Data Processing Addendum

Last updated: 12th October 2026

This Data Processing Addendum ("Addendum") forms part of the Webtik Terms of Service ("Terms") between Digidom Studios Limited, trading as Webtik ("Webtik", "we", "us"), and the customer named in the order ("Customer", "you").

It applies to personal data that we process for you when we build, host and manage your website ("Customer Data"). For Customer Data, you are the controller and Webtik is the processor. Personal data about you and your authorised users as Webtik customers, such as contact, account and billing details, is covered by our Privacy Policy, not this Addendum.

Terms such as "controller", "processor", "personal data", "processing" and "personal data breach" have the meanings given in the UK GDPR.

1. Subject matter

1.1 Purpose. We process Customer Data only to design, build, host, maintain and support your website as described in the Terms.

1.2 Types of personal data. Customer Data includes names, contact details and message content from website forms, e-commerce order and customer details, blog or CMS content containing personal data, files and images you supply, and website analytics data such as device information, IP-derived location and browsing behaviour.

1.3 Data subjects. These include visitors to your website, people who submit forms or place orders, your customers and prospects, and your staff or other people featured in your website content.

1.4 Duration. We process Customer Data for the length of your subscription. It is then handled as set out in section 11.

2. Instructions

2.1 We process Customer Data only on your documented instructions. Your use of the service, and the requests you make to us in writing (including by email or support request), are those instructions.

2.2 We do not use Customer Data for our own purposes, sell it, or use it to train artificial intelligence models.

2.3 We will tell you if we believe an instruction breaches UK data protection law, unless the law prohibits us from doing so.

2.4 If the law requires us to process Customer Data in some other way, we will tell you before doing so, unless the law prohibits it.

3. Your responsibilities

3.1 You are responsible for having a lawful basis for collecting and using personal data through your website, including through forms, e-commerce and analytics.

3.2 You are responsible for the privacy notice, cookie policy and cookie consent choices published on your website. We will configure them as you reasonably instruct.

3.3 You are responsible for how you use Customer Data once it reaches you, such as form submissions delivered to your inbox, and for complying with PECR on any marketing you send.

4. Confidentiality

Anyone who processes Customer Data on our behalf is bound by a duty of confidentiality.

5. Security

5.1 We take appropriate technical and organisational measures to protect Customer Data, considering the nature of the data and the risks involved.

5.2 These include encryption in transit (TLS/SSL on every website we host), role-based access to Webflow sites and related accounts, multi-factor authentication on our administrative accounts, limiting access to staff and contractors who need it, and relying on the security programmes of our hosting providers.

6. Subprocessors

6.1 You give general authorisation for us to use the subprocessors listed on our Subprocessors page.

6.2 We will post any material addition on that page. You may object on reasonable data protection grounds within 30 days of the posting. If we cannot reasonably accommodate your objection, either party may end the affected service by written notice.

6.3 We will bind each subprocessor to data protection terms no less protective than this Addendum, and we remain responsible for their performance.

6.4 Services that you connect to your website using your own account, such as your own analytics property, email marketing platform, CRM, booking tool or payment account, are your processors and are outside this Addendum.

7. Assistance

7.1 Taking into account the nature of the processing, we will reasonably help you meet your obligations under the UK GDPR. This covers data subject requests, security, breach notification, data protection impact assessments and consultation with the ICO.

7.2 If we receive a request from a data subject about Customer Data, we will refer it to you and will not respond directly, unless the law requires us to.

8. Personal data breaches

8.1 We will notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Data.

8.2 We will give you the information you reasonably need to notify the ICO or affected individuals, and we will take reasonable steps to contain the breach.

9. Audits

On written request, we will give you the information reasonably needed to show that we comply with this Addendum. This includes relevant certifications or reports from our subprocessors where they are available to us.

10. Restricted transfers

10.1 Your website is hosted by Webflow, Inc., which may process Customer Data in the United States and other countries.

10.2 Where we or a subprocessor transfer Customer Data outside the UK, we rely on a valid UK transfer mechanism. This may be UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework), the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.

11. End of the contract

11.1 When your subscription ends, you may choose in writing to:

• have your website transferred to a Webflow account you control, in line with the website transfer terms in our Terms; or
• receive an export of Customer Data held in your website's forms, CMS and e-commerce records in a reasonable format; or
• have Customer Data deleted.

11.2 We will action your choice within 30 days of the subscription ending. If we receive no choice in that period, we will delete Customer Data.

11.3 We will then delete any remaining copies, unless UK law requires us to keep them.

12. Order of precedence

If this Addendum conflicts with the Terms on how Customer Data is handled, this Addendum prevails. Everything else, including liability and governing law, is governed by the Terms.

Questions

Contact us at support@webtik.co.uk.

‍