# Data Processing Agreement

Canonical: https://check-your-website.com/dpa
Last updated: October 25, 2026

If your company needs a Data Processing Agreement under Article 28 of the GDPR, we sign one with you. Email us and we send it for signature.

## When we are your processor

When Autopilot works on your code or your Lovable project, SOMA44 d.o.o. processes that content for you, on your instructions. Any personal data in it, such as names or email addresses in your code, is processed under the DPA.

## When we are the controller

For your account, sign-in, service emails, and product analytics, SOMA44 d.o.o. is the controller. The Privacy Policy at /privacy covers that data.

## What the DPA covers

- The subject, duration, nature, and purpose of the processing.
- The types of personal data and the people they concern.
- We process the data only on your documented instructions.
- Everyone who processes the data is bound to confidentiality.
- The security measures required by Article 32, listed on the Security page.
- Subprocessors: the list at /subprocessors, and notice 30 days before we add or replace one.
- Help with requests from the people the data concerns.
- At the end, we delete or return the data, as you choose.
- The information you need to check that we comply, including audits.
- Notice of a personal data breach within 48 hours after we become aware of it.

## Sign the DPA

- [Email info@check-your-website.com to request the DPA](mailto:info@check-your-website.com?subject=DPA)
- [Subprocessors](https://check-your-website.com/subprocessors)
- [Security measures](https://check-your-website.com/security)