Data Processing Agreement.

Last updated: 3 November 2026

Annex to the Terms of Service

1. Parties and order of precedence

1.1 The controller is the business that ordered the website (name, address and email as given in the order). The processor is Moritz Reiß, trading as Kettlebury, Hofmatte 20, 79232 March, Germany, hello@kettlebury.com (“we”).

1.2 This DPA is an annex to and part of our Terms of Service. If it conflicts with the Terms, this DPA prevails.

2. What we process, for how long and why

2.1 Subject matter: hosting your website under clause 2 of the Terms, including maintenance, small changes and, if you switch it on in onboarding, forwarding contact form messages to you.

2.2 Duration: from the start of the contract until deletion under section 9, at the latest 30 days after the contract ends (Terms clause 8). Backups expire as set out in Schedule 2.

2.3 Nature and purpose: storing, serving, logging, backing up and deleting; receiving and forwarding form messages by email if switched on. We do this only to deliver your website, keep it secure and pass enquiries to you.

2.4 Data subjects, data categories and sensitive data: Schedule 1.

3. Instructions

3.1 We process personal data only on your documented instructions. Your instructions are the Terms, this DPA and your onboarding answers (for example whether the contact form sends messages). You can give further instructions by email.

3.2 If EU or German law requires us to process data differently, we tell you first unless that law forbids it.

3.3 If we believe an instruction breaks data protection law, we tell you straight away and may pause it until you confirm or change it. If you insist on an unlawful instruction, we may end the contract.

3.4 We do not use data from your website (logs, form messages) for our own purposes, including our own visitor statistics.

4. Confidentiality and security

4.1 Only Moritz Reiß has access. Anyone we bring in later commits to confidentiality first, in writing, and gets only the access their task needs.

4.2 We apply at least the security measures in Schedule 2. We may replace a measure with an equivalent or better one and update Schedule 2, but never lower the level of protection.

5. Sub-processors

5.1 You authorise the sub-processors listed in Schedule 3.

5.2 We tell you by email at least 4 weeks before adding or replacing a sub-processor, with its name, location and task. Posting the change on our website alone is not enough.

5.3 You may object by email within that period. If we cannot find a solution, you may end the contract when the change takes effect. On the yearly plan we then refund the unused part pro rata.

5.4 Each sub-processor is bound by contract to essentially the same data protection obligations as in this DPA, and we remain fully responsible to you for it.

6. Transfers outside the EU

6.1 Your website files and logs are stored in the EU, with replicas in the region named in Schedule 3, and served through a worldwide CDN.

6.2 Data we send back to you (form messages, log extracts you ask for) leaves the EU, because you are outside it.

• New Zealand: this is covered by the EU adequacy decision for New Zealand.
• Australia and the United States: the EU Standard Contractual Clauses for transfers, Module Four (processor to controller), Commission Implementing Decision (EU) 2021/914, are incorporated into this DPA by reference. We are the data exporter and you are the data importer. The details in Schedules 1 to 3 complete their annexes. If they conflict with this DPA, the Clauses prevail.

7. Helping you with requests and incidents

7.1 Requests from individuals: if someone asks us for access, deletion or similar, we pass it to you promptly and do not answer it ourselves unless you ask us to. We help you answer, for example by finding or deleting log entries for an IP address.

7.2 Data breach: if we become aware of a breach affecting your data, we tell you without undue delay and within 48 hours by email. We include what happened, the kinds of data and the approximate number of people and records affected, a contact point, the likely consequences and what we have done or propose. We send anything still missing as soon as we know it.

7.3 We give you the information we have if you need it for a privacy impact assessment or to consult a regulator.

8. Your responsibilities and rights

8.1 You are responsible for your website having a lawful basis for processing and an accurate privacy notice. We provide the text as part of the website and you confirm it in onboarding.

8.2 You tell us promptly if you notice anything wrong with the processing.

8.3 You may give instructions (section 3), object to sub-processors (section 5), ask for evidence and audits (section 10) and choose deletion or return at the end (section 9).

9. Deletion or return at the end

9.1 When the contract ends, you may ask for a copy of your website content until 30 days after the end date; after that, deletion applies.

9.2 We delete the website, logs and form data within 30 days after the contract ends. Backups expire under Schedule 2. On request we confirm deletion by email.

10. Evidence and audits

10.1 On request we give you the information you need to check that we comply: the current Schedule 2, our sub-processor terms and written answers.

10.2 You may audit at reasonable intervals or when there are signs of non-compliance, yourself or through an auditor bound to confidentiality, with 14 days’ notice. Our server sits in a data centre run by our sub-processor; there, their certifications and reports replace an on-site visit. Each side bears its own costs.

10.3 Changes to this DPA follow clause 13 of the Terms: at least 4 weeks’ notice by email, with the right to object.

Schedule 1: Description of the processing

Data subjects: 1. Visitors to your website. 2. People who write via the contact form (only if switched on). 3. People named or shown on the website: you, your staff, review authors (first name or initials), people in photos.

Data: 1. Server logs: IP address, date and time, page, referrer, browser identifier, status code. 2. Form messages: name, phone, email, message. 3. Website content: names, photos, contact details and review excerpts you supplied or confirmed.

Not used: Cookies, analytics, tracking, third-party embeds (unless you chose the map embed, which the privacy notice then names).

Sensitive data: Not intended. For health businesses, visitors may still type health details into a form message. Safeguards: a note on the form not to send health details, encrypted transfer, no storage on the web server after forwarding.

Retention: Logs: up to 30 days at our server. Form messages: until forwarded. Content: the contract term plus up to 30 days. Backups: Schedule 2.

Schedule 2: Security measures

1. Servers in EU data centres (Germany, Slovenia/EU storage; CDN worldwide).

2. Server login by SSH key only, password login off, firewall and fail2ban on, automatic security updates.

3. https/TLS only. Form messages forwarded over SMTP with TLS.

4. No disk-level encryption on the origin server; the website content is public anyway, and logs and form messages are protected by measures 1 to 3.

5. Backups: daily restic backup, encrypted client-side, to a Hetzner Storage Box (Hetzner Online GmbH, Germany); retention 30 days. A restore is tested at least once a quarter.

6. No cookies or tracking; logs limited to the fields in Schedule 1.

7. Logs deleted after 30 days at the latest.

8. Only the owner has access. AI tools and scripts do not read logs or form messages from customer sites unless their provider is listed in Schedule 3.

9. Measures reviewed at least once a year and after any incident.

Schedule 3: Authorised sub-processors

• BunnyWay d.o.o., Dunajska cesta 165, 1000 Ljubljana, Slovenia. Where: storage in Germany, with a replica in Sydney (NZ, AU) or New York (US); CDN: worldwide edge locations. Task: website hosting and delivery, CDN logs. When: always.
• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Where: Germany. Task: server for the contact form and backups. When: always (encrypted daily backups); also for form messages if the form sends messages.
• Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, Ireland (with Anthropic PBC, USA). Task: AI assistance for editing website texts and photos you supply. When: only when we make changes. Transfer to the USA: EU-US Data Privacy Framework or Standard Contractual Clauses.