This Data Processing Agreement ("DPA") sets out the terms under which helloLOG ("Processor") processes personal data on behalf of a customer ("Controller") in connection with the helloLOG WordPress activity log service. It supplements the Privacy Policy and satisfies Article 28 GDPR. For business customers, this DPA is incorporated into and forms part of the Terms of Service by reference — you don't need to sign anything separately; using the service to process activity-log data means these terms apply. If your organization needs a countersigned copy for its own records, contact us and we'll arrange it.
1. Parties
Controller: the customer operating the WordPress site(s) connected to helloLOG, or the agency managing those sites on the site owner's behalf.
Processor: GoBird OÜ (registry code 17311365), Sepapaja tn 6, Lasnamäe linnaosa, 15551 Tallinn, Harju maakond, Estonia — operating helloLOG (hellolog.io). Contact: [email protected].
2. Subject matter and duration
The Processor processes personal data on the Controller's behalf for as long as the Controller's account is active and a site remains connected. Processing ends when the Controller disconnects a site or closes their account, subject to the retention periods in Section 6.
3. Nature and purpose of processing
The Processor receives WordPress activity events from the Controller's connected sites, stores them, makes them searchable in the Controller's dashboard, and enforces the retention period for the Controller's plan. No processing occurs beyond delivering this service.
4. Categories of data subjects
- Users of the Controller's WordPress site(s) (administrators, editors, authors, customers, members)
- Visitors whose actions trigger a logged event (e.g. a failed login, a form submission)
5. Categories of personal data
- WordPress usernames and user IDs
- IP addresses (unless the Controller enables IP anonymization)
- Event metadata: timestamps, event type, severity, affected object (post, order, setting, etc.)
- The site domain the event originated from
The Processor does not intentionally collect special categories of data (Article 9 GDPR).
6. Retention and deletion
Data is retained per the Controller's plan (7 days on Free; 90 days on paid plans; per contract on Enterprise) and then deleted automatically. On account closure, remaining data is deleted within a reasonable period; the Controller may request earlier deletion by contacting us.
7. Processor obligations
The Processor:
- Processes personal data only on the Controller's documented instructions, including as to international transfers, unless required to do otherwise by EU or Member State law
- Ensures personnel with access are bound by confidentiality
- Implements appropriate technical and organizational security measures
- Assists the Controller, so far as reasonably possible, in responding to data subject requests concerning activity-log data
- Notifies the Controller without undue delay, and in any case within 72 hours of becoming aware, after a personal data breach affecting the Controller's data
- Deletes or returns personal data at the end of the engagement, per Section 6
- Makes available the information reasonably necessary to demonstrate compliance with this DPA
8. Subprocessors
The Controller authorizes the Processor to engage the following subprocessors, and any others we add in the ordinary course of running the service:
| Subprocessor | Role |
|---|---|
| Hosting / infrastructure provider | Hosts the database and application that store and serve event data |
| Stripe | Payment processing for the account holder’s subscription (controller data, not activity-log data) |
| hellohost.io | Delivery of transactional account and security email (SMTP) |
We'll update this table when the list changes and, for a change that materially affects how activity-log data is processed, tell account holders by email before it takes effect. Every subprocessor is bound by data protection terms at least as protective as this DPA.
9. International transfers
We haven't made data-residency or "EU-only storage" commitments — if that matters for the Controller's compliance needs, contact us before connecting a site so we can confirm current details directly. Where a subprocessor processes data outside the EEA, we rely on the EU Standard Contractual Clauses as the transfer safeguard.
10. Audits
On reasonable written notice, and no more than once per year (or more often if required by a supervisory authority or following a breach), the Controller may request information reasonably necessary to demonstrate compliance with this DPA. We'll provide it directly rather than through an on-site audit wherever that's sufficient to satisfy the request.
11. Liability
Liability under this DPA is subject to the limitations set out in the Terms of Service.