Data Processing Addendum
Last updated 30 August 2026
This Addendum applies where IGWebsites.com ("IG Websites", "we") processes personal data on behalf of a creator ("you") in the course of providing IG Websites. It forms part of our Terms of Service and takes effect automatically when you create an account — you do not need to sign or request it.
Terms such as controller, processor, personal data, processing, data subject and personal data breach have the meanings given in the UK GDPR and the EU GDPR.
1. Scope, and what this does not cover
Read this section before the rest. It is unusual, and it matters.
In scope. Personal data we process purely on your instructions in operating your page — principally the content of your page and any personal data you choose to put in it, and any personal data you supply to us in support requests.
Not in scope: supporter contact data. Because IG Websites determines how long supporter email addresses are kept, where they are stored, and whether they are readable on a free plan, we take the position that IG Websites is the controller of that data rather than your processor. Our handling of it is governed by the Privacy Policy, not by this Addendum.
When you unlock and export supporter addresses, you become an independent controller of the copy you hold, and your own obligations attach to it from that moment.
2. Roles and responsibilities
For data in scope, you are the controller and IG Websites is the processor.
You are responsible for the lawfulness of what you ask us to do: having a lawful basis, giving data subjects the information they are entitled to, and making sure your instructions do not breach data protection law. We will tell you if, in our opinion, an instruction would breach the law — though we are not obliged to give you legal advice.
3. Processing on documented instructions
We will process in-scope personal data only on your documented instructions, including for transfers outside the UK or EEA, unless we are required to do otherwise by law — in which case we will tell you first, unless the law prohibits us from doing so.
Your instructions are: these terms, this Addendum, and what you do through the IG Websites interface and any API we provide. We will not use in-scope personal data for our own purposes, and we will not sell it or use it to train machine-learning models.
4. Confidentiality
Access is limited to personnel who need it to provide or support the service. They are bound by written confidentiality obligations that survive the end of their engagement, and receive data protection training appropriate to their role.
5. Security
We implement the technical and organisational measures set out in Annex 2, having regard to the state of the art, the cost of implementation, and the risk to individuals. We may update them, provided the level of protection does not go down.
6. Sub-processors
You give general authorisation for us to engage the sub-processors listed in Annex 3.
We will give you at least 30 days' notice by email before adding or replacing a sub-processor. If you object on reasonable data protection grounds within that period, we will work with you to find a solution; if we cannot, you may terminate your subscription and receive a pro-rata refund of any unused period.
We impose data protection obligations on each sub-processor that are no less protective than those in this Addendum, and we remain fully liable to you for their performance.
7. Assisting you
Taking into account the nature of the processing, we will assist you by appropriate technical and organisational measures with:
- responding to requests from data subjects exercising their rights;
- your obligations on security, breach notification, data protection impact assessments and prior consultation with a supervisory authority.
Most of this is built into the product rather than requiring a request: you can export your readable contacts, delete any individual contact, and delete your entire account, directly from the dashboard at any time. If a data subject contacts us directly about data you control, we will not respond substantively ourselves — we will tell them to contact you, and tell you promptly.
8. Personal data breach
We will notify you without undue delay, and in any event within 48 hours of becoming aware of a personal data breach affecting in-scope personal data. The notice will describe the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, the measures taken or proposed, and a contact point for more information — to the extent we know it, with further detail following as we learn it.
9. Deletion and return
When you delete your account, we delete your page, widgets, contacts, tracked links and visit records from our production systems immediately.
Payment records are retained to meet tax and accounting obligations, with supporter names and email addresses stripped from them. Backups are overwritten on their normal cycle and are fully purged within 30 days; until then they remain encrypted and are not restored to production except in a disaster.
Export your data before you delete your account. We cannot recover it afterwards, and on a free plan the export contains the 5 addresses you can read.
10. Audits
We will make available the information reasonably necessary to demonstrate compliance with this Addendum, and allow for and contribute to audits, including inspections, conducted by you or an auditor you appoint.
In the first instance we will provide the security documentation and any third-party certifications or reports we hold, together with those published by our sub-processors. Where that is genuinely insufficient, an on-site audit may take place on 30 days' notice, no more than once a year unless a breach or a regulator requires otherwise, during business hours, without unreasonable disruption, subject to confidentiality, and at your cost.
11. International transfers
Where we or a sub-processor transfer in-scope personal data out of the UK or the EEA to a country without an adequacy decision, the transfer is made under the European Commission's Standard Contractual Clauses, and for UK data under the UK International Data Transfer Addendum to those Clauses, each incorporated into this Addendum by reference.
For the Clauses: Module Two applies where you are a controller and we are your processor, and Module Three where you act as a processor for someone else. Annex 1 of this Addendum populates the description of the transfer, Annex 2 the technical and organisational measures, and Annex 3 the sub-processors. The option for general written authorisation of sub-processors applies, with the 30-day notice period in section 6. The governing law and forum are those stated in our Terms of Service, where the Clauses permit that choice.
Our database is created with a jurisdiction constraint so that it runs and stores data within the European Union. As a UK controller we may transfer to the EEA without additional safeguards, because the UK recognises the EEA as providing an adequate level of protection.
Not everything can be constrained this way. Our key-value store — which holds hashed session tokens, rate-limit counters and short-lived caches — is distributed across Cloudflare's global network and cannot be pinned to a region. It holds no supporter email addresses.
12. Annex 1 — Description of the processing
| Subject matter | Providing the IG Websites service: hosting a creator's public page and the dashboard behind it |
|---|---|
| Duration | For as long as the account exists, plus the retention periods in section 9 |
| Nature and purpose | Storage, retrieval, display, transmission, backup and deletion, for the purpose of operating the page and its analytics |
| Categories of data subject | The creator; any individual the creator names or depicts in their own page content; individuals identified in support correspondence |
| Types of personal data | Name, email address, biography text, profile photograph, page copy chosen by the creator, and support correspondence |
| Special category data | None is requested or required. Do not put special category data into your page content. If you do, you are responsible for the additional conditions that apply to it |
| Frequency | Continuous, for as long as the service is in use |
13. Annex 2 — Technical and organisational measures
- Encryption in transit — HTTPS with modern TLS throughout, including between our service and every sub-processor.
- Encryption at rest — provided by our infrastructure provider for database, object storage and key-value storage.
- Authentication — no passwords are stored. Sign-in is by single-use emailed link, valid for 15 minutes and invalidated on use. Session tokens are stored only as SHA-256 hashes, so a copy of the session store cannot be replayed.
- Payment data — card details are entered directly with Stripe and never reach our systems. We store no card numbers and no bank details.
- Access control — every dashboard route is authenticated, and every query is scoped to the signed-in creator's own records. Production access is limited to named personnel who need it.
- Application hardening — a strict Content Security Policy, no third-party scripts of any kind, HTML escaping on all output, and rate limiting on authentication and public form endpoints.
- Integrity of financial records — inbound payment webhooks are signature-verified and replay-protected, so records cannot be forged or duplicated.
- Data minimisation — no tracking cookies, no third-party analytics, and no IP addresses stored against visit records.
- Resilience and backup — managed, replicated infrastructure with point-in-time recovery.
- Logging — application and access logs retained for 30 days.
- Organisational — confidentiality obligations for all personnel, data protection training, and a documented incident response procedure.
14. Annex 3 — Sub-processors
| Sub-processor | What it does | Data | Location |
|---|---|---|---|
| Cloudflare, Inc. | Application hosting, database, object storage, key-value storage and outbound email delivery | All data stored by the service | Global network; database region as configured — see section 11 |
| Stripe, Inc. and group companies | Payment processing, connected account onboarding, and subscription billing for our own plans | Payment details, supporter name and email as given at checkout, creator billing details | United States and other Stripe locations |
Stripe acts as an independent controller for its own fraud prevention, identity verification and legal compliance purposes, in addition to processing on instruction. See Stripe's Data Processing Agreement and Cloudflare's Data Processing Addendum.
15. General
If this Addendum conflicts with the Terms of Service, this Addendum wins on data protection matters. If it conflicts with the Standard Contractual Clauses, the Clauses win.
Each party's liability under this Addendum is subject to the limitations in the Terms of Service, except where the law does not permit that.
This Addendum ends when your account ends and all in-scope personal data has been deleted or returned, except for provisions that by their nature survive.
Data protection contact: privacy@igwebsites.com.