Data Processing Addendum

Last updated 19 October 2026. How we process your visitors' data when we host your site.

In short

  • This addendum applies when the sites you host collect personal data about your visitors.
  • You are the controller. We are your processor and act only on your instructions.
  • We keep the data confidential and secure, and tell you without undue delay about a breach.
  • We use listed sub-processors and tell you before adding new ones.
  • When you leave, we delete your data after 30 days.

This summary helps you find your way. The full text below is what applies.

1. Scope and roles

This Data Processing Addendum ("DPA") forms part of the Terms of Service between you (the "Customer") and [Company legal name] (Private) Limited ("Walakulu"). It applies when Walakulu processes personal data on your behalf in the course of hosting, building, fixing or serving your websites ("Customer Personal Data"), for example data your visitors submit through your site's forms or that appears in your site's files and logs.

For Customer Personal Data, you are the controller and Walakulu is your processor. You decide what personal data your website collects and why. Walakulu processes it only to provide the Service. Terms not defined here have the meaning given in the Terms or in the applicable data protection law, including Sri Lanka's Personal Data Protection Act, No. 9 of 2022 (as amended) and, where they apply, the EU and UK GDPR ("Data Protection Law").

2. Your responsibilities

You confirm that you have a lawful basis and have given all notices and obtained all consents needed for Walakulu to process Customer Personal Data under this DPA, and that your instructions comply with Data Protection Law. You are responsible for the accuracy and legality of Customer Personal Data, for your website's privacy policy and cookie consent, for answering your visitors' requests, and for not uploading special category or sensitive personal data, card numbers or government identifiers unless you have assessed and accepted the risk.

3. Processing on your instructions

Walakulu processes Customer Personal Data only on your documented instructions, which are these Terms, this DPA and your use and configuration of the Service, unless the law requires otherwise. If the law requires other processing, we will tell you first unless the law forbids it. We will tell you if we believe an instruction breaks Data Protection Law, and we may refuse to follow it.

Details of processing. Subject matter and duration: providing the Service for the term of your account plus the deletion period. Nature and purpose: hosting, storage, building, caching, transmission, security scanning, automatic fixing and support. Data subjects: your website's visitors, customers and contacts. Categories: whatever personal data your website collects or contains, typically names, contact details, messages, IP addresses and usage data.

4. Confidentiality and security

Walakulu ensures that people authorised to process Customer Personal Data are bound by confidentiality. Walakulu implements technical and organisational measures appropriate to the risk, including encryption in transit, access controls, least privilege access, logging and monitoring, and the security of our providers' infrastructure. You are responsible for the security of your own code, account credentials and the configuration of your website.

5. Sub-processors

You give general authorisation for Walakulu to use sub-processors. Walakulu binds each sub-processor by written terms that protect Customer Personal Data to a standard no lower than this DPA, and remains responsible for their performance as Data Protection Law requires. Current sub-processors:

  • Cloudflare, Inc.: Hosting, content delivery, SSL certificates, DNS and security filtering. Location: United States, with servers worldwide.
  • Payments.lk: Card and online payment processing. Location: Sri Lanka.
  • Domain registries and registrars (including LK Domain Registry): Registering and renewing domain names. Location: Sri Lanka and the registry's country.
  • Anthropic, PBC: AI processing for automatic fixes and builder features. Location: United States.
  • Email delivery and mailbox providers: Sending service and account emails, business email add-ons. Location: Varies by provider.

We will update this list at least 14 days before adding or replacing a sub-processor. If you object on reasonable data protection grounds, tell us within that period. If we cannot reasonably address your objection, your sole remedy is to stop using the affected part of the Service or cancel your plan.

6. International transfers

Walakulu and its sub-processors may process Customer Personal Data in Sri Lanka, the United States and the other countries where our providers operate servers. Where Data Protection Law requires a transfer mechanism, the parties agree to rely on the safeguards specified or approved by the relevant authority, including, where the GDPR applies, the European Commission's Standard Contractual Clauses of 4 June 2021 (Module 2, controller to processor, and Module 3, processor to processor, as applicable) and the UK International Data Transfer Addendum, which are incorporated by reference with you as data exporter and Walakulu as data importer. Where the Clauses require a choice of law and forum, the law and courts of Ireland apply to them.

7. Assistance

Taking into account the nature of the processing, Walakulu will provide reasonable assistance to help you respond to data subject requests and meet your obligations on security, breach notification and impact assessments. We mainly do this through the self-service tools in the Service. If a data subject contacts us directly about your website, we will refer them to you. Assistance beyond the self-service tools may be charged at our standard rates.

8. Personal data breaches

Walakulu will notify you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and will provide the information reasonably available to help you meet your own notification duties. Notifying regulators and individuals about your website is your responsibility. Our notification is not an admission of fault or liability.

9. Deletion

When your account ends, Walakulu will delete Customer Personal Data after the 30 day period described in the Terms, unless the law requires us to keep it. Copies in backups are deleted on their normal cycle and remain protected until then. Export your data before your account ends.

10. Information and audits

Walakulu will make available the information reasonably necessary to demonstrate compliance with this DPA, mainly through documentation, its providers' security certifications and written answers to reasonable questionnaires. If Data Protection Law requires more, you may audit Walakulu once a year with at least 30 days' written notice, during business hours, through an independent auditor bound by confidentiality, at your own cost, and without access to other customers' data.

11. Liability and precedence

Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Terms. If this DPA conflicts with the Terms on the processing of Customer Personal Data, this DPA applies to that conflict. Questions about this DPA: privacy@walakulu.com.