR and, where the Customer is established in the United Kingdom, Article 28 UK GDPR.
- This agreement records the terms required by Article 28(3).
Article 1 — Subject and duration
1.1 M25 processes personal data only to provide the Services and only on the Customer's documented instructions. Use and configuration of the Services by the Customer constitute such instructions.
1.2 This agreement runs for as long as M25 provides the Services and ends with the main agreement, except for provisions that by their nature survive.
Article 2 — Nature and purpose of processing
2.1 Categories of data subjects: visitors of the Customer's website; persons who submit a form; senders and recipients of e-mail in the Customer's mailboxes; the Customer's staff.
2.2 Categories of personal data:
| Service | Data |
|---|---|
| Website hosting | IP address, user agent, requested URLs and timestamps in server logs; personal data the Customer places in site content |
| Forms (only if configured) | The fields the Customer defines, plus submission time and IP address |
| Mailbox | Full content and metadata of e-mail messages, including attachments |
| DNS | Zone records set by the Customer |
2.3 The Customer determines the content of its website, forms and mailboxes. M25 does not filter for special categories of data and cannot do so.
2.4 M25 does not use the data for its own purposes, including training or improving models, cross-customer analysis or product development.
Article 3 — Customer responsibilities
3.1 The Customer ensures a lawful basis for the processing, including for any forms, analytics or tracking scripts it adds to its website, and for informing visitors (privacy notice, cookie consent where required).
3.2 Services the Customer connects itself — its own API keys for third-party services, external AI assistants, DNS records pointing to other providers — are outside this agreement. The Customer contracts those providers directly.
3.3 Third-party resources included in the website's code (for example web fonts, embeds or scripts loaded from another provider) are loaded by the visitor's browser directly from that provider. They are not sub-processors of M25.
Article 4 — Confidentiality and security
4.1 M25 ensures that anyone authorised to process the data is bound by confidentiality.
4.2 M25 takes appropriate technical and organisational measures (Article 32), including: encrypted transport (TLS) for websites, mail protocols and storage connections; private network between application servers; rate limiting at the web server; per-project access control on all APIs; integration credentials stored in a separate vault rather than in site code.
4.3 Access by M25. M25 is a small organisation. The owner holds administrative access to all systems; separation of duties is not possible. M25 accesses content only for fault investigation, security incidents, or at the Customer's request.
Article 5 — Sub-processors
5.1 The Customer gives general authorisation for the sub-processors below. M25 informs the Customer at least thirty days before adding or replacing a sub-processor; the Customer may object and, failing agreement, terminate the affected Service.
5.2 Sub-processors at signing:
| Party | Role | Location |
|---|---|---|
| Hetzner Online GmbH | Mail servers, mailbox object storage, database backup copy | Germany (Falkenstein) |
| DigitalOcean LLC | Application servers, load balancer, databases, file storage, database backups | Netherlands (Amsterdam) |
| BunnyWay d.o.o. (Bunny.net) | CDN delivery of website files; cached files up to one month | Slovenia; worldwide edge network |
| Resend, Inc. | Platform e-mail to the Customer's account address | United States |
| Openprovider (Hosting Concepts B.V.) | Domain registration, only if domain registered via M25 | Netherlands |
| Anthropic, PBC | AI assistant (Claude) used by M25's team when it looks into a project: support at the Customer's request, abuse review, aftercare of site imports | United States |
| OpenRouter, Inc. | Cloud language models for AI build jobs, only when the Customer runs such a job on a cloud model; the provider of the selected model processes behind it | United States |
5.3 M25 imposes on each sub-processor obligations equivalent to those in this agreement and remains liable to the Customer for their performance.
Article 6 — International transfers
6.1 Website and mailbox data are processed and stored within the EEA.
6.2 For Customers in the United Kingdom: the EEA is recognised as adequate under UK data protection law, so processing by M25 in the EEA requires no additional transfer mechanism.
6.3 Four sub-processors process data outside the EEA:
- Resend, Inc. (platform e-mail to the Customer's account address): certified under the EU-U.S. Data Privacy Framework and its UK Extension.
- Bunny.net (CDN): a visitor outside Europe is served from an edge location near that visitor, where the request (IP address, user agent, URL) is processed.
- Anthropic, PBC (AI assistant of M25's team): what the team reads for a request is processed in the United States. The transfer basis is being put in place; until then M25 works with masked data wherever possible.
- OpenRouter, Inc. (cloud language models): the instruction and page content of an AI build job the Customer runs on a cloud model are processed in the United States. The transfer basis is being put in place.
Article 7 — Data subject rights
7.1 The Customer can view, export and delete its website content, form records and e-mail through the Services.
7.2 If M25 receives a request directly from a data subject, M25 refers it to the Customer without undue delay.
Article 8 — Retention and deletion
8.1 Data is kept for as long as the Customer keeps it in the Services. The platform imposes no retention period on content, form records or e-mail.
8.1a A page, fragment or public file that the Customer deletes is kept in a private trash for 30 days, so that the Customer can restore it, and is then deleted together with its version history. Private files are deleted immediately.
8.2 Web server access logs are kept for approximately ten days and application logs for approximately seven days, and then removed by rotation.
8.3 On termination M25 deletes website content, form records and mailboxes within 30 days, unless the Customer requests an export first. Database backup copies expire within 90 days after that. The mechanism that enforces this expiry is being implemented; M25 confirms to the Customer on request once it is in place.
8.4 Mailbox storage has no backups; deletion of a message by the Customer is final.
8.5 On request, M25 confirms deletion in writing.
Article 9 — Personal data breaches
9.1 M25 notifies the Customer without undue delay and in any case within 24 hours of becoming aware of a personal data breach affecting the Customer's data.
9.2 The notification includes, as far as known: the nature of the breach, categories and approximate numbers of data subjects and records, likely consequences, and measures taken or proposed.
9.3 The Customer decides on notification to the supervisory authority and data subjects. M25 cooperates.
Article 10 — Assistance and audit
10.1 M25 assists the Customer, taking into account the nature of the processing and the information available to M25, with data protection impact assessments and consultations with the supervisory authority.
10.2 M25 makes available the information necessary to demonstrate compliance: this agreement, the privacy factsheet and the sub-processor list. This documentation is the same for all customers and is published at websitepublisher.ai/legal.
10.2a The content and configuration of the Customer's website, forms and mailboxes are determined by the Customer and visible in its dashboard. Assessing them is the Customer's responsibility as controller and is not part of M25's assistance.
10.3 The Customer may, at most once a year and with thirty days' notice, have compliance audited by an independent expert bound by confidentiality. Costs are borne by the Customer unless the audit reveals a material breach by M25.
10.4 Requests for information beyond the documentation in 10.2, including questionnaires and customer-specific assessments, are handled as an audit under 10.3 and charged at M25's hourly rate of USD 100 excluding VAT. M25 provides a cost estimate before starting.
Article 11 — Liability
11.1 The liability provisions of the main agreement apply, except that limitations do not apply to intent or gross negligence.
Article 12 — Final provisions
12.1 In case of conflict, this agreement prevails over the main agreement as regards the processing of personal data.
12.2 Dutch law applies. Disputes are submitted to the competent court in the district where M25 is established.
Signatures
| Customer | M25 |
|---|---|
| Name: | Name: |
| Title: | Title: |
| Date: | Date: |
| Signature: | Signature: |
Version 1.2 replaces version 1.1 (26 October 2026). Changes: Anthropic and OpenRouter added as sub-processors (5.2) with their transfers (6.3); 10.2 now points to websitepublisher.ai/legal.