Effective Date: July 2, 2026
This Data Processing Addendum (“DPA”) forms part of the Master Services Agreement, Proposal, Statement of Work, or other agreement (“Agreement”) between Webtivity Marketing & Design (“Processor”) and the client identified in the applicable Agreement (“Controller”).
This DPA governs the Processing of Personal Data by Processor on behalf of Controller.
1. Definitions
For purposes of this DPA:
Applicable Privacy Laws means all applicable privacy and data protection laws, including, where applicable:
- EU General Data Protection Regulation (GDPR)
- UK GDPR
- Florida Digital Bill of Rights (where applicable)
- California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA)
- Other applicable U.S. state privacy laws
- Any amendments or successor legislation
Controller means the entity determining the purposes and means of Processing Personal Data.
Processor means Webtivity Marketing & Design.
Personal Data means any information relating to an identified or identifiable natural person.
Processing means any operation performed on Personal Data, including collection, storage, use, disclosure, transmission, analysis, deletion, or destruction.
Subprocessor means any third party engaged by Processor to Process Personal Data.
2. Scope
Processor will Process Personal Data only as necessary to perform the services described in the Agreement.
Nothing in this DPA transfers ownership of Personal Data to Processor.
Controller remains the owner and Controller of all Personal Data.
3. Nature of Processing
Processor may perform activities including:
- Website hosting support
- Website development
- Website maintenance
- Digital marketing
- Search engine optimization (SEO)
- AI optimization (AEO/GEO)
- Pay-per-click advertising
- Email marketing
- CRM integrations
- Analytics implementation
- Conversion tracking
- Call tracking
- Reporting
- Marketing automation
- Technical consulting
- Cloud storage
- Security monitoring
4. Categories of Personal Data
Depending on the services provided, Personal Data may include:
- Names
- Email addresses
- Telephone numbers
- Business information
- IP addresses
- Website usage information
- Marketing preferences
- Contact form submissions
- Customer communications
- Device identifiers
- Cookie identifiers
- General geographic information
- Online identifiers
Processor does not intentionally collect special categories of Personal Data unless specifically authorized in writing by Controller.
5. Categories of Data Subjects
Personal Data may relate to:
- Customers
- Prospective customers
- Website visitors
- Employees
- Job applicants
- Vendors
- Business contacts
- Subscribers
- Authorized users
6. Processor Obligations
Processor agrees to:
- Process Personal Data only on documented instructions from Controller.
- Process data solely for purposes of providing contracted services.
- Maintain appropriate technical and organizational safeguards.
- Limit access to authorized personnel.
- Ensure personnel handling Personal Data are subject to confidentiality obligations.
- Assist Controller with reasonable privacy-related requests where required by law.
- Notify Controller of confirmed Personal Data breaches without undue delay after becoming aware of them.
7. Controller Responsibilities
Controller is responsible for:
- Obtaining any legally required notices or consents.
- Determining the lawful basis for Processing.
- Ensuring the accuracy of Personal Data provided.
- Responding to consumer privacy requests unless otherwise agreed.
- Maintaining appropriate legal authority to share Personal Data with Processor.
8. Confidentiality
Processor shall ensure that employees, contractors, and authorized personnel who Process Personal Data:
- Receive appropriate training where applicable.
- Are subject to confidentiality obligations.
- Access Personal Data only when necessary to perform their duties.
9. Security Measures
Processor maintains commercially reasonable administrative, technical, and physical safeguards appropriate to the nature of the services provided.
These measures may include:
- Encryption in transit where supported
- Password management
- Multi-factor authentication where available
- Access controls
- Principle of least privilege
- Secure cloud infrastructure
- Firewall protection
- Malware protection
- Security monitoring
- Routine software updates
- Secure backup procedures
Processor continually evaluates and improves security practices but cannot guarantee absolute security.
10. Subprocessors
Controller authorizes Processor to engage Subprocessors as reasonably necessary to provide services.
Examples may include providers of:
- Cloud hosting
- Website hosting
- Email services
- CRM systems
- Analytics
- Advertising platforms
- AI services
- Project management
- Customer support
- Payment processing
- Security monitoring
- Data storage
Processor will use commercially reasonable efforts to engage reputable Subprocessors that are contractually obligated to protect Personal Data.
11. International Data Transfers
Personal Data may be processed within the United States or other countries where Processor or its Subprocessors operate.
Where required by Applicable Privacy Laws, Processor will implement appropriate safeguards for international data transfers, including approved contractual mechanisms where applicable.
12. AI-Assisted Processing
Processor may utilize artificial intelligence tools to assist with:
- Content development
- Data analysis
- Search optimization
- Reporting
- Marketing insights
- Workflow automation
Processor will use commercially reasonable efforts to avoid submitting confidential Personal Data to publicly available AI systems unless authorized by Controller or protected through appropriate safeguards.
13. Consumer Privacy Requests
Where Processor receives a request from an individual regarding Personal Data processed on behalf of Controller, Processor will, where appropriate:
- Notify Controller.
- Cooperate with Controller.
- Assist Controller as reasonably necessary.
Unless legally required, Processor will not respond directly to such requests without Controller’s authorization.
14. Security Incidents
Upon becoming aware of a confirmed Personal Data breach affecting Controller data, Processor will:
- Notify Controller without undue delay.
- Provide reasonably available information regarding the incident.
- Cooperate with Controller in investigating and responding to the incident.
- Take commercially reasonable measures to mitigate further unauthorized access or disclosure.
15. Data Retention and Deletion
Processor will retain Personal Data only as long as necessary to perform services, comply with legal obligations, resolve disputes, or enforce contractual rights.
Upon termination of the Agreement and at Controller’s written request, Processor will, subject to applicable law and legitimate business retention requirements:
- Return Personal Data where feasible; or
- Securely delete or anonymize Personal Data.
Backups maintained in the ordinary course of business may be retained until overwritten or securely destroyed.
16. Audits
Upon reasonable written request and subject to appropriate confidentiality protections, Processor will make available information reasonably necessary to demonstrate compliance with this DPA.
Controller acknowledges that documentation, certifications, security questionnaires, or other reasonable evidence may satisfy audit requests.
17. Liability
Each party’s liability under this DPA shall be subject to the limitations of liability contained in the underlying Agreement, unless prohibited by applicable law.
18. Term
This DPA becomes effective on the Effective Date above or the effective date of the underlying Agreement, whichever is later.
It remains in effect for as long as Processor Processes Personal Data on behalf of Controller.
19. Governing Law
This DPA shall be governed by the governing law specified in the underlying Agreement.
If the Agreement does not specify governing law, this DPA shall be governed by the laws of the State of Florida, without regard to conflict of law principles.
20. Order of Precedence
If there is any conflict between this DPA and the underlying Agreement regarding the Processing of Personal Data, this DPA shall control solely with respect to data protection obligations.
21. Contact Information
Questions regarding this DPA may be directed to:
Webtivity Marketing & Design
4654 East State Road 64, Suite 175
Bradenton, FL 34208
138 Pinellas Way North
St. Petersburg, FL 33710
Phone: (941) 753-7574
Email: marketing@webtivitydesigns.com
Website: https://www.webtivitydesigns.com
Appendix A – Processing Details
Controller: Client identified in the applicable Agreement
Processor: Webtivity Marketing & Design
Subject Matter: Digital marketing, website development, hosting support, SEO, AI optimization, advertising, analytics, CRM integration, and related professional services.
Duration of Processing: For the duration of the Agreement and any applicable retention period.
Nature and Purpose of Processing: To provide contracted marketing, website, technology, and consulting services.
Categories of Data Subjects: Website visitors, customers, prospects, employees, vendors, subscribers, and authorized users.
Categories of Personal Data: Contact information, online identifiers, analytics data, marketing preferences, communication records, and other Personal Data necessary to perform the contracted services.
Special Categories of Data: Not intentionally processed unless expressly authorized in writing by the Controller.