Data Processing Agreement

Private beta. 8pixel is in a private beta by invitation. The company is not registered yet, so the name on these pages is a working name. We do not take payments.

This Data Processing Agreement ("DPA") applies between the customer using 8pixel (the "Customer", controller) and 8pixel (working name) (processor). It supplements the Terms and applies when 8pixel processes Customer Personal Data through the Service.

It does not apply to the Customer's account, billing, or support data at 8pixel. For that data, 8pixel is controller under the Privacy Policy.

1. Instructions, subject matter, and duration

8pixel processes personal data only on the Customer's documented instructions, including settings and features selected in the service, unless law requires otherwise. Processing lasts for the customer relationship and any period needed for deletion, return, or legally required retention.

2. Purpose and processing

Processing is needed to host and deliver the Customer's website, store and display Customer content, receive and store form submissions, manage bookings, contacts, orders, offers, and related email, and provide optional AI features the Customer enables.

3. Data subjects and data

Data subjects are the Customer's website visitors, customers, and other people whose data the Customer submits to the service. Data may include name, email, phone number, messages, booking details, contact and order details, and visitor-assistant messages. The Customer must not use the service for special categories of personal data under GDPR Article 9 without a written agreement with 8pixel.

Even so, a visitor cannot be stopped from typing sensitive details into a free-text field. For businesses where that is likely (a dentist, a clinic, a therapist) the Customer must expect it to happen: secure a lawful basis under Article 9(2), do not ask for more than you need in the form, and delete what you no longer need. The generated privacy policy for such websites says this to the visitor. 8pixel cannot detect sensitive data in free text and treats it like any other message.

4. Customer responsibilities

• The Customer determines purposes and means of processing and is responsible for a lawful basis, correct privacy information, and data-subject requests.
• The Customer is responsible for content, form fields, cookies, and external tools enabled on its published website.
• The Customer must give lawful, documented instructions and limit access to authorised people.

4.1 Where the Customer holds the account for someone else

The Customer may hold the account for an end client, and may itself be a processor. 8pixel is then a sub-processor. The Customer warrants that it is entitled to engage 8pixel as a sub-processor.

5. 8pixel commitments

• We ensure authorised people are bound by confidentiality.
• We use appropriate technical and organisational measures considering risk.
• Taking account of the nature of processing and available information, we assist the Customer with data-subject requests and Articles 32–36 GDPR duties.
• We notify the Customer without undue delay when we become aware of a personal-data breach affecting Customer data.
• We provide information reasonably necessary to demonstrate compliance and handle reasonable audits with advance notice, confidentiality, and without endangering other customers' security.

6. Security measures

Current measures include server-enforced authorisation, role-based access, encrypted connections, server-managed secrets, verified webhooks, rate limiting, security headers, and audit logging of sensitive events without content payloads. See the Security page for a summary. The Customer acknowledges that no security measure eliminates all risk.

7. Sub-processors and transfers

The Customer gives general written authorisation for the sub-processors listed on the Sub-processors page. We update the list on material changes and give affected customers an opportunity to object where law or the agreement requires it. Agreements, transfer mechanisms, and regional processing must be assessed per provider. Contact us before processing if you need written evidence; this page does not represent that every individual supplier agreement or transfer safeguard has been independently verified. Where the Customer is itself a processor for an end client, 4.1 also applies.

8. Deletion and return

The Customer can export data in the service and delete a website. On termination, 8pixel will, on the Customer's instruction, delete or return personal data unless law requires continuing retention. Backups and providers' retention may mean copies are removed through their normal lifecycle.

9. Precedence and contact

For data-protection conflicts, this DPA prevails over the Terms. Questions or instructions should be sent to contact@8pixel.app or through the contact form. Swedish law applies to the extent permitted by mandatory data-protection law.