Data Processing Agreement

Last updated: 2 June 2026

This is a summary. Where it differs from the signed Data Processing Agreement, the signed agreement governs. References to WebSentinel are references to That Privacy Guy!, in Malta, trading as WebSentinel.

Scope

This agreement applies to the WebSentinel SaaS platform and to audit engagements where we process personal data on your behalf. In both cases you remain in control of the data and we act on your instructions. The WebSentinel marketing website is out of scope, because it processes no client personal data, and nothing on it collects, stores, or transmits personal data on behalf of a customer.

Roles

For any personal data processed under this agreement you are the controller and WebSentinel, operated by That Privacy Guy! in Malta, is the processor. You decide the purposes and the means of the processing, and we carry it out only as you direct. Where we act as our own controller for our business records, that processing is governed by our privacy notice.

Our commitments

As your processor we commit to the following:

• We process personal data only on your documented instructions, including for transfers, unless a law we are subject to requires otherwise, in which case we tell you before processing where the law permits us to.
• Everyone we authorise to process the data is bound by a duty of confidentiality, whether by contract or by a statutory obligation.
• We put in place appropriate technical and organisational security measures suited to the risk, including encryption in transit and at rest, strict access control on a need-to-know basis, logging, and tested recovery.
• We process only what an engagement actually needs, and we do not repurpose your data for anything you have not asked us to do.

Data residency

Our infrastructure is EU-based, EU-owned, and single-tenant. Your personal data is processed and stored within the European Union and it does not leave the European Union. There is no transfer to a third country and no reliance on a transfer mechanism, because the data simply stays inside the EU. Single-tenant means your data sits on infrastructure dedicated to you and is not commingled with that of other customers.

Sub-processors

We keep sub-processors to a minimum and we disclose those we use. The WebSentinel SaaS is single-tenant, which keeps the dependency footprint small by design. Where we do engage a sub-processor we impose the same data-protection obligations we owe to you, we tell you of any intended addition or replacement in advance, and we give you the opportunity to object.

Assisting you

We help you meet your own obligations as a controller. That includes assisting you in responding to requests from data subjects exercising their rights, and supporting you with your security, breach-notification, and impact-assessment duties. If we become aware of a personal-data breach affecting your data we notify you without undue delay and give you the information you need to meet your reporting obligations.

Deletion and return

On termination of the engagement we return or delete your personal data at your choice, and we delete existing copies unless a law we are subject to requires us to keep them. We also make available the information you reasonably need to demonstrate our compliance with this agreement, and we allow for and contribute to audits you conduct or mandate.

The full agreement

The full Data Processing Agreement, including the technical and organisational measures, the current list of sub-processors, and the details of any processing, is available on request. To receive it, or to discuss a SaaS or audit engagement, get in touch.

This summary is provided for information. It does not create contractual obligations on its own, and the signed agreement is what governs.