This is the Data Processing Agreement (“DPA”) between Larsik, Corp., Hollywood, Florida, USA (“we”, “us”) and the customer named in the email that accepts this DPA (“you”).
It covers two things: support tickets, and the Pro shared block list when you leave reporting on. It is not a certification under the EU-U.S. Data Privacy Framework. Larsik, Corp. is not on that list.
Checkout, licensing, and plugin updates are not part of this DPA. Freemius processes that data under its own addendum, which includes the EU Standard Contractual Clauses: freemius.com/terms/dpa. That addendum stays in force.
1. Roles
You decide why and how your own sites, and your clients’ sites, are secured. You are the controller for personal data on those sites.
We are the processor only for the personal data in the table below. Data that stays inside your WordPress installation never reaches us.
2. What we process
| Processing | Personal data | Where it is stored | How long |
|---|---|---|---|
| Support tickets | Name, email, IP, and whatever you write in the message | FreeScout on a Hetzner server in Finland | Until you ask us to delete the thread, or we no longer need it to handle the request |
| Pro shared block list, if you leave it on | Blocked IP, the site that reported it, and the block reason. No visitor profile | api.wpsecurityninja.com, on a Hetzner server in Helsinki, Finland | While the list needs that report. You can turn reporting off, which stops new reports from your site |
The Pro visitor log stays in your WordPress database. The default is 7 days. You can choose 1, 3, 7, or 14 days. We do not receive that log.
We do not use the data in the table to sell ads or to build a named profile of your visitors.
3. Instructions
We process the data in the table only to answer support requests, and to run the shared block list when you leave that feature on.
You can give us a further written instruction about that data by emailing [email protected]. We will follow it unless the law requires something else. If an instruction looks unlawful, we will tell you.
4. Our duties
We will:
- Let only people who need the data for support or the block list see it
- Keep the data confidential
- Use HTTPS for the services we run
- Use sub-processors only as listed below
- Help you answer a data-subject request about data we actually hold, when you email us
- Tell you without undue delay if we become aware of a breach of personal data we hold for you
- Delete the personal data in a support ticket when you ask, or when we no longer need the thread. Turning off block-list reporting stops new reports from your site
You remain responsible for the notice on your own website, including that the plugin may log IPs for security. Wording you can adapt is in GDPR compliance.
5. Sub-processors
| Sub-processor | What they do for this DPA |
|---|---|
| Hetzner | Hosts api.wpsecurityninja.com in Helsinki, Finland, and the support server in Finland |
| FreeScout, on that support server | Stores support tickets |
We will update this page at least 14 days before a new sub-processor starts handling the data in the table. You can object by email before that date. If you object, you can turn off the affected feature or end this DPA.
6. Access from the United States
Support tickets and block-list reports are stored in Finland. We read them from Hollywood, Florida. This DPA does not include the EU Standard Contractual Clauses. It does not make that access a Data Privacy Framework transfer.
Checkout, licensing, and update data are outside this DPA. Transfers of that data are covered only by the Freemius addendum linked above.
7. Security and audits
We keep access to support records limited to the people doing that work. You may ask us, by email, for a short description of those measures. We do not offer on-site audits of our vendors.
8. Term
This DPA starts when you email [email protected] that you accept it. It lasts while we process personal data for you under the table above.
Either party can end it by email. Deletion follows section 4.
9. Contact
Larsik, Corp., Hollywood, Florida, USA. Email [email protected].
Questions about this DPA go to that address. This page is the agreement. We do not sign a different version per customer.
