Data Processing Agreement / GDPR Addendum

This Data Processing Agreement and GDPR Addendum (the “DPA“) forms part of the agreement between WPSoil (“WPSoil“, “we“, “us“, or “Processor“) and the client, agency, business, or website owner using our services (“Client“, “you“, or “Controller“).

This DPA applies when WPSoil processes personal data on behalf of a Client while providing WordPress, Kadence, Gutenberg, WooCommerce, website design, redesign, migration, speed optimization, local SEO, maintenance, Care Plan, or white-label agency services.

This DPA is intended to support GDPR, UK GDPR, and similar privacy compliance obligations where WPSoil acts as a processor or service provider. If a signed project agreement, platform order, or separate data protection document conflicts with this page, the signed or platform-specific document controls for that project.

---

1. Roles of the Parties

For most WPSoil service work, the Client is the Controller because the Client decides why personal data is collected, what data is collected, how long it is kept, and how it is used on the Client website. WPSoil acts as the Processor when we access or handle that personal data only to deliver the agreed services.

In some situations, WPSoil may act as an independent controller for our own business records, such as inquiries submitted to wpsoil.com, invoices, emails, project communication, portfolio permissions, direct client relationship records, fraud prevention, tax/accounting records, and legal compliance. Those activities are covered by our Privacy Policy, not this DPA.

2. Processing Details

WPSoil does not require sensitive personal data, health data, government ID numbers, financial account numbers, criminal records, children’s data, or special category data to provide standard website services. The Client must not provide such data unless it is strictly necessary, disclosed in advance, and covered by a written agreement.

3. Client Responsibilities as Controller

The Client is responsible for having a lawful basis to collect and use personal data on the Client website, publishing appropriate privacy/cookie notices, obtaining valid consent where required, responding to data subject requests, and ensuring that the data provided to WPSoil is lawful, accurate, relevant, and necessary.

The Client is also responsible for choosing and managing hosting, domain, email, CRM, payment, newsletter, booking, analytics, cookie banner, and third-party systems unless WPSoil is specifically hired to configure or support them. WPSoil is not responsible for the Client’s legal compliance, privacy notices, cookie consent setup, customer data collection, or third-party tools unless those duties are expressly included in the agreed project scope.

4. WPSoil Responsibilities as Processor

5. Sub-Processors and Third-Party Tools

The Client gives WPSoil general written authorization to use reputable sub-processors and third-party tools when reasonably necessary to deliver the services. These may include hosting providers, WordPress plugins, form tools, SMTP/email providers, analytics tools, backup tools, security tools, payment processors, project management tools, file storage tools, communication tools, and freelance platforms such as Fiverr or Upwork when the Client orders through those platforms.

WPSoil remains responsible for choosing appropriate tools for work under our control, but WPSoil is not responsible for third-party tools selected, owned, configured, or required by the Client. Where required, WPSoil will inform the Client of significant changes to sub-processors used for ongoing managed services, giving the Client a reasonable opportunity to object where legally required.

6. International Data Transfers

WPSoil may provide services remotely and may access Client systems from locations outside the Client’s country, including countries that may not have the same data protection rules as the Client’s jurisdiction. The Client is responsible for ensuring that any transfer of personal data to WPSoil is lawful under applicable privacy laws.

Where GDPR, UK GDPR, or similar laws require a transfer mechanism, the parties will use an appropriate mechanism such as Standard Contractual Clauses, a signed addendum, platform-provided terms, or another lawful transfer method. If the Client requires specific transfer terms, the Client must notify WPSoil before sharing personal data or granting access.

7. Security Measures

WPSoil applies practical security measures suitable for a remote WordPress service business. These measures may include:

8. Personal Data Breach Assistance

If WPSoil becomes aware of a confirmed or reasonably suspected personal data breach affecting Client personal data under WPSoil’s control, WPSoil will notify the Client without undue delay after becoming aware of it. The notice will include available information about the nature of the incident, affected systems or data where known, actions taken, and recommended next steps.

The Client remains responsible for determining whether a breach must be reported to a regulator, customer, user, or other person. WPSoil will provide reasonable assistance where the incident relates to services provided by WPSoil.

9. Audits and Compliance Information

Upon reasonable written request, WPSoil will provide information reasonably necessary to demonstrate compliance with this DPA. Any audit request must be proportionate, remote where possible, limited to systems and records relevant to the Client, and scheduled with reasonable notice.

Audits must not compromise WPSoil’s security, other clients’ confidentiality, trade secrets, internal systems, or unrelated business records. If an audit requires significant time, custom reporting, technical review, or third-party support, WPSoil may charge a reasonable fee agreed in advance.

10. Client Access and Credential Handling

When the Client provides admin, hosting, domain, email, CRM, analytics, payment, or plugin access, the Client should create separate user accounts where possible instead of sharing personal owner credentials. The Client should remove or change access after the project ends if ongoing support is not active.

WPSoil is not responsible for unauthorized access caused by weak Client passwords, reused credentials, missing two-factor authentication, compromised email accounts, insecure hosting, shared logins, or Client-side security failures.

11. WooCommerce, Forms, and Customer Data

For WooCommerce, booking, membership, CRM, newsletter, or contact form projects, WPSoil may temporarily access customer, order, lead, or user data while configuring, testing, troubleshooting, or supporting the website. WPSoil will not sell that data or use it for WPSoil marketing.

The Client remains responsible for its own customer privacy notices, checkout terms, payment compliance, tax compliance, email marketing consent, cookie consent, and any legal requirements connected to selling products or collecting leads.

12. Data Retention

WPSoil keeps project-related records only as long as reasonably needed for service delivery, support, dispute handling, accounting, tax, legal compliance, security, or business record purposes. Temporary files, backups, exports, credentials, and staging copies may be deleted after the project or support period unless retention is reasonably required.

The Client should not rely on WPSoil as the only storage location for website data, backups, content, media, credentials, or business records unless a written backup service is specifically included in a Care Plan.

13. Liability and Relationship to Main Agreement

This DPA does not expand WPSoil’s liability beyond the limits stated in the Terms of Service, Client Agreement, platform order, proposal, or signed agreement. If there is a conflict between this DPA and a mandatory privacy law requirement, the mandatory legal requirement will apply to the extent required.

This DPA is intended to support responsible data handling, but it does not replace legal advice. Clients with regulated data, high-risk processing, large customer databases, medical/health data, financial data, children’s data, or complex EU/UK privacy obligations should obtain advice from a qualified privacy professional.

14. Contact for Data Protection Questions

For privacy, data protection, GDPR, UK GDPR, or DPA questions, contact WPSoil at privacy@wpsoil.com or hello@wpsoil.com.

This document should be read together with our Privacy Policy, Terms of Service, Refund & Cancellation Policy, and Cookie Policy.