Data Processing Agreement
Under Art. 28 GDPR and Art. 28 UK GDPR · Last updated: 2 November 2026
This agreement is part of our Terms of Service and applies to every client automatically. The client ("you", the controller) and Daniil Kirillov, trading as Working Hands Websites, Guerickestr. 19, 80805 München, Germany ("we", the processor), agree as follows. If this agreement and the Terms conflict on data protection, this agreement wins.
1. Subject and duration
We process personal data on your behalf to run your website and, on the Website + Leads plan, your customer management account, phone number and automated messages. This agreement lasts as long as you have a plan, plus the deletion period in section 9.
2. What we process
| Purpose | Hosting your website; receiving form requests and forwarding them to you; storing leads and contacts; routing calls and voicemail; sending missed-call texts, review requests and follow-up emails in your name. |
|---|---|
| Types of data | Names, phone numbers, email addresses, postal addresses, message and form content, call logs, voicemails and recordings (if you turn them on), text and email history, opt-in and opt-out records, technical data such as IP addresses and timestamps. |
| Whose data | Your website visitors, people who contact you, your customers and leads, and your staff who use the account. |
3. Your instructions
We process the data only on your documented instructions. These are the Terms, this agreement, the settings of your account and anything you ask us in writing (email is fine). We don't use the data for our own purposes. If we think an instruction breaks data protection law, we tell you and can hold off until you confirm or change it. If the law requires us to process data in another way, we tell you first, unless the law forbids it.
4. Confidentiality
Only Daniil Kirillov has access to the data. Anyone we bring in later will be bound to confidentiality in writing before they get access.
5. Security
We take the technical and organisational measures in Annex 2 (Art. 32 GDPR). We may improve them, but we never go below the level described there.
6. Sub-processors
You authorise us to use the sub-processors in Annex 1. We'll tell you by email at least 30 days before we add or replace one. You can object on reasonable data protection grounds within that time. If we can't resolve your objection, you can end the affected service without penalty. We bind every sub-processor to data protection terms at least as protective as these.
7. Transfers outside the EU and UK
Some sub-processors are in the USA. Transfers rely on the EU-US Data Privacy Framework and its UK Extension where the provider is certified, and otherwise on the EU Standard Contractual Clauses (with the UK Addendum for UK data). For UK clients, data from the UK to us in Germany is covered by the UK's adequacy regulations for the EEA.
8. Helping you
- Requests from individuals: if someone asks us directly for access, deletion and so on, we pass it to you without delay and don't answer it ourselves. We help you answer requests, for example by exporting or deleting records.
- Data breaches: we tell you without undue delay, and within 48 hours of becoming aware of a breach affecting your data, with the information we have, so you can meet your own 72-hour deadline.
- Other duties: we help with security, impact assessments and consulting the authorities (Art. 32–36 GDPR) as far as the information we hold allows.
9. End of the service
When your plan ends, we export your leads and contacts on request (CSV file) within 30 days, and then delete the data, including from your account at our sub-processors. Provider backups expire within their normal backup cycles. We keep data only where the law requires it.
10. Proof and audits
We give you the information you need to check that we keep to this agreement. Usually that's this document, our answers in writing and our sub-processors' certifications and reports. If you have a concrete reason, you or an auditor bound to confidentiality can carry out an inspection with 30 days' notice, during business hours and at your own cost.
11. Liability
Liability between us follows Art. 82 GDPR and the liability section of the Terms.
Annex 1: Sub-processors
| Sub-processor | Service | Location |
|---|---|---|
| HighLevel Inc. and LeadConnector LLC | Customer management, phone numbers, call routing, texts, emails, form handling | USA (DPF certified) |
| Cloudflare, Inc. | Website hosting, DNS, security, email forwarding | USA / global network (DPF certified) |
| Google LLC / Google Ireland Ltd | Email we use to talk with you, which may contain lead details you send us | EU / USA (DPF certified) |
HighLevel uses its own sub-processors (for example cloud hosting, phone carriers and email delivery). It publishes the list and gives notice of changes.
Annex 2: Security measures
- Two-factor authentication on every admin account (HighLevel, Cloudflare, Google, domain registrar, payments).
- Unique passwords kept in a password manager. Full-disk encryption on our computers.
- Each client has a separate sub-account. Your staff only get access to your own account.
- All websites served over HTTPS (TLS). Providers encrypt stored data at rest.
- Least access: only Daniil Kirillov has admin rights. Access is reviewed when anyone joins or leaves.
- Website forms collect only what's needed to reply: name, phone, what the job is.
- Availability and backups through our providers' redundant infrastructure.
- Fixed deletion process when a client leaves (section 9).