Qsite data processing agreement

Version 1.0 of 8 November 2026. Effective from 8 November 2026.

1. Parties and starting point

1.1 This data processing agreement applies between you as a Qsite customer (the controller) and Qsite.com B.V., Pijlkruidstraat 2, 8245 JN Lelystad, the Netherlands, Chamber of Commerce number 34255398 (the processor).

1.2 With your Qsite site you process personal data, for example of visitors who fill in a form, of members who log in or of customers in your online shop. You decide why and how that happens. Qsite only processes that data for you, to provide the service. This agreement sets out the arrangements for this, as article 28 of the General Data Protection Regulation (GDPR) requires.

1.3 This agreement forms part of the Qsite general terms. If those terms and this agreement conflict on personal data, this agreement prevails.

2. What Qsite processes

2.1 Annex 1 sets out which data Qsite processes for you, about whom and for what purpose.

2.2 Qsite only processes the data on your instructions. Your instructions are: the general terms, this agreement and what you set up and do in Qsite. If we believe an instruction of yours breaks the law, we tell you.

2.3 Qsite does not use the data for its own purposes. We may use anonymised and aggregated data to improve the service, for example the number of forms per month.

2.4 If the law requires Qsite to hand over data to a government body, we tell you in advance, unless the law forbids it.

3. Your responsibility

3.1 You make sure you have a legal basis to process the data, that you inform your visitors properly, for example with a privacy statement on your site, and that you do not collect data you do not need.

3.2 Do not process special categories of personal data, such as health data, or criminal data through Qsite, unless you have a legal basis for it and have agreed extra measures with us.

4. Confidentiality

4.1 Everyone at Qsite with access to the data has a duty of confidentiality. Staff only get access when needed, for example to solve a question from you.

5. Security

5.1 Qsite takes appropriate technical and organisational measures to secure the data. They are listed in annex 2. We may change the measures as long as security remains at least as good.

6. Sub-processors

6.1 You authorise Qsite to use the sub-processors in annex 3.

6.2 If Qsite wants to add a new sub-processor or replace an existing one, we tell you at least 30 days in advance, by e-mail or with a notice in your account. If you have a reasonable ground to object, we look for a solution together. If that fails, you may cancel the agreement.

6.3 Qsite imposes at least the same obligations on sub-processors as this agreement contains, and remains responsible to you for their work.

6.4 If data goes to a country outside the European Economic Area, Qsite ensures appropriate safeguards, such as the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

7. Help with data subject rights

7.1 If someone asks you to view, correct or delete their data, you can usually do this yourself in Qsite, for example in Forms or Contacts. If you cannot, Qsite helps you.

7.2 If Qsite receives such a request directly, we forward it to you and do not respond to it on the substance ourselves.

8. Data breaches

8.1 If Qsite discovers a security breach that affects your data (a data breach), we tell you without undue delay, and no later than 48 hours after discovery.

8.2 We tell you what happened, which data and how many people are affected, what the consequences may be and what we are doing to fix it. That way you can decide whether to report the breach to the supervisory authority and to the people affected. You make that report yourself; we help you with it.

9. Help with other obligations

9.1 Qsite helps you, as far as reasonable, with a data protection impact assessment (DPIA) and with questions from the supervisory authority. If this takes a lot of time, we may charge costs after consultation.

10. Audits

10.1 Qsite gives you the information you need to see that we comply with this agreement, such as a summary of our security reviews.

10.2 If you also want an audit, it can be done at most once a year, after 30 days' notice, by an independent expert bound by confidentiality. You pay the costs, unless the audit shows that Qsite does not comply with this agreement.

11. Term and end

11.1 This agreement runs for as long as Qsite processes personal data for you.

11.2 When your account ends, you can download or request your data beforehand. Qsite then deletes the data within 30 days, and from backups within 90 days, unless the law requires us to keep it longer.

12. Liability

12.1 Liability is governed by the general terms, except where the GDPR mandatorily provides otherwise.

Annex 1. Description of the processing

Annex 2. Security measures

• All connections are encrypted with https (TLS).
• Passwords are only stored encrypted (hashed).
• Administrators use two-step verification.
• Users only have access to the sites and folders they have rights to.
• Hosting in a data centre in the EU (Frankfurt) with physical security, through Laravel Cloud on Amazon Web Services.
• Regular backups of the database and files.
• Forms are protected against spam and misuse; there are limits on login attempts and AI use.
• The software was checked for security four times in 2026; problems found have been fixed.
• Software and dependencies are checked automatically with every change.
• Staff only get access when needed and are bound by confidentiality.

Annex 3. Sub-processors