Data processing agreement

What this is about

People can send enquiries and book appointments on your website. That creates personal data. This data belongs to you: you decide what happens to it. We process it only on your behalf. This agreement records how we do that. It applies together with our terms as soon as your subscription starts.

You are the controller within the meaning of the General Data Protection Regulation (GDPR) and the Swiss Federal Act on Data Protection. Closelift c/o T. Lutz, Färberstrasse 17, 4057 Basel, Switzerland, is the processor.

Which data we process for you

Enquiries through your contact form: name, phone number, email address, message and whatever else the person enquiring gives voluntarily.

Appointment bookings and requests: name, phone number, email address, the service wanted, date and time, message.

Content of your website that names people: for example customer testimonials with names, or the names of your team, that you have published there.

Visits to your website, for the visitor statistics in your customer account: the day, the page opened, the source (such as a search engine, never the full address of the referring page) and a short value we form from the IP address and browser identifier to tell the visitors of one day apart. Its key changes daily and is not kept; we do not store the IP address or the browser identifier. Visitors whose browser sends an objection signal (Global Privacy Control or Do Not Track) are not counted.

Those concerned are therefore mainly your customers, prospective customers, the visitors of your website and your team.

What we process it for

Solely to run your website: receiving enquiries and bookings, delivering them to you, sending confirmations and cancellations, and keeping the data available for you. This includes sending emails on your behalf to the person who booked an appointment, such as confirmations, cancellations and reminders, and showing you in your customer account how many people visit your website and where they come from.

We process this data only on your documented instructions, including with regard to transfers abroad. This agreement, with the sub-processors named below, is such an instruction. If we consider an instruction unlawful, we tell you and may suspend carrying it out. We do not use the data for our own purposes, do not pass it on and do not sell it.

For how long

We keep enquiries and bookings for 24 months after the appointment or after receipt, so that you can look up who contacted you. After that we delete them automatically. If you want them deleted earlier, a message is enough. We delete the visitor statistics after 13 months.

We back up all data daily and keep the backups for 90 days. A deleted entry remains in these backups until they expire. We use them only to restore data after an error.

When your subscription ends, we delete the data 30 days later. On request, we give you your enquiries and bookings as a file beforehand. Statutory retention obligations remain unaffected.

Who else works on it

We use sub-processors. You agree to their use:

Cloudflare, Inc. (USA): running the website, storing enquiries, bookings and the visitor statistics, sending notifications. Cloudflare stores bookings from online appointment booking in data centres in the EU. All other data lies in Cloudflare's worldwide network and may also be processed outside Europe. A data processing agreement is in place with Cloudflare; transfers to the USA are covered by the European Commission's standard contractual clauses.

Resend (USA): only as a fallback, if we have to switch email delivery from Cloudflare to Resend. In normal operation Resend receives no data. Also with a data processing agreement and standard contractual clauses.

Anthropic, PBC (USA): when you change your website through the AI assistant, Anthropic receives your change request and the current texts of your website, so that the change can be written. Enquiries and bookings never go there. If you change your website through the forms in your customer account, Anthropic is not involved.

GitHub, Inc. (USA): keeps the source files of your website in a private repository, so that every version can be traced and restored, carries out the changes to your website and converts videos you upload into a format every browser plays. There, too, only the content of your website is stored, no enquiries and bookings.

Blacksmith Software, Inc. (USA): provides the machines on which GitHub carries out the changes to your website and converts your videos. The content of your website is processed there; a video stays there only while it is being converted. The machines also hold the access with which the changed website is published.

Hetzner Online GmbH (Germany): keeps a copy of our daily backups and of the photos and videos you uploaded for your website in data centres in Germany. The copy runs through a machine provided by GitHub; it only passes through there and is not stored. We remove deleted photos and videos there after 90 days. A data processing agreement is in place with Hetzner.

A data processing agreement or an equivalent arrangement is in place with Anthropic, GitHub and Blacksmith; transfers to the USA are covered by certification under the EU-US and Swiss-US Data Privacy Framework or by the European Commission's standard contractual clauses.

If we want to use or change to another sub-processor, we inform you at least four weeks in advance. You can object; in that case you can terminate for cause.

Not part of this agreement: payments are handled by Stripe. There we are the controller ourselves, not your processor.

How we protect the data

Transmission only encrypted (TLS). Cloudflare stores the data encrypted.

Access only for people who need it for their work. If we open your customer account for support, we do so stating the reason, for at most 45 minutes and at first read-only. You see every such access in the settings of your customer account; we keep the log for 24 months.

You reach your enquiries and bookings through your customer account, signing in with a one-time code sent to your email address. We also send you new enquiries and bookings by email to the address you have confirmed. As long as no address is confirmed, they go to us, so that nothing is lost.

Separation of different customers' data through separate identifiers for each website.

Deletion periods are set up technically and run automatically.

We adapt these measures to the state of the art; we do not lower the level of protection when doing so.

If something happens

If we become aware of a personal data breach, we inform you without undue delay and support you with your reporting obligations.

If someone asserts their rights

If a data subject contacts us directly, we forward the request to you and do not answer it ourselves.

We help you to provide information and to correct, delete or hand over data. For requests of usual scope we charge nothing for this.

We also support you with data protection impact assessments and with consulting the supervisory authority.

Audits

You may check whether we comply with this agreement. We give you the information needed for that. Please announce an on-site audit with reasonable notice and carry it out so that operations are not disrupted.

Confidentiality

Everyone who has access to this data on our behalf is bound to confidentiality. This obligation continues after the collaboration ends.

Language

Contracts concluded in English are governed by the English version of this agreement, contracts concluded in German by the German version.