This Data Processing Agreement (“DPA”) governs our processing of personal data on your behalf when you use Sitekeep. It forms part of the Terms of Service between you and Tilak Kumar G, sole proprietor trading as TurtleByte (“we”, “us”, “our”), and applies automatically — you do not need to sign it for it to bind us. If your organisation requires a signed copy, write to [email protected] and we will provide one. What we sign is this document: we do not accept a customer’s own data processing terms in its place.

Terms defined in the Terms of Service have the same meaning here.

1. Roles

You are the controller of the personal data your organisation and its users put into the Service: you decide why it is collected and what is done with it. We are the processor: we hold and handle it on your instructions.

Where a person submits a maintenance request through your public request portal without an account, you are the controller of that submission. Our Privacy Policy §3 explains this to them.

For information about you as our customer — your billing contact, your account holders’ names and addresses, our correspondence with you — we act as a controller in our own right, and that processing is governed by the Privacy Policy rather than by this DPA.

2. Our instructions

We process personal data only:

to provide, secure, and support the Service as described in the Terms;
as otherwise instructed by you in writing, where we have agreed to it; and
where required by law, in which case we will tell you first unless the law forbids it.

We will not use personal data for our own purposes, will not sell it, and will not use your Customer Data to train our own models. Annex A sets out what is processed, for whom, and for how long.

If we believe an instruction from you breaches data protection law, we will tell you and may suspend that instruction until it is resolved.

3. Confidentiality

Everyone we allow to access personal data is bound by a duty of confidentiality and is granted access only where needed to do their work. We currently operate as a sole proprietorship; where that changes, this obligation applies to every person engaged.

4. Security

We maintain the technical and organisational measures set out in Annex B, appropriate to the risk. We may change them as the Service develops, but will not reduce the overall level of protection during your subscription.

5. Subprocessors

You give us general authorisation to engage subprocessors. Those currently engaged are published at getsitekeep.com/subprocessors and listed in Annex C.

We will give at least 30 days’ notice before adding or replacing one. If you object on reasonable data-protection grounds within that period and we cannot resolve your objection, you may terminate the affected subscription and receive a prorated refund of prepaid, unused fees.

We remain responsible to you for a subprocessor’s performance, and impose data protection obligations on it no less protective than those in this DPA.

6. Helping you answer people who ask about their data

Taking into account the nature of the processing, we will assist you — by appropriate technical and organisational measures, and so far as is reasonably possible — in responding to a request from a person exercising their rights of access, correction, erasure, restriction, portability, or objection.

In practice, the Service lets you do most of this yourself: your data is exportable at any time from Organisation → Exports, and records can be corrected or deleted in the product. Where a request reaches us instead of you, we will refer it to you and tell the person we have done so.

One limit, stated plainly. The Service keeps an audit record of who did what and when, so that a maintenance history can be relied upon. For that reason user accounts are deactivated rather than deleted — a deleted account would leave past entries attributed to nobody. Privacy Policy §9 describes what survives a deletion and why.

7. Personal data breach

We will notify you without undue delay, and in any event within 24 hours of becoming aware of a personal data breach affecting personal data we process for you. The notification will describe what we know: the nature, extent and timing of the breach; the categories and approximate number of people and records involved so far as known; the consequences likely to arise for the people affected; the measures we have taken and are taking; what affected people can do to protect themselves; and a person who can answer your questions. Where we cannot provide all of that at once, we will provide it in stages without undue further delay.

We will assist you in meeting your own notification obligations to regulators and to affected people.

8. Data protection impact assessments

We will provide reasonable assistance with any data protection impact assessment or prior consultation with a supervisory authority that relates to our processing for you, taking into account the information available to us.

9. Deletion and return

At the end of our provision of the Service, we will, at your choice, delete or return to you all personal data we process on your behalf, and delete existing copies — unless law requires us to keep it. Tell us which you want before the end of the export window below; if you tell us nothing, we delete.

In practice, “return” is the export: your Customer Data is downloadable at any time during your subscription and for 30 days afterward, from Organisation → Exports. After that window we delete in accordance with the Privacy Policy §9.

You may also ask us to delete it sooner. Because deletion cannot be undone, we hold such a request for 7 days so that it can be cancelled, then delete: your data is gone from active systems within a further 7 days, and out of backups by the end of the 30-day backup cycle.

We may retain personal data where law requires it, and retain the audit records described in clause 6 and Privacy Policy §9.

10. Audits and information

On written request, no more than once in any twelve-month period, we will:

provide the information reasonably necessary to demonstrate compliance with this DPA, by completing a written security questionnaire; and
where a supervisory authority requires an inspection, cooperate with it.

We do not offer on-site audits. Any review beyond the questionnaire above is at your cost, must be conducted under confidentiality, and must not disrupt the Service or risk the confidentiality of other customers’ data.

11. International transfers

We are established in India and operate the Service from there. Customer Data is hosted in Helsinki, Finland, with Hetzner Online GmbH, and its encrypted backups are stored with Cloudflare, Inc. within the European Union. The other subprocessors in Annex C operate in the United States.

India is not the subject of a European Commission adequacy decision, and storing Customer Data in the EEA does not change that: we access it from India, and that access is a transfer. Where you are established in the EEA, the UK, or Switzerland, or the personal data relates to people there, the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two (controller to processor), are incorporated into this DPA by reference and apply to that transfer, with:

Clause 7 (docking) included;
Clause 9 option 2, general written authorisation, with the 30-day notice period in clause 5 above;
Clause 11 optional independent dispute resolution not included;
Clause 17 governed by the law of Ireland;
Clause 18(b) courts of Ireland;
Annexes I, II and III populated by Annexes A, B and C of this DPA.

For transfers subject to UK law, the UK International Data Transfer Addendum (version B1.0) applies to the Clauses above, with Tables 1 to 4 populated by the same Annexes and the importer’s obligations as set out here.

A copy of either, executed, is available from [email protected].

12. United States

Where a United States state privacy law applies to our processing for you, Annex D applies and forms part of this DPA. It records our role as your service provider, the restrictions we accept on the personal information you give us, and the certification the statute requires.

13. India

Where India’s Digital Personal Data Protection Act, 2023 applies, you are the Data Fiduciary and we are a Data Processor acting under this DPA. Our grievance officer is named in the Privacy Policy, and an unresolved grievance may be escalated to the Data Protection Board of India.

From 13 May 2027 the Digital Personal Data Protection Rules, 2025 require you, as Data Fiduciary, to intimate affected Data Principals without delay and to report a personal data breach to the Data Protection Board of India within 72 hours of becoming aware of it. Clause 7’s notice is timed and worded so that you can meet both from what we send you, and we will supply whatever further information the Board’s report requires. Clause 6 applies to a request or grievance a Data Principal raises with you under the Act.

14. Liability

Each party’s liability under this DPA is subject to the exclusions and limits in Terms of Service §14.

15. Precedence and changes

If this DPA conflicts with the Terms of Service or the Privacy Policy on the processing of personal data on your behalf, this DPA prevails. A separate agreement signed by both parties prevails over this one.

We may update this DPA where law or our processing changes; for material changes we will give at least 30 days’ notice, as Terms §17 provides.

Annex A — Details of the processing

Subject matter. Provision of a maintenance and work order management service.

Duration. The term of your subscription, plus the retention periods in Privacy Policy §9.

Nature and purpose. Hosting, storing, transmitting, and displaying Customer Data so that your organisation can raise, assign, track, and complete maintenance work; transcribing audio notes; indexing work order text so it can be searched; generating answers to natural-language questions about your own history; sending notifications and service email.

Categories of data subject

Your account holders — owners, administrators, and technicians.
People who submit requests through your public request portal without an account, who may be staff, members of your community, or members of the public.

Categories of personal data

Identity and contact: name, work email address, telephone number, job title, organisation name.
Content: work orders, requests, comments, and the free text within them.
Media: photographs and video of facilities and equipment, audio notes recorded by technicians, and text transcripts of those audio notes.
Technical: IP address, device and browser identifiers, push notification tokens, usage and error logs.
Requester submissions: name, contact details, description and location of the problem, and any photograph attached.

Special categories of personal data. None is intended or requested. The Service is not configured for health data, cardholder data, student education records, or classified information — Terms §7 prohibits submitting them absent a separate written agreement. Free text and audio can nonetheless carry whatever a person types or says, which is why Privacy Policy §2 asks that they do not.

Frequency. Continuous, for the duration of the subscription.

Annex B — Technical and organisational measures

Tenant isolation. Every tenant-scoped table carries an organisation identifier. Row-level security is enabled and forced on each of them, so that even the table’s owner cannot bypass its policies, and an automated test suite fails the build if any table is missing that protection, its policy, or its grants. Isolation is implemented twice — once for what a device may download and once for what it may write — because the two paths are enforced by different mechanisms.

The public request portal is write-only. It runs as a separate database role holding permission to insert requests and attachments and permission to read nothing at all. An automated check fails if that role ever acquires another grant, column-level grants included. A submission cannot read any of your data back.

Encryption in transit. All public traffic is served over TLS.

Encryption at rest. The production disk is encrypted in full, and each backup is encrypted before it leaves it. The keys are held by us and not by the hosting or storage provider, so neither can read what it stores.

Access control. Roles and permissions are enforced server-side, never by hiding controls in an interface. Internal access is least-privilege.

Audit logging. Significant actions — status changes, assignments, deletions, permission changes — are recorded and attributable to a person, and that record is retained as described in clause 6.

Data on devices. The mobile application stores a copy of the data a user is entitled to see, so that work can continue without a network. That copy is protected by the device’s own storage encryption and lock screen, and is deleted when the user signs out or removes the application. Managing the devices themselves is the customer’s responsibility.

Backups. The database is backed up daily to encrypted object storage within the European Union, retained on a 30-day rolling cycle, and restores are rehearsed rather than assumed.

Resilience and patching. Dependencies are updated regularly and the service is monitored for errors, performance, and availability.

Personnel. We operate as a sole proprietorship. Access to production is held by the proprietor alone and is bound by the confidentiality obligation in clause 3.

Annex C — Subprocessors

The current list, with what each receives and where it operates, is published at getsitekeep.com/subprocessors and forms part of this Annex. At the date above it comprises: Hetzner Online GmbH (hosting), Cloudflare, Inc. (encrypted backups, and bot protection on the public request portal), OpenAI (transcription), Voyage AI (search indexing), Anthropic (search answers), Resend (email), and Expo (push notifications).

Paddle.com Market Ltd, which sells the subscription as merchant of record, is deliberately absent. It receives billing data as an independent controller for its own purposes rather than processing personal data on our behalf, so it is not a subprocessor of ours. It receives no Customer Data.

The Service runs on a server rented from Hetzner Online GmbH in Helsinki, Finland, and its encrypted backups are stored with Cloudflare, Inc. in the European Union. Both hold Customer Data in a form they cannot read — the disk and the backups are encrypted with keys we hold — and both are subprocessors nonetheless. Website analytics, error diagnostics, and telemetry run on that same server and are disclosed to no third party.

Annex D — United States state privacy laws

This Annex applies where we process personal information subject to the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”), or to a comparable state privacy law including those of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and Delaware. Terms used in this Annex have the meaning given in the applicable statute.

D.1 Roles

For personal information you or your users put into the Service, you are the business (or “controller”) and we are your service provider (or “processor”). We receive that personal information from you, or on your behalf, solely to perform the services described in the Terms of Service.

D.2 What we will not do with it

We will not:

sell personal information, or share it for cross-context behavioural advertising, as those terms are defined in the CCPA;
retain, use, or disclose personal information for any purpose other than performing the services specified in the Terms, or as otherwise permitted by the CCPA;
retain, use, or disclose personal information outside the direct business relationship between you and us; or
combine personal information we receive from you with personal information we receive from, or on behalf of, anyone else, or that we collect from our own interaction with a consumer — except where the CCPA permits a service provider to do so.

We do not use personal information to build or train our own models, and we contractually require the AI providers in Annex C not to train theirs on it.

D.3 Certification

We certify that we understand the restrictions in D.2 and will comply with them. This certification is given for the purposes of Cal. Civ. Code § 1798.140 and applies whether we are characterised as a service provider or a contractor.

D.4 Our obligations

We will:

comply with the obligations applicable to us under the CCPA and the other laws named above, and provide personal information the same level of privacy protection the statute requires of you;
tell you promptly if we determine we can no longer meet those obligations;
assist you in responding to a verifiable consumer request, as described in clause 6 of this DPA;
assist you with the security, breach notification, and assessment obligations described in clauses 4, 7 and 8; and
ensure that any subprocessor in Annex C is engaged under a written contract imposing obligations no less protective than this Annex.

D.5 Your oversight rights

You may take reasonable and appropriate steps to confirm that we use the personal information we receive in a manner consistent with your obligations under the CCPA — clause 10 of this DPA sets out how — and to stop and remediate any unauthorised use of it.

D.6 Sensitive personal information

The Service is not configured to collect sensitive personal information, and Terms of Service §7 prohibits submitting data subject to specialised regulatory regimes. Where such information nonetheless reaches us in free text or an audio note, we do not use or disclose it for any purpose other than those permitted by Cal. Civ. Code § 1798.121, and we do not use it to infer characteristics about a consumer.

D.7 Deidentified information

If we ever hold deidentified information, we will maintain it in deidentified form, will not attempt to reidentify it except as the statute permits, and will contractually oblige any recipient to the same.

Contact: [email protected] · [email protected] · Tilak Kumar G, sole proprietor trading as TurtleByte · 2nd Floor, No. 17, 7th Main Road, Bengaluru, Bengaluru Urban, Karnataka 560038, India

Data processing agreement