Data Processing Agreement
This document is available in English only.
Last updated: 20 September 2026
This Data Processing Agreement (the Agreement) forms part of the Terms of Service for app.kea.page between you (the Customer) and Stanislav A, doing business as KEA.Page (we, us, our). The Annexes form part of it.
It is concluded in electronic form. By accepting the Terms of Service you accept this Agreement; no signature is required. We keep every version of this Agreement and a record of which version you accepted and when; you can see and download both in the application at any time, and we will give them to you on request after your account closes.
Where the Terms of Service and this Agreement conflict about the processing of personal data, this Agreement prevails — except on liability, which section 14 governs.
In this Agreement, the messages means the messages that visitors send you through a contact form on the page you publish at kea.page/[name], including everything a visitor writes in them.
1. What this Agreement covers, and what it does not
This Agreement applies to one thing: the messages. For them you are the controller and we are your processor, and we process them only to deliver them to you.
It does not cover:
| Who decides | Where it is described | |
|---|---|---|
| Your account, your subscription, your billing | We are the controller | our Privacy Policy for the application |
| Our server logs, and our own security and anti-abuse records | We are the controller, on our legitimate interest in keeping the service secure and running | our Privacy Policy for the application |
| Visit statistics for your page | We are the controller. We collect them to operate and secure the service, to plan capacity, to detect abuse and to improve the product. What we show you is aggregate counts containing no identifier for any visitor | our Privacy Policy for the website and published pages |
| Anything a third-party feature you switch on does | that provider, as an independent controller | section 10, and that provider's own terms |
Two qualifications, so the boundary is not wider than it should be. Any log entry that contains the content of a message, or identifies a particular message, is in scope and is deleted on the same schedule as the message itself. And where we are the controller, that is our assessment of the facts, not something this Agreement decides: roles follow what actually happens.
We are not a joint controller with you for the messages, and you are not our processor for anything.
2. Your instructions
We process the messages only on your documented instructions. Your instructions are: this Agreement, the Terms of Service, and what you do in the application — for example, which contact form appears on your page, which fields it asks for, and where the messages are delivered.
Giving us a further instruction. If you need something the application cannot express, tell us through the Privacy & Data department of our contact form. We will acknowledge within 2 working days, act on it or tell you why we cannot, and keep it with this Agreement as part of your documented instructions. We will give you the record of your instructions on request.
Transfers. Your instructions do not permit us, or any sub-processor, to transfer the messages outside the European Economic Area for storage, or to disclose them to an authority of a country outside it. We will not do either unless you instruct us in writing or a law of the European Union or of a Member State requires it.
Our own purposes: none. We do not use the messages for any purpose of our own. We do not use them to train anything, and we do not use them to improve the service.
Reading them. We do not read the messages. We access their content only where you instruct us to, where it is strictly necessary to deliver a message or to investigate a delivery failure you have reported to us, or where a law binding on us requires it. We record every such access and will tell you that it happened.
Where a law requires something else. If a law of the European Union or of a Member State requires us to process the messages otherwise than on your instructions, we will tell you about that legal requirement before we process, unless that law forbids us to tell you on important grounds of public interest.
If an instruction looks unlawful. If we consider that an instruction of yours infringes the GDPR or other Union or Member State data protection provisions, we will tell you immediately and we will not carry it out. We will suspend that instruction until you confirm, amend or withdraw it. If you do not reply within 14 days, or if you confirm it unchanged and we still consider it infringing, we may end this Agreement and the service for the affected page on 14 days' notice. No refund is due where we end it because you insisted on an instruction we consider unlawful. Suspending one instruction does not affect the rest of the service.
3. Confidentiality
Access to the messages is limited to those who need it to provide the service. Today that is one person: the operator of KEA.Page.
The operator is bound by the statutory duty of confidentiality in Article 5 of the Spanish Ley Orgánica 3/2018, which binds everyone who takes part in any phase of the processing and which continues after this Agreement ends.
Anyone else given access will sign a written confidentiality undertaking first, covering all personal data processed on your behalf and surviving the end of their engagement, and will be given access only to what they need. On request we will confirm in writing that such an undertaking is in place, and give you the template we use.
4. Security
We take the measures set out in Annex II. They are the measures actually in place, not a statement of intent.
By accepting this Agreement you confirm that you have read Annex II and consider those measures appropriate to the risk of the processing you have asked us to carry out. If you do not, tell us before you publish a form.
We review the measures at least once a year and whenever the service changes materially. We may change them, but not in a way that materially reduces the protection of the messages. Where a change is material we will update Annex II and email you what changed — at least 30 days in advance where the change is planned, and as soon as we can where it is not.
5. Sub-processors
You give us your general authorisation to engage the sub-processors listed in Annex III, and to engage others, subject to this section.
How we choose one. Before we engage a sub-processor we satisfy ourselves that it offers sufficient guarantees to implement appropriate technical and organisational measures. We engage only sub-processors that store the messages within the European Economic Area, will sign a written agreement meeting Article 28(3), can show independently assessed security practices, and publish their own sub-processors.
Telling you. Before a new sub-processor starts processing the messages we will tell you who they are, where they are, what they will do and what safeguards they have. We send that notice by email at least 30 days in advance, to the address on your account, and we keep Annex III up to date. We will not rely on you noticing a change to a web page.
The one exception: where we must engage a replacement urgently to protect the security or continuity of the service, we will tell you as soon as we reasonably can, and you may object exactly as if the notice had come in advance.
Objecting. You may object within 14 days of that notice, in good faith and on specific grounds relating to the protection of personal data. Tell us your reasons and we will try to resolve them. We will not start using a sub-processor you have objected to while your objection is open. If we cannot resolve it within 30 days, you may end the subscription for the affected page by written notice, and we will refund, pro rata on a daily basis, fees you have paid in advance for the unexpired part of the then-current subscription period for that page. If the page is on a free plan, you may simply stop using the service.
If you say nothing within those 14 days, you are taken to have authorised that sub-processor.
What we hold them to. We put a written contract in place with every sub-processor imposing data protection obligations that are, in substance, the same as those in this Agreement. Where a sub-processor's own commitments are shorter than ours — on notice periods, for example — we close the gap ourselves rather than pass it on to you. On request we will give you the data protection terms we have with any sub-processor, with commercial terms removed.
Further down the chain. Our sub-processor engages its own. On request we will tell you who they are and point you to where that sub-processor publishes and updates the list, so you can see the whole chain.
Liability. If a sub-processor fails to meet its data protection obligations, we remain liable to you for that failure to the same extent as if it were our own, as Article 28(4) requires. Section 14 governs how much.
6. Helping you answer data subjects
A visitor who wants to see, correct or delete a message they sent you should ask you — you are the controller and you have the message.
Where you need us, we will help, by appropriate technical and organisational measures and so far as it is possible given how the service is built. In practice we can tell you what we still hold and when it was delivered, and we can delete our copy.
Ask us through the Privacy & Data department of our contact form. We will acknowledge within 2 working days, tell you what we hold within 5 working days, and carry out a deletion you ask for within 5 working days of your instruction, confirming when it is done. Working days are working days in Barcelona, Spain. We do not charge for this help.
If a visitor contacts us instead, we will not answer on your behalf. We will tell them to contact you, and let you know it happened. If a supervisory authority contacts us about your messages, we will tell you as soon as we lawfully can.
7. Helping you with security, breaches and impact assessments
Security (Article 32). On request we will give you the current Annex II, the date of our last review and our last restore test, and what you need for your own risk assessment.
Impact assessments and prior consultation (Articles 35 and 36). Where you carry out a data protection impact assessment about the messages, or consult a supervisory authority, we will answer your written questions about how the processing works, what is held where, for how long, and who can reach it, within 10 working days. The assessment and the consultation remain yours to carry out.
Breaches (Article 33). If we become aware of a personal data breach affecting the messages, we will tell you without undue delay, and in any event within 72 hours. "Without undue delay" is the standard and 72 hours is the outside limit, not a target.
We are aware of a breach when we have a reasonable degree of certainty that a security incident has led to personal data being compromised. An automated alert or a third-party report is not by itself awareness until it has been reviewed and confirmed.
We will tell you, as far as we know it: what happened, which categories and roughly how many people and records are affected, the likely consequences, and what we have done about it. Where we cannot give you everything at once we will send an initial notice in time and the rest in stages, rather than wait for a complete picture.
We send breach notices by email to the address on your account, and we will also place a notice in the application. Keep that address current and monitored. We will not notify a supervisory authority or any data subject on your behalf unless you instruct us to. We do not charge for any of this help.
8. Deleting or returning the messages
While the service runs, our copy of a message is deleted within 30 days of delivery. We keep it for that period so that we can re-deliver it if delivery fails or you tell us you did not receive it, and for no other reason. You can ask us to delete a message sooner and we will.
When the service ends, you choose: we delete the messages, we return them to you first, or we hand them to a processor you name.
Closing your account takes your page offline immediately. We then hold what remains for 30 days, so that you have time to tell us which of those three you want, and so that the account can be restored if you closed it by mistake. You may change your choice at any time within those 30 days. If you have not told us by the end of them, we delete. After that we cannot recover anything.
Because a message is in any event deleted 30 days after delivery, there will usually be little or nothing left to return by the time an account closes. The lasting copy of a message is the one delivered to you, in your own mailbox, which we do not control.
Where you ask for return, we return the messages as a JSON or CSV export.
We confirm deletion to you in writing within 30 days of your request.
Where a law requires us to keep something. If a law of the European Union or of Spain requires us to keep a message, we will tell you within 5 working days which message, which law, and for how long. Where Article 33.3 of the Spanish Ley Orgánica 3/2018 applies, we return the message to you rather than keep it, and you guarantee its preservation. Separately, and as Article 33.4 of that law permits, we may keep duly blocked any data needed while liabilities arising from our relationship with you could still arise — blocked in the sense of Article 32.2 of that law: identified, reserved, with measures preventing any processing including viewing, available only to the courts, the Ministerio Fiscal, the AEPD or another competent authority, and destroyed at the end of that period.
Backups. Deletion from backups completes within four months at the latest, as the backup cycle overwrites them. Until then a backup is encrypted and is not used for any purpose other than restoring the service.
9. Information and audits
Information, first. On request and at no charge we will give you what you need to show that we meet Article 28: the current Annex II and Annex III, the relevant part of our Article 30(2) record, how the systems work, where the messages are held, how long they are kept, who can reach them, and what our sub-processor has committed to. We will send it within 10 working days. Changes to Annex II or Annex III we send by email as they happen, without waiting to be asked.
Audits. Beyond that you may audit us. You may run the audit yourself or appoint an auditor of your choice; we may suggest one, but the choice is yours. Please give us 30 days' written notice, keep the audit to the processing of your own messages, and have your auditor accept a written confidentiality undertaking.
We answer a documentary or remote audit at no charge, once in any twelve-month period, and again after a breach affecting your messages. Because this is a one-person business with no offices, an on-site inspection happens only where the documentary route has not answered your question — at our registered address, during working hours, once a year, with your auditor's own costs borne by you. Audits must not disrupt the service or expose another customer's data.
Where an audit finds a shortcoming, we will agree a remediation plan with you and tell you when it is closed.
Our sub-processor does not accept audit visits from our customers. Instead we will give you its data protection terms and its certifications, and we will put your questions to it.
10. Third-party features you can switch on
Your page can include features that make your visitor's browser connect directly to another company: a map, a cryptocurrency token swap, a live price chart. They are off unless you switch them on, and switching one on is your act.
- That provider is an independent controller, not our sub-processor. We do not send them your visitors' data — the visitor's own browser contacts them — and they decide for themselves what they do with what they receive. Their own terms govern what they do with it.
- This Agreement does not cover what the provider does with the data afterwards.
- For the moment the connection is made, responsibility is shared: you choose to switch the feature on and you know your visitors; we wrote the code that loads it. You are responsible for telling your visitors in your own privacy notice and for any consent required under Article 5(3) of the ePrivacy Directive or Article 22.2 of the Spanish LSSI. We will give you the information you need to do that, and we describe each provider in our visitor-facing Privacy Policy.
11. What you are responsible for, and what you may require
As the controller you:
- decide what your contact form asks for, and do not ask for more than you need;
- have a lawful basis for collecting the messages, and tell your visitors what happens to them, including that we deliver them on your behalf;
- keep the email address on your account current and monitored — it is where breach notices under section 7 and sub-processor notices under section 5 are sent;
- give us your instructions in the application or through our contact form, and keep a record of them;
- satisfy yourself, before you start and while the service runs, that the measures in Annex II are appropriate to the risk of the processing you have chosen, and supervise that processing;
- keep your account secure and remove access from anyone who no longer needs it;
- answer your visitors' requests, and tell us promptly when you need our help;
- do not configure your form to ask for special categories of personal data under Article 9, data about criminal convictions and offences under Article 10, or payment card or government identifier numbers, and do not direct your page at children. Free text is free text and we cannot control what a visitor writes; this is about what you ask for. If you do, we may suspend the form and ask you to change it;
- do not instruct us to do anything unlawful.
You have the right to give us documented instructions within the scope of this Agreement and to have them followed, to be told when we think an instruction is unlawful, to the information and audits in section 9, to object to a sub-processor under section 5, and to end this Agreement.
12. Where the messages are
The messages are stored only in the European Economic Area. Our servers are in Spain. Our sub-processor stores them in the European Union and we have configured it to do so.
Your visitor's browser reaches our service through that sub-processor's network, which has points of presence worldwide. Where a visitor is outside the European Economic Area, their message may pass in transit through a point of presence outside it. It is encrypted before it is stored and it is not stored outside the European Economic Area.
If that ever has to change, we will tell you before it happens, name the country and the safeguard we would rely on, and you may object under section 5.
13. If an authority asks us for the messages
If any authority asks us to disclose the messages, we will review the request, challenge it where we have grounds, disclose only the minimum required, and tell you before we disclose — or as soon as we lawfully can, where we are forbidden to tell you first.
We will not disclose the messages to an authority of a country outside the European Economic Area unless an international agreement in force between that country and the European Union or a Member State requires it, as Article 48 GDPR provides.
14. Changes to this Agreement
We may need to change this Agreement — when a sub-processor changes, or the law does.
We will not change it by quietly posting a new version. We will email you the change and what it means. For a change that materially affects your rights or our obligations we will ask you to accept it, and we record which version you accepted and when.
If you do not accept a change we need to make in order to keep providing the service, either of us may end this Agreement and the subscription for the affected page on 30 days' written notice, and we will refund the unexpired part of any fees paid in advance. Where a change is required by law and cannot wait, we will apply it and tell you immediately, and you may end the Agreement on the same terms.
15. Liability, term and law
This Agreement runs from your acceptance until we have stopped processing the messages and completed our obligations under section 8. Sections 3, 8, 13 and 15 survive it.
The limitations and exclusions of liability in the Terms of Service apply to this Agreement and to every claim between us arising out of it, including a claim of recourse under Article 82(5) GDPR. The order of precedence at the top of this Agreement does not disapply them. Nothing in this Agreement limits either party's liability to a data subject under Article 82 GDPR.
We have not appointed a Data Protection Officer, because Article 37 does not require one for processing of this kind. The Privacy & Data department of our contact form is the point of contact for everything in this Agreement.
Spanish law governs this Agreement, and the courts of Barcelona, Spain have jurisdiction — except that, if you are a consumer, this does not deprive you of the protection of mandatory rules of the country where you live, or of the right to bring proceedings there.
16. Contact
Use our contact form at https://www.kea.page/contact/ and choose Privacy & Data.
Annex I — The processing
| Subject matter | Delivering to you the messages that visitors send through the contact form on the page you publish at kea.page/[name], and holding them only long enough to deliver them and to re-deliver them if delivery fails |
| Duration | For as long as your page is published. Each message is deleted within 30 days of delivery; when a page goes offline, what remains is held for 30 days and then erased |
| Nature of the processing | Receiving a message from the visitor's browser, encrypting it, storing it briefly, transferring it to our own servers, delivering it to you by email, and deleting it |
| Purpose | Delivery of the message to you, and re-delivery if it fails. No other purpose |
| Types of personal data | The fields your form is configured to collect, which are recorded in your account and form part of this Annex. As shipped the form collects the visitor's name, email address, subject and message text; a visitor phone field is planned. The message text is free text and may contain any personal data the visitor chooses to write, including personal data of other people. The form does not accept file attachments |
| Special categories | None are requested. We cannot prevent a visitor writing something sensitive in free text; if they do, we process it only to deliver it |
| Categories of data subjects | Visitors to your published page who choose to send you a message, and any person they mention in it |
| Frequency | Continuous, whenever a visitor sends a message |
| Retention | In the queue: minutes, then erased. On our servers: deleted within 30 days of delivery. On your page's closure: the page goes offline at once and what remains is erased after 30 days. In backups: overwritten within four months |
A change you make to your form's fields is a change to this Annex. You can see the current field configuration in the application at any time.
Annex II — Technical and organisational measures
These are the measures in place today.
Encryption. A message is encrypted before it is written anywhere, and stays encrypted until it reaches our own systems. It is never stored in readable form outside them. The key is held in a protected key store, separate from the stored messages. All connections use TLS.
Where it is stored. The message is stored only in the European Economic Area. See section 12.
Minimising what is held. The queue holds a message only long enough to move it — normally a few minutes — and it is erased afterwards. Our own copy exists only to deliver the message and to re-deliver it if delivery fails, and is deleted within 30 days of delivery.
Access. One person has access to the messages. Two-factor authentication is enforced on that account and cannot be turned off. Sessions expire after 24 hours. Customers signing in to the application may also enable two-factor authentication on their own accounts.
Continuity. One person operates the service, so we hold: a break-glass credential kept offline; a documented arrangement under which a named trusted contact can take the service offline, tell customers, and preserve or delete data if the operator is unavailable for more than 7 days; and encryption at rest, so that losing control of the account does not by itself expose stored messages. We test that arrangement once a year.
Resilience and testing. Backups are encrypted and used only to restore the service. We test a restore from backup at least once a year and record the result. We aim to restore message delivery within 24 hours of a serious failure and to lose no more than 24 hours of data. We review these measures at least once a year and whenever the service changes, and on request we will tell you when the last restore test and the last review took place.
Abuse prevention. Forms are protected by our own checks. They process a shortened form of the visitor's IP address, an identifier derived from it, and browser identification; the full IP address is not retained, and these records are kept for 90 days. We do not use a third-party captcha service. (We are the controller for these anti-abuse records — see section 1. They are described here so that you can see the whole picture.)
Deletion. Closing an account takes the page offline immediately. What remains is held for 30 days — during which the account can still be restored and you can tell us what you want done with the messages under section 8 — and is then erased.
Changes. We may improve these measures, but not in a way that materially reduces protection, and we tell you when a change is material — see section 4. On request we will give you a list of material changes made in the past 24 months.
Annex III — Sub-processors
One party processes your visitors' messages on our behalf.
| Sub-processor | BunnyWay d.o.o., trading as bunny.net |
| Registered address | Cesta komandanta Staneta 4A, 1215 Medvode, Slovenia |
| Data protection contact | Through bunny.net's published privacy contact |
| Where it processes | Stores the messages in the European Union. Its network has points of presence worldwide; see section 12 |
| What it does | Delivers your published page, and holds the encrypted message between the visitor's browser and our servers |
| Safeguards | A written data processing agreement meeting Article 28(3); encryption in transit and at rest; EU establishment, so no transfer mechanism is needed for storage |
| Its own sub-processors | Published by bunny.net and available from us on request under section 5 |
Not sub-processors, and why. We name these so that you can see the whole picture and so that their absence from the table above is not mistaken for an omission:
- The provider of the network path into our own systems is a proxy. The traffic it carries is encrypted and it cannot read it. It is a conduit, not a processor of your visitors' messages. The message is decrypted only in memory on our own servers in Spain, and is written to storage encrypted.
- Our payment provider handles your subscription, where we are the controller and you are the data subject. It has nothing to do with your visitors' messages.
- Map, token swap and price chart providers are independent controllers, reached by your visitor's own browser, and only if you switch the feature on. See section 10.
Annex III is kept current. Changes are notified by email under section 5, never by editing this page quietly.