Privacy Policy

2026-04-01

  • 1. INTRODUCTION
    • The Company, together with its Affiliates, where applicable, (hereinafter referred to as the “Company”, “we”, “us” or “our”) operates its website Site.pro (the “Company’s Website”) and provides various services, included but not limited to website builder, website builder for hosting providers, accounting software, domains, mailboxes and blogs (collectively, the “Services”) accessible via the Company’s Website by users (the “User” or “you”).
  • 2. APPLICATION
    • This Privacy Policy applies to all visitors or Users of the Company Website. It describes what personal data we collect and why, on what legal bases, where personal data is stored, how it is used and shared, how long it is retained, and your rights regarding your personal data. We are committed to transparency and compliance with:
      • The Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereafter “GDPR”),
      • The United Kingdom General Data Protection Regulation, as incorporated into United Kingdom law pursuant to section 3 of the European Union (Withdrawal) Act 2018, together with the Data Protection Act 2018 (the “UK GDPR”),
      • The Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) of the Parliament of India, enacted on 11 August 2023 (“DPDP Act”),
      • The Federal Decree Law No. 45 of 2021 on the Protection of Personal Data of the United Arab Emirates (the “UAE PDPL”),
      • The United States federal and state privacy laws, including the California Consumer Privacy Act of 2018, as amended (the “CCPA”), and other applicable U.S. state privacy laws,
      • The Law of Georgia on Personal Data Protection, which entered into force on March 1, 2024,
      • any other applicable data protection and privacy laws.
    • Where local laws grant additional rights or impose additional obligations, those provisions apply only to Users in those jurisdictions. The terms “personal data”, “data subject”, “data controller”, and “data processor” are used in this Privacy Policy with the meanings assigned to them under the applicable data protection and privacy laws, depending on the User’s place of residence and the laws governing the processing of personal data. Where such laws do not use the same terminology, equivalent terms shall apply in accordance with the relevant regulations.
  • 3. DATA CONTROLLER AND DATA PROCESSOR
    • The Company acts as both a Data Controller and a Data Processor, depending on the type of personal data.
    • 3.1. When We Act as a Data Controller
    • We act as a Data Controller when we determine the purposes and means of processing personal data, including:
      1. Account registration and management;
      2. Billing, invoicing and payment processing;
      3. Security logs and system monitoring;
      4. Fraud prevention;
      5. Communication with Users (support, service messages, marketing where permitted);
      6. Website analytics and performance monitoring;
      7. Cookies and similar technologies.
    • 3.2. When We Act as a Data Processor
    • We act as a Data Processor when processing User content and data provided or uploaded by Users while using the Services, including:
      1. Website builder content
      2. Files, images, code, text posted by Users
      3. Hosted data
      4. Accounting software entries
      5. Mailbox data
      6. Domain-related data
      7. Backup archives (for accounting software)
    • In these cases, the User is the Data Controller, and we process such data solely on the User’s documented instructions.
  • 4. PERSONAL DATA WE PROCESS
    • The Company processes personal data only provided by Users. As a data processor, the Company does not independently determine what personal data is collected. All personal data is received from the User and processed strictly in accordance with the User instructions. The categories of personal data listed below are processed solely to enable and support the functionality and delivery of our Services. Additionally, the Company collects limited technical and usage data necessary to operate, secure, and optimize the performance of the Company’s Website.
    • Category of Personal DataTypes of Personal Data ProcessedPurpose of ProcessingLegal Basis
      Identification and Account DataFull name, title, personal ID number, email address, username, password, language selection, other contact details provided (if any)Used for account creation, provision of Services, login authentication, and access managementArt. 6(1)(b) Contract
      Billing & Accounting DataAll payment details, full name, invoice information, VAT number, financial entries uploaded by the UsersUsed for account operation and the provision of Services, accounting, access management, fraud preventionArt. 6(1)(b) Contract;
      Art. 6(1)(c) Legal obligation
      Technical & Log DataIP address, browser and device type, operating system, usage timestampsCollected for Company’s Website security, Service provision, diagnostics, usage analytics and diagnostics, support servicesArt. 6(1)(f) Legitimate interest
      Support DataCommunications with our support and provided information for the supportCustomer serviceArt. 6(1)(b) Contract
      Marketing DataNewsletters, preferencesSending permitted marketingArt. 6(1)(a) Consent
      Hosted ContentAll content uploaded by the UsersProvision of hosting and website builder ServicesArt. 6(1)(b) Contract
      Mailbox DataEmails sent or received by the UsersProvision of mailbox ServiceArt. 6(1)(b) Contract
      BackupsCopies of User ContentService continuity (applicable only for accounting software Service)Art. 6(1)(b) Contract
  • 5. SENSITIVE DATA AND MINORS
    • The Company does not process special or sensitive categories of personal data or children's personal data, as defined under applicable privacy laws. The Services are designed strictly for professional use by the Users and does not require or intentionally collect sensitive data (such as health, ethnicity, or political views). The Users are hereby instructed not to input such data. Additionally, the Services are not intended for use by individuals under 16 years of age, and no data from minors is knowingly collected.
  • 6. LEGAL BASIS FOR PROCESSING
    • The processing of personal data by the Company is based on the performance of a contract, in accordance with Article 6(1)(b) GDPR, the compliance with legal obligations, in accordance with Art. 6(1)(c), the legitimate interests, in accordance with Art. 6(1)(f) and consent for marketing and non-essential cookies, in accordance with Art. 6(1)(a). Most personal data processing activities are necessary to fulfil either the contract between you and the Company or the contract between your employer and the Company.
  • 7. DATA SHARING AND DISCLOSURE
    • 7.1. Sub-processors
    • The Company uses of a small number of carefully selected third-party service providers (also known as “sub-processors”) to operate core aspects of the Services and provide support. These sub-processors include:
    • Purpose of ProcessingSub-processorsLocations
      Cloud hosting, compute, storage, backups, securityGoogle CloudTaiwan, USA (selected region), fallback global if configured
      Cloud hosting, storage, email infrastructure, securityAkamai CloudSingapur, USA or global if configured
      Cloud hosting, storage, email infrastructure, securityAmazon Web Services (AWS)Brasil, EU regions (Ireland, Frankfurt, etc.) or global if configured
      Hosting servicesHoster.KZ LLPKazakhstan
      Cloud hosting, compute, serversThe Constant Company LLCThe United States
      Web hosting, domain and infrastructure operationsUAB Interneto vizijaLithuania
      Email hosting, mailbox operations, some secondary hostingFornexCyprus / Germany / Spain (varies by data center)
      Product analyticsMixpanelThe United States / the Netherlands (varies by data center)
      Transactional email sendingSMTP2goNew Zealand / EU
      EU servers by default for EU customers
      Outbound email deliverySendGrid (part of Twilio)The United States
      Task management, internal company operationsClickUpThe United States
      Communications and collaborationMicrosoft Teams / Office 365EU by default for EEA Users, fallback is set to be the United States
      Email services for communicating with UsersOutlook.com / Microsoft Corporation email servicesEU datacenters, fallback is set to be the United States
      AI-based invoice recognition and support assistanceOpenAI OpCo, LLC (ChatGPT)The United States
      Hosting services for some infrastructureTimeWeb LLCCIS
      Customer support assistanceLiveKit IncorporatedThe United States
    • The sub-processors are barred from using your personal data for any unrelated purpose.
    • 7.2. Disclosures Required by Law
    • The Company may disclose personal data to third parties only if required by law or valid legal process, for example:
      1. In response to a subpoena, court order, or legitimate law enforcement request;
      2. To investigate or prevent fraud, abuse, or security threats;
      3. As part of a merger, acquisition, or other business transaction, where personal data may be transferred to the successor entity under equivalent safeguards.
    • In such cases, the Company will inform you unless legally prohibited from doing so.
    • 7.3. No Use for Advertising or Profiling Outside the Platform
    • The Company does not use your personal data for third-party or targeted advertising, behavioral targeting, or non-service-related profiling. We do not share your personal data with social media platforms or data brokers. The Company does not sell personal information and does not share personal information for behavioral advertising, as those terms are defined under the CCPA.
    • 7.4. Confidentiality Obligations
    • All personnel with access to personal data, whether it is the Company‘s employees, contractors, or sub-processors, are bound by strict confidentiality obligations. The Company employees receive training and sign confidentiality agreements. Any breach of these obligations results in immediate action, including termination of access and, if needed, legal proceedings.
  • 8. YOUR RIGHTS
    • RightDescription
      Right to be informedTo receive clear and transparent information about how your personal data is collected and used.
      Right of AccessTo access your personal data and obtain information about how it is processed.
      Right to RectificationTo correct inaccurate or incomplete personal data.
      Right to Erasure (Right to be forgotten)To request deletion of your personal data in certain circumstances.
      Right to restrict ProcessingTo request temporary restriction of processing of your personal data.
      Right to Data PortabilityTo receive your data in a structured, commonly used format and transmit it to another controller.
      Right to ObjectTo object to processing based on legitimate interests or for direct marketing.
      Rights Related to Automated Decision-MakingTo obtain information about, or request review of, certain automated decisions.
    • The rights described in this Section 8 apply to Users to the extent provided by the applicable data protection and privacy laws, which may vary depending on the User’s place of residence. Not all rights listed below are available in all jurisdictions, and certain rights may be subject to limitations, conditions, or exceptions under applicable law.
    • 8.1. How to Exercise Your Rights
    • Any User may contact the Company directly via email or the ticket system available via the Company’s Website, please see the contact details in Section 11.
    • 8.2. Verification
    • To protect your personal data, we must verify your identity before fulfilling any rights request. If you make a request while logged in through your account, that will suffice. If you contact us from a personal or external email address, we may ask for additional verification to confirm your identity.
    • 8.3. No Fee
    • There is no charge for exercising your rights. In rare cases where a request is clearly excessive or repetitive, a reasonable fee may apply, or we may refuse the request in accordance applicable laws. We will always explain our reasoning in such cases.
    • 8.4. Response Times
    • We aim to respond to all valid requests within one month. If a request is particularly complex or involves numerous data sets, we may extend the response period by up to two additional months. You will be notified within the first month if an extension is needed.
    • 8.5. Right to Lodge a Complaint
    • If you believe your privacy rights under applicable privacy laws have been violated, you have the right to lodge a complaint with your national Data Protection Authority. Contact information is provided in Section 11.
  • 9. DATA RETENTION AND DELETION
      1. The Company retains personal data only as long as necessary for the purposes it was collected, or to meet legal or contractual obligations, in line with applicable data retention laws.
      2. Retention Timelines:
    • Data TypeRetention Period
      Identification, Account data and Support TicketsData is kept for the duration of active subscription for the Services. Users are able to delete their accounts themselves. Personal data is retained for 10 years after the contract (subscription) termination.
      Financial dataKept for 10 years for accounting, auditing and financial obligations purposes.
      Technical logsKept for 12-24 months
      BackupsRetained for 5 days
      CookiesAs per Cookie Policy
      Data under legal hold or dispute - Legal exceptionsData may be retained longer if needed for legal claims, audits, or investigations.
  • 10. DATA SECURITY MEASURES
      1. The Company is committed to protecting your personal data and maintaining the confidentiality, integrity, and availability of our Services. We implement a wide range of technical and organizational security measures to guard against unauthorized access, accidental loss, misuse, or unlawful processing.
      2. Security Safeguards in Place:
        1. Encryption in transit (TLS 1.2+);
        2. Encryption at rest where applicable;
        3. Access control based on least privilege;
        4. Secure development practices;
        5. Role-based administrative access;
        6. Audit logging;
        7. Malware and intrusion detection;
        8. Regular penetration testing;
        9. Incident response plan;
        10. Disaster recovery;
        11. Vendor risk assessments.
  • 11. DATA BREACHES AND NOTIFICATION
      1. The Company maintains technical and organizational measures to detect and respond to personal data breaches swiftly.
      2. If a breach affecting personal data occurs, we will notify the affected Users without undue delay of becoming aware. Our notification will include:
        1. A description of the breach;
        2. The categories and estimated number of affected data subjects and records;
        3. Likely consequences;
        4. Measures taken or proposed to mitigate the breach.
      3. The Company will cooperate fully, provide necessary documentation and its assistance. We maintain internal records of any personal data breaches.
  • 12. INTERNATIONAL DATA TRANSFERS
    • 12.1. Global Infrastructure
    • The Company operates a globally distributed infrastructure. As a result, personal data may be stored and processed globally.
    • 12.2. Transfer Safeguards and Legal Requirements
    • Where personal data is transferred from the European Economic Area or the United Kingdom to a country that has not been recognized as providing an adequate level of protection, the Company implements appropriate safeguards to protect the transferred personal data, as required by applicable laws. These safeguards include, where applicable:
      1. the European Commission Standard Contractual Clauses (“EU SCCs”); and/or
      2. transfers subject to the UK GDPR, the UK International Data Transfer Agreement (“IDTA”) and/or the UK Addendum to the EU SCCs; and/or
      3. other lawful transfer mechanisms recognized under applicable laws.
    • 12.3. Supplementary Measures and Risk Assessments
    • Where required, the Company conducts and documents transfer risk assessments and implements technical and organizational measures to ensure a largely equivalent level of protection, such as encryption in transit and at rest (where applicable), access controls, data minimization, and contractual restrictions on onward transfers.
    • 12.4. Transfers Under Non-EU Laws
    • For Users located outside the EEA/UK, the Company transfers and processes personal data internationally in accordance with the applicable data protection and privacy laws of the User’s jurisdiction, which may include additional conditions, notices, contractual safeguards, or consents for cross-border processing.
  • 13. CONTACT INFORMATION
    • If you have questions or grievances about this Privacy Policy or how your personal data is being processed:
    • 13.1. Contact the Company
    • Companys' Email: privacy@site.pro
    • 13.2. Contact Person for Data Protection Matters
    • The Company has also designated a contact person who can provide additional information on the processing of personal data and applicable privacy practices, as well as assist Users in understanding and exercising their rights.
    • Email: info@privacyanywhere.eu
    • 13.3. Supervisory Authority
    • Alternatively, you may contact the supervisory authority in your country of residence. We encourage you to contact us first, and we will do our best to resolve any concerns swiftly
  • 14. UPDATES TO THIS PRIVACY POLICY
    • We may revise this Privacy Policy to reflect changes in our Services or legal requirements. For significant updates, we will notify the Users at least 30 days in advance. Minor updates may be posted without prior notice.
  • 15. COOKIES
      1. We use cookies and similar technologies for:
        1. Essential functionality
        2. Analytics and performance
        3. User preferences
        4. Fraud prevention
        5. Marketing (only where consented)
        A detailed description is available in our Cookie Policy: https://site.pro/gallery/cookie-policy.pdf
      2. Legal basis for the essential cookies is Art. 6(1)(b) Contract, and for analytics or marketing cookies is Art. 6(1)(a) Consent. A cookie banner is displayed upon first visit to obtain consent where required.
  • 16. DATA LOCALISATION AND DATA RESIDENCY
      1. If you reside in a jurisdiction that imposes data localisation or data residency requirements (i.e., requiring that personal data of its residents be stored within the territorial boundaries of that jurisdiction), and such requirements apply to the processing of your personal data, the Company may, where legally required and technically feasible, store or process certain personal data within the applicable jurisdiction.
      2. You acknowledge and agree that, notwithstanding any such localisation measures, the Company may continue to collect, access, transfer, store, and otherwise process personal data outside of that jurisdiction for purposes permitted under applicable law, including for service provision, security, backup, support, compliance, and business operations, subject to appropriate safeguards.
  • 17. USE OF AI TOOLS
    • 17.1. General Use of AI Tools
    • To enhance the User experience, improve operational efficiency, and support the delivery, security and integrity of the Services, the Company uses artificial intelligence (“AI”) and automated tools in a limited and controlled manner. These tools may be used to assist Company personnel and Users and, in certain cases, to support or carry out automated operational actions, subject to appropriate safeguards and oversight as described in this Privacy Policy.
    • 17.2. Use of ChatGPT
    • The Company uses ChatGPT, an AI tool provided by OpenAI OpCo, LLC, for limited operational purposes, including:
      1. assisting with the preparation of responses to User support requests;
      2. invoice recognition, classification and document analysis; and
      3. internal operational support.
    • Only the minimum amount of personal data necessary to perform these functions is processed. Any personal data processed through ChatGPT is handled in accordance with the technical, and organizational safeguards, including the Data Processing Agreement (DPA) and, where applicable, Standard Contractual Clauses (SCCs) or equivalent international transfer mechanisms.
    • Further information on OpenAI’s data processing practices is available in OpenAI’s Privacy Policy: https://openai.com/policies/privacy-policy
    • 17.3. Use of DeepSeek and Similar AI Technologies
    • The Company may also use AI technologies provided by DeepSeek or similar service providers for limited assistive purposes, including:
      1. assisting Users with website creation, content generation, structure suggestions, and multimedia support (such as text, layout, video, or visual elements);
      2. assisting with text recognition, summarization, and analysis;
      3. providing informational assistance or recommendations related to accounting workflows, subject to User instructions;
      4. assisting with search, information retrieval, and content organization within the Services;
    • Further information on DeepSeek’s data processing practices is available in DeepSeek’s Privacy Policy: https://www.deepseek.com/privacy-policy
    • These AI tools operate as assistive technologies only. They do not replace professional advice, do not independently determine outcomes, and do not make binding decisions on behalf of the Company or Users. Human review or oversight is applied where outputs may affect Users or the operation of the Services.
    • 17.4. Automated and AI-Assisted Call Management
    • The Company may use automated or AI-assisted systems, including voice recognition or conversational tools, to answer or route incoming calls, provide basic information, or support customer service operations. Where such systems are used:
      1. Users will be informed that automated or AI-assisted technology may be used;
      2. Calls may be recorded or analyzed for quality assurance, security, training, or service improvement purposes, where permitted by applicable law;
      3. Human support remains available, and Users may request escalation to a human representative where applicable.
    • Any personal data processed during calls is handled in accordance with this Privacy Policy and applicable data protection and privacy laws, including consent and notice requirements under relevant jurisdictions.
    • 17.5. No Fully Automated Decision-Making
    • Certain AI tools described in this Section may support or be involved in automated processing related to service administration, security, compliance with applicable terms, or risk management. Where such processing results in automated decisions that may have legal effects or similarly significant impacts on Users, such processing is governed by the safeguards and rights described in Section 16 of this Privacy Policy.
    • 17.6. No Professional Advice
    • Information, content, or outputs generated or assisted by the Company’s Services, including through AI-based tools, are provided for informational and operational purposes only and do not constitute legal, accounting, tax, financial, or other professional advice. Users remain solely responsible for verifying the accuracy and suitability of any outputs and for obtaining independent professional advice where needed.
  • 18. AUTOMATED DECISION MAKING AND PROFILING
    • 18.1. Use of Automated Decision-Making
    • The Company may use automated tools, including AI-based systems, to assist with certain operational decisions related to the administration, security, and integrity of the Services. Such automated processing may be used, for example, to detect fraud, misuse, violations of applicable terms, security threats, or other activities that may result in actions such as temporary suspension, limitation, or termination of access to the Services, or contractual measures.
    • 18.2. Human Oversight and Safeguards
    • Where automated processing is used in connection with decisions that may have legal effects or similarly significant impacts on Users, the Company implements appropriate safeguards in accordance with applicable data protection and privacy laws. These safeguards include, where required:
      1. human involvement in the decision-making process, either prior to or promptly following the automated action;
      2. the ability for Users to request review or reconsideration of a decision by a qualified human representative; and
      3. measures designed to ensure accuracy, fairness, and proportionality of automated processing.
    • 18.3. Scope of Automation
    • Automated tools are used to support Company’s operations. Automated decisions are based on objective criteria related to service usage, security, contractual compliance, or legal obligations and are not used for profiling for advertising purposes.
    • 18.4. Jurisdiction-Specific Rights
    • Depending on the User’s place of residence, additional rights may apply in relation to automated decision-making, including the right to obtain meaningful information about the process involved or to challenge certain decisions, as provided under applicable law (e.g. the GDPR or UK GDPR). Users may exercise such rights by contacting the Company using the details provided in Section 11 of this Privacy Policy.
  • 19. THIRD-PARTY SERVICES AND LINKS
    • The Company’s Website or Services may contain links to third-party websites or services that are not operated or controlled by the Company. This Privacy Policy does not apply to such third-party services. The Company is not responsible for the privacy practices, content, or security of third-party websites or services, and Users are encouraged to review their privacy policies independently.
  • 20. ANONYMIZED AND AGGREGATED DATA
    • The Company may anonymize or aggregate personal data in such a way that it can no longer be used to identify an individual. Anonymized or aggregated data may be used for analytics, research, service improvement, security, and business purposes and is not considered personal data under applicable laws.