Version 1.1 · effective 2026-11-05
This data processing agreement is entered into between you (the customer) and FWRD Digital (KvK 42057087), established at Utrechtseweg 95-3, 3702 AA Zeist, the Netherlands, email [email protected] ("FWRD", "we"), and forms part of your FWRD Studio subscription. It sets out what we may do with the personal data of your website’s visitors — and what we may not.
YOU are the controller: it is your website, your visitors, your decision what the data is used for. WE are the processor: we only do what you instruct us to, and nothing beyond that. That distinction is the heart of Article 28 GDPR and of this entire document.
We have deliberately kept it readable. Where readability collided with precision, precision wins — but there is no sentence here that only a lawyer could check.
Subject matter: building, hosting and maintaining your website, including measuring how visitors use it and receiving whatever they enter into your forms.
Duration: this agreement runs for as long as your subscription runs. When the subscription ends, so does this agreement — with the consequences set out in section 11.
We process the data solely to deliver the service you buy:
The data subjects are the VISITORS to your website, and anyone who fills in a form on it.
From them we process:
To count whether someone is new or returning, we need an identifier. Instead of a cookie we compute a code: SHA-256 over (today’s secret ‖ the IP address ‖ the browser type ‖ your site’s id).
That secret — the "daily salt" — changes every day and is then destroyed. While it exists, the code could with considerable effort be worked back; once it is gone, that is permanently impossible. Not by us either, and not under compulsion: the key you would need no longer exists.
The consequence: within one day we recognise a visitor on one site. Across days we do not. Across sites we never do, because your site’s id is part of the computation.
If the IP address is unavailable, we compute no code at all. Otherwise every visitor sharing a browser would collapse onto one identity — a number that looks credible and is wrong.
One exception to "no free text": if something breaks in the visitor’s browser, we keep the error message itself, at most 200 characters and scrubbed. Query strings, email-like patterns and runs of seven or more digits are replaced before storage. Without the message a reported error cannot be fixed; with the scrubbing it can never be something a visitor typed.
You give us general authorisation to engage sub-processors. At present these are:
We impose on every sub-processor the same data protection obligations as set out in this agreement, and we remain fully responsible to you for their performance.
If we want to add or replace a sub-processor, we notify you at least 30 days in advance by email to your account address, stating the name, purpose and country. Within that period you may object in writing. If you object and we cannot reasonably offer an alternative, you may terminate the agreement effective on the date the change takes effect, and we refund the prepaid amount for the period not used.
The visitor statistics and the form submissions are stored in the European Union (Supabase, AWS eu-north-1 in Stockholm). That is not incidental; it is a hard requirement written into our own configuration.
Some sub-processors are established in the United States (Cloudflare, Resend, Google, Stripe, Sentry, GitHub). For those transfers we rely on the EU-US Data Privacy Framework where the supplier is certified under it, and otherwise on the European Commission’s standard contractual clauses (Decision 2021/914) in that supplier’s data processing agreement.
The language model we use to write pages currently runs at DeepSeek in China. No valid transfer mechanism exists for that. We will replace it no later than 4 November 2026 with processing inside the EU. No form submissions, visitor data or visitor identifiers are sent to that model, only your site content and summarised figures.
If we discover a personal data breach we notify you WITHOUT UNDUE DELAY and at the latest within 48 hours of discovery, by email to your account address.
That notification contains what we know: what happened, which categories of data and roughly how many data subjects are likely affected, the likely consequences, and the measures we have taken. If we do not know everything yet we send what we do know first — a complete story in three days is worth less than half a story today.
Notifying the supervisory authority and the data subjects is YOUR responsibility as controller. We supply everything you need in order to do so.
You may verify that we hold to this. In practice that means: you ask us questions and we answer them, with evidence where evidence exists.
If you want an on-site audit or one by an independent auditor, we will cooperate. We ask for reasonable notice (30 days), no more than one audit per year absent a specific cause, and confidentiality — the systems serving you also serve other customers.
This agreement is governed by Dutch law. Disputes go to the competent court in the Netherlands.
Where this data processing agreement and our general terms conflict on the processing of personal data, this agreement prevails.
If we change this text materially, it receives a new version number. We notify you of the change at least 30 days in advance by email. For a new sub-processor the objection procedure in section 7 applies. The previous version is kept, so it is always traceable what applied at the moment you agreed.