Project processing schedule: the accepted proposal, statement of work or attached schedule completes these terms by identifying the processing details, hosting, locations, authorized subprocessors, security expectations and any required transfer mechanism. Publishing these terms does not by itself appoint SiteFueler to process a visitor’s data.
1. Parties, roles and scope
The client identified in the accepted project agreement is the “Controller” or “Client.” Dhanush R S trading as SiteFueler is the “Processor” or “SiteFueler” only for personal data handled on the Client’s documented instructions. The parties’ privacy-law labels will be interpreted according to applicable law.
These terms supplement the Professional Services Terms and accepted project documents. They do not apply when SiteFueler independently determines the purpose of processing, such as its own billing, account security or legal compliance; SiteFueler’s Privacy Policy governs those controller activities.
2. Processing details
The project agreement or an attached schedule must describe:SubjectThe WordPress development, migration, maintenance, troubleshooting, integration or other service.DurationThe project and any expressly agreed support or retention period.PurposeOnly the technical and operational tasks needed to provide the agreed service.Data subjectsAs applicable: the Client’s website visitors, customers, users, employees, contributors or contacts.Data categoriesAs applicable: account, contact, order, content, support, log, analytics or technical data visible in the systems supplied by the Client.Sensitive dataNone intended unless expressly identified and protected by additional written instructions.
3. Client instructions
SiteFueler will process Client Personal Data only on documented instructions, including the project agreement, approved tickets and written change requests, unless law requires otherwise. If legally permitted, SiteFueler will notify the Client before legally required processing.
SiteFueler will inform the Client if an instruction reasonably appears to violate applicable privacy law and may pause the affected task while the parties clarify it. SiteFueler is not responsible for independently determining the Client’s legal basis, notices or consent unless legal/privacy configuration is an expressly agreed deliverable.
4. Client obligations
The Client is responsible for the lawfulness, fairness and accuracy of Client Personal Data and instructions. The Client must:
- have an appropriate legal basis and provide required notices;
- collect valid consent where consent is relied on;
- give SiteFueler only data reasonably needed for the service;
- use synthetic or minimized data for development where feasible;
- identify special-category, child, financial, health or other high-risk data before access;
- configure user rights, retention and security according to the Client’s obligations; and
- ensure instructions do not violate another person’s rights.
5. Confidentiality and personnel
SiteFueler will limit Client Personal Data access to authorized personnel or contractors who need it for the service and are subject to confidentiality duties. Access will be removed when no longer required. The Client will provide individual least-privilege accounts where supported rather than shared master credentials.
6. Security measures
Taking account of the nature and risk of the Project, SiteFueler will use reasonable technical and organizational measures, which may include:
- TLS and secure provider connections;
- access control, unique accounts and multi-factor authentication where available;
- password managers or agreed protected credential transfer;
- least privilege and time-limited access;
- staging and minimized test data where practicable;
- protected devices, updated software and anti-malware controls;
- backups where assigned to SiteFueler in the Project;
- logging and incident investigation;
- secure deletion or credential revocation at completion; and
- provider security supplied by the selected host, CDN, repository or project platform.
No measure eliminates all risk. The Client remains responsible for security controls outside the Project and for changing credentials after handover.
7. Subprocessors
The Client gives general authorization for SiteFueler to use providers reasonably necessary to perform the Project. The applicable project schedule should identify material subprocessors, their purpose and processing location. Possible providers include the Client’s chosen host, Cloudflare, collaboration/repository tools, secure backup or transfer tools, and communication providers.
SiteFueler will require a subprocessor to protect Client Personal Data consistently with applicable obligations. Where law requires advance notice of a new material subprocessor, SiteFueler will provide it and allow a reasonable, documented objection based on data-protection grounds. The parties will try to find an alternative; additional cost or inability to perform may require a project change or termination.
8. International transfers
The Client must identify required location restrictions before the Project. Where EU/UK or another transfer law applies, the parties will use an appropriate transfer mechanism—such as an adequacy basis or applicable approved contractual clauses—and complete any necessary transfer assessment. If a required mechanism cannot be established, SiteFueler may decline or stop the affected processing.
9. Assistance with individual rights
Taking account of the nature of processing, SiteFueler will provide reasonable technical assistance so the Client can respond to access, correction, deletion, restriction, portability, objection or consent-withdrawal requests. If SiteFueler receives a request directly concerning Client-controlled data, it will refer the requester to the Client and will not respond substantively unless authorized or legally required.
Unusual or extensive assistance outside ordinary Project scope may be chargeable after notice, unless the need results from SiteFueler’s breach.
10. Security incidents
SiteFueler will notify the Client without undue delay after becoming aware of a confirmed personal-data breach affecting Client Personal Data. Available information will include the nature of the incident, affected data and individuals, likely consequences, measures taken or proposed, and a contact for follow-up.
SiteFueler will take reasonable containment, preservation and remediation steps and cooperate with the Client’s legally required assessment and notice. The Client decides whether to notify individuals or authorities unless law directly requires SiteFueler to do so.
11. Assessments and consultation
SiteFueler will provide reasonably available information concerning its processing to assist a Client with a data-protection impact assessment or regulatory consultation where required for the Project. SiteFueler is not responsible for the Client’s entire assessment or legal conclusions unless separately agreed.
12. Deletion and return
At Project completion or termination, SiteFueler will return or delete Client Personal Data under its control as instructed, unless law requires retention. Working copies and credentials will be removed within a reasonable period. Protected backups will expire through ordinary rotation and will not be restored for ordinary use after deletion.
SiteFueler may keep project invoices, instructions, approvals, security evidence and limited records needed for legal claims or compliance as an independent controller. The Client is responsible for retrieving deliverables before the agreed access period ends.
13. Information and audits
On reasonable written request, SiteFueler will provide information necessary to demonstrate compliance with these terms. If legally required and documentary information is insufficient, the Client may request a proportionate audit no more than once annually, during ordinary hours, with confidentiality, security and non-disruption safeguards.
The Client pays its audit cost and SiteFueler’s reasonable out-of-scope assistance unless the audit identifies a material SiteFueler breach. No audit may expose another customer’s data, security secrets or unrelated confidential information.
14. Liability and termination
Liability is subject to the agreed Professional Services Terms and mandatory law. A material data-processing breach may be handled through cure, suspension of affected processing or termination. Provisions concerning confidentiality, return/deletion, audit, liability and lawful retention survive as necessary.
15. Governing law
Indian law governs these terms unless a required transfer instrument or mandatory privacy law provides otherwise. Subject to non-excludable jurisdiction, competent courts in Dakshina Kannada District, Karnataka, India have jurisdiction.