Data Processing Agreement

Last updated 14 October 2026

This Data Processing Agreement ("DPA") is between Aporia Research Ltd (company number 17518971, registered in England and Wales), London N22 8NL, United Kingdom ("we", "us"), which runs Page Lemon, and you, the customer. "You" includes anyone who publishes a site on Page Lemon, with or without an account. This DPA forms part of our Terms of Service whenever we process personal data on your behalf. You accept it when you accept the Terms, when you publish a site, or when you claim a site into an account. If this DPA and the Terms conflict on data protection, this DPA wins.

1. Roles

• For personal data that your sites collect or contain ("customer personal data"), you are the controller and we are your processor. If you act for someone else (for example an agency building a client's site), you are a processor and we are your subprocessor. Annex 1 lists the data.
• For your own account, billing and support data, we are a controller. Our Privacy Policy covers that, not this DPA.
• "Data protection law" means the UK GDPR and the Data Protection Act 2018, and, where it applies to you, the EU GDPR (Regulation (EU) 2016/679), and laws that replace or implement them. Words such as "controller", "processor", "personal data breach" and "data subject" mean what those laws say.

2. Your instructions

• We process customer personal data only on your documented instructions. Your instructions are: this DPA and the Terms; the settings you choose in Page Lemon; and what you, your team or an AI app you connect ask Page Lemon to do through the app, the API or our MCP server. Further instructions must be in writing (email is fine) and fit how the service works.
• We may also process customer personal data where UK law (or, for EU data, EU or member state law) requires it. If so, we tell you first, unless that law forbids it on important grounds of public interest.
• We tell you straight away if we think an instruction breaks data protection law. We don't have to follow it until it is confirmed or changed.
• You are responsible for having a lawful basis for the data your sites collect, for your own privacy notice to your visitors, and for what you ask your forms and pages to collect.
• We don't sell customer personal data, use it for advertising, use it to train AI models, or combine it with other customers' data.

3. Confidentiality

Everyone we authorise to process customer personal data is bound by confidentiality, by contract or by law. Access is limited to people who need it to run, secure or support the service.

4. Security

• We keep the technical and organisational measures in Annex 2. We may change them, but not in a way that lowers overall protection.
• You are responsible for the security of what you control: your sign-in, your API tokens and claim links, the people you invite, the AI apps you connect, and the content of your sites.

5. Subprocessors

• General authorisation. You authorise us to use the subprocessors listed on our subprocessors page. It names each provider, its purpose, the data involved and where it processes.
• Notice of changes. At least 14 days before a new or replacement subprocessor starts processing customer personal data, we email every account owner and update the subprocessors page. Sites published without an account have no email address, so for them the page is the notice.
• Objection. You may object on reasonable data protection grounds within those 14 days by emailing support@pagelemon.com. We will discuss it in good faith. If we can't resolve it, you may end the affected paid plan and we refund any prepaid unused period.
• Same duties. Each subprocessor is bound by a written contract with data protection duties at least as protective as this DPA. We remain responsible to you for how it meets them.

6. Helping you

• Requests from people. We help you answer people who use their data protection rights. Most of this is self-service: you can view, export and delete form messages and bookings, remove members, remove a form or delete a site. If a person contacts us about your site, we pass the request to you and don't answer it ourselves, unless the law requires us to.
• Other help. We give reasonable help with your security duties, breach notices, data protection impact assessments and consultation with a regulator, using the information we have.

7. Personal data breaches

• We tell you without undue delay, and aim to do so within 48 hours, after we become aware of a personal data breach affecting customer personal data. We email the account owner's address.
• We tell you what we know and add to it as we learn more: what happened, the kinds and rough numbers of people and records affected, the likely consequences, and what we have done or plan to do.
• Telling you is not an admission of fault. You decide whether to notify the regulator or the people affected.

8. Where data is and international transfers

• Where data is. Our servers are in London, UK. They hold the account database (including form messages, bookings and members) and a cache of site files. Site files are stored in the EU, and so are database backups. Some subprocessors process data in other countries, including the United States, as the subprocessors page shows.
• Data coming to us from the EU. If the EU GDPR applies to you, data you send to us in the UK is covered by the European Commission's adequacy decision for the United Kingdom. If that decision ends, the EU Standard Contractual Clauses apply automatically, with the choices in Annex 3.
• Transfers onward from us. Where we transfer customer personal data to a subprocessor in a country without adequacy, we use the safeguard in Annex 3 and carry out the transfer risk assessment it requires. We share a summary on request.

9. Return and deletion

• Export at any time. While your account is open you can download your site files, form messages and bookings, and member lists.
• Your choice at the end. When you close your account or the service ends, you choose whether we return customer personal data or delete it. To have it returned, email support@pagelemon.com before you close your account, or within 7 days after, and we will send it to you in a common, machine-readable format. Otherwise we delete it.
• How fast we delete. Site files: within 7 days of the site or account being deleted. Form messages and bookings: 30 days after you bin them, remove the form or delete the site. Members and sign-in sessions: when you remove the person or delete the site. Visitor numbers: single page views after 30 days; daily totals 30 days after the site is deleted. Account data: within 30 days of account closure. Database backups roll over every 7 days, so deleted data leaves them 7 days later. Site files have no separate backup. Anonymous sites that are never claimed are deleted 72 hours after publishing, with files removed within 7 days after that. We confirm deletion in writing if you ask.
• We keep data longer only where UK law (or, for EU data, EU or member state law) requires us to store it, for as long as it requires, and still protected by this DPA.

10. Audits and information

• We make available all information needed to show we meet our duties as your processor: this DPA, the subprocessors page, our Security and Trust pages, and answers to a reasonable security questionnaire.
• We allow for and contribute to audits, including inspections, by you or by an independent auditor you mandate who is bound by confidentiality. Give us at least 30 days' notice, or less if a regulator requires it or after a personal data breach. Audits happen during business hours, must not access other customers' data or put the service at risk, and each party bears its own costs.
• We normally expect one audit a year. More are fine where needed to show compliance, after a breach, or if a regulator asks.
• For our subprocessors, we rely on their certifications and audit reports, and share them where their terms allow. Where those are not enough, we use our own audit rights under our contracts with them for you.

11. Liability

Each party's liability under this DPA follows section 8 of the Terms, except where data protection law does not allow liability to be limited. Liability to the people whose data it is follows data protection law.

12. Term, changes and law

• This DPA lasts as long as we process customer personal data for you.
• We may update this DPA to reflect changes in law, regulator guidance or our service. We give at least 30 days' notice of material changes by email, as for the Terms. Changes won't reduce the protection of customer personal data unless the law requires it.
• This DPA is governed by the laws of England and Wales, and the courts of England and Wales have jurisdiction, except where the EU Standard Contractual Clauses apply, which are then governed as Annex 3 says.

Annex 1: Details of processing

Annex 2: Security measures

1. Encryption in transit. All traffic to our domains and to your sites uses TLS.
2. Encryption at rest. Site files and backups are kept in encrypted storage in the EU.
3. Separation. Your sites are served from a separate domain from the app and sign-in, so a site can't read app sessions. Each customer's data is kept separate in the application and checked on every request.
4. Access control. Only named staff can reach production servers, with individual keys and no shared passwords. Staff access to customer data is limited to what support, security or the law requires.
5. Passwords and tokens. Site passwords and API tokens are stored only as one-way hashes. We never see account passwords; sign-in is handled by our sign-in provider. Card data never reaches our servers.
6. Data minimisation. Visitor numbers use no cookies and no scripts and never store a full IP address. Form spam limits use a one-way hash of the IP address.
7. Upload safety. Uploads are scanned for leaked secret keys, and uploads that look like they contain them are blocked. We don't run customers' server-side code.
8. Protection against attacks. Rate limits, and protection against denial-of-service attacks in front of all our domains.
9. Resilience. Continuous database backups, a tested restore procedure, and the ability to roll a site back to an earlier version.
10. Incident response. A written breach procedure with roles, a 72-hour regulator clock for our own data, and the customer notice in section 7.
11. Supplier management. Subprocessors are chosen for their security and bound by data processing terms.
12. Review. We review these measures at least once a year and after any significant incident or change.

Annex 3: International transfer terms

Parties

• Data exporter: you, the customer, with the contact details in your account. Role: controller, or processor if you act for someone else. Activities: as in Annex 1.
• Data importer: Aporia Research Ltd (company number 17518971, registered in England and Wales), London N22 8NL, United Kingdom, contact support@pagelemon.com. Role: processor (or subprocessor). Activities: as in Annex 1.
• Signature and date: accepting the Terms or publishing a site counts as signing this annex, on the date of acceptance.

EU data sent to us (only if the UK adequacy decision ends)

Transfers from us to subprocessors

Which safeguard each subprocessor uses is shown on the subprocessors page or available on request from support@pagelemon.com.