Data Processing Agreement.

Version: 23 October 2026

This Data Processing Agreement ("Agreement") forms part of the Hosting, Domain and Cancellation Terms ("Terms") between you and CitySite Studio.

Who we are

CitySite Studio is a trading name of Culture & Clarity Ltd, registered in England and Wales (company number 16795837), registered office: 28 Maxwell Drive, Kingstown, Carlisle, CA6 4EB.

As in the Terms, "we", "us" and "our" mean Culture & Clarity Ltd and "you" and "your" mean the customer.

This Agreement satisfies Article 28 of the UK GDPR. Terms such as controller, processor, personal data, data subject and personal data breach have the meanings given in the UK GDPR.

If this Agreement conflicts with the Terms in relation to data protection, this Agreement takes priority.

1. Roles

1.1 Controller and processor

For personal data processed through your hosted website and PlainAnswer assistant, you are the controller and we are the processor. The processing covered by this Agreement is described in Annex A.

1.2 Your responsibilities

You are responsible for:

• ensuring there is a lawful basis for the processing;
• providing any privacy notices required by law;
• responding to data subject rights requests;
• ensuring your instructions to us comply with applicable data protection laws.

1.3 Your data

You retain all rights, title and interest in and to your personal data and remain responsible for determining the purposes and means of processing.

1.4 Our own data processing

Personal data we process for our own business purposes, including account management, billing and legal compliance, is governed by our Privacy Notice at citysitestudio.com/privacy and is not covered by this Agreement.

2. Our obligations

2.1 Instructions

We will process personal data only:

• to provide the services under the Terms; and
• on your documented instructions, including instructions given by email or through service settings.

If applicable law requires us to process data differently, we will notify you before doing so unless prohibited by law. We will inform you if, in our opinion, an instruction infringes applicable data protection law.

2.2 Confidentiality

We will ensure that any person authorised to process personal data:

• is subject to a duty of confidentiality; or
• is under an appropriate statutory obligation of confidentiality.

2.3 Security

We will implement appropriate technical and organisational measures in accordance with Article 32 UK GDPR. Measures include:

• HTTPS encryption for websites and PlainAnswer;
• security headers, including Content Security Policy;
• access limited to authorised personnel who require it, protected by strong passwords and two-factor authentication where available;
• secure management of credentials and secrets;
• masking visitor email addresses and telephone numbers before chat content is sent to an AI provider;
• automatic deletion of visitor contact details captured through PlainAnswer after 90 days.

2.4 Assistance

Taking account of the nature of processing and the information available to us, we will provide reasonable assistance to help you comply with your obligations relating to:

• data subject rights requests;
• security of processing;
• personal data breaches;
• data protection impact assessments;
• consultations with the Information Commissioner's Office (ICO).

If we receive a request directly from a data subject concerning personal data processed on your behalf, we will promptly forward it to you unless legally prohibited from doing so.

2.5 Personal data breaches

If we become aware of a personal data breach affecting personal data processed on your behalf, we will notify you without undue delay and provide available information reasonably necessary for you to meet your legal obligations. Information may be provided in phases as further details become available.

3. Sub-processors

3.1 General authorisation

You provide general written authorisation for us to engage the sub-processors listed in Annex A.

3.2 Changes to sub-processors

We will provide at least 30 days' notice before adding or replacing a sub-processor. You may object on reasonable data protection grounds. If we cannot reasonably resolve the objection, you may terminate the affected services under section 4 of the Terms before the change takes effect.

3.3 Sub-processor contracts

We will ensure each authorised sub-processor is subject to written contractual obligations that provide a level of protection substantially equivalent to this Agreement. We remain responsible for the performance of our sub-processors as required by applicable law.

4. International Transfers

4.1 Transfers outside the UK

Some approved sub-processors may process personal data outside the United Kingdom. Where this occurs, we will ensure that an appropriate transfer mechanism is in place, including where applicable:

• UK adequacy regulations;
• the UK Extension to the EU-US Data Privacy Framework (UK-US Data Bridge);
• the UK International Data Transfer Agreement (IDTA); or
• the UK Addendum to the EU Standard Contractual Clauses.

The transfer mechanisms currently relied upon by our sub-processors are described in Annex A. Where a provider participates in the UK Extension to the EU-US Data Privacy Framework, transfers may rely on that adequacy mechanism. Where a provider does not participate, transfers will be protected by the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or another lawful transfer mechanism recognised under UK data protection law.

5. End of Services

5.1 Return or deletion

At the end of the services, we will return or delete personal data as follows.

Website files - Website files remain available for download for 60 days after the website goes offline. - Following that period, files will be permanently deleted unless retention is legally required.

PlainAnswer data - On request, we will provide an export of available data. - Following export, personal data will be deleted within 30 days. - Visitor contact details are automatically deleted after 90 days regardless.

5.2 Legal retention and backups

We may retain personal data where required by applicable law.

Where personal data remains within secure backup systems operated by us or our authorised sub-processors, it will be retained only for the duration of the applicable backup retention cycle and will be automatically deleted or overwritten in accordance with the relevant provider's standard retention policies.

Backup copies are not actively processed except where required for disaster recovery, business continuity, security investigations or legal compliance. Information about current backup and retention practices is available on reasonable request.

6. Information and Audits

6.1 Demonstrating compliance

We will make available information reasonably necessary to demonstrate compliance with this Agreement and Article 28 UK GDPR.

6.2 Audits

You may conduct an audit or inspection, either yourself or through an independent auditor bound by confidentiality obligations. You must:

• provide at least 30 days' written notice;
• conduct audits during normal business hours;
• ensure audits occur no more than once per calendar year unless required by the ICO or following a personal data breach.

Audits must not unreasonably disrupt our business operations or compromise the confidentiality or security of other customers' information. Each party will bear its own costs.

7. Liability and Duration

7.1 Liability

The liability provisions in section 9 of the Terms apply to this Agreement except to the extent that applicable law prohibits such limitation or exclusion.

7.2 Duration

This Agreement remains in force for as long as we process personal data on your behalf. Section 5 survives termination or expiry of the services.

Annex A: Details of Processing

Subject matter: Hosting your website and providing the PlainAnswer AI assistant.

Duration: For the duration of the services and any applicable return or deletion periods described in section 5.

Nature and purpose - website hosting; - storage and transmission of website content; - processing contact form submissions; - responding to visitor enquiries through AI; - capturing and forwarding sales leads; - providing service communications relating to enquiries.

Types of personal data - names; - email addresses; - telephone numbers; - contact form submissions; - chat messages; - lead information voluntarily provided by visitors; - IP addresses; - browser, device and usage information.

Categories of data subject - website visitors; - users of the PlainAnswer assistant; - prospective customers; - existing customers of the controller.

Special category and criminal offence data: The services are not intended for the routine processing of special category data or criminal offence data. You must not intentionally collect such information through the services unless agreed with us in writing beforehand.

Sub-processors

Core service providers

Optional customer-enabled services

These services are only used where enabled on a customer's website.

Domain registrar

The domain registrar used for your domain name may receive registrant and administrative contact information in connection with domain registration and renewal. The registrar does not normally process personal data relating to visitors of your website unless separately engaged to do so.

End of Data Processing Agreement.