Updated on 14 August 2026.
1.1. This agreement (the “DPA”) sets out the conditions under which LIVEN STUDIO (the “Processor”) processes personal data on behalf of the User (the “Controller”) in connection with the WP UMBRELLA solution (the “Solution”), in accordance with Article 28 of Regulation (EU) 2016/679 (“GDPR”) and Law No. 78-17 of 6 January 1978.
1.2. The DPA forms an integral part of the contract. In case of conflict, the order of precedence in art. 4 of the T&C applies (T&C, then DPA, then privacy policy). The DPA prevails over the privacy policy for all matters concerning processing carried out by LIVEN STUDIO as a processor.
1.3. The DPA takes effect on the creation of the User’s account and remains applicable for as long as LIVEN STUDIO carries out processing on the User’s behalf.
Personal Data, Processing, Controller, Processor, Sub-processor, Data Subject and Personal Data Breach have the meaning given by the GDPR. For the purposes of this DPA: the Controller in relation to LIVEN STUDIO is the User; the Processor is LIVEN STUDIO; Documented Instructions are the User’s written, electronic or contractual instructions, of which the T&C and this DPA form the initial basis.
3.1. The User acts as Controller (or itself as processor for its own end clients); LIVEN STUDIO acts as Processor. For processing that LIVEN STUDIO performs as a controller (management of its site, billing, prospecting), the User is referred to the privacy policy.
3.2. Cascading sub-processing. LIVEN STUDIO processes data of the User’s end clients and of persons interacting with their sites. The User represents and warrants, to the extent applicable, that it has obtained all necessary rights, authorisations and instructions from its customers and data subjects, and where the User acts as a processor on behalf of its own customers, that it has entered into an appropriate data processing agreement covering the processing performed through the Solution.
4.1. Nature and purposes: automatic backup of sites; security hardening; production of maintenance reports; performance, uptime and security monitoring; database cleanup; access via the public API and MCP server. Operations: consultation, structuring, export, retention, transmission, deletion.
4.2. Categories of data subjects: the User’s end clients (site publishers); persons interacting with those sites (administrators, users, internet users).
4.3. Categories of data: end-client identification data (name, first name, site address, email, telephone); data stored on the end client’s site depending on its configuration (civil status, identity, images; connection data, IP addresses, logs, identifiers, timestamps; location data; personal-life data). The User warrants that no special-category data (art. 9 GDPR) is entrusted under this DPA without appropriate measures agreed in writing beforehand.
4 bis.1. Scope and trigger. This article applies only where the User orders an On-demand Service (Security Audit or Malware Removal, governed by Annex 1 to the T&C). The User’s order of the service constitutes its documented instruction (art. 28 GDPR) to carry out the processing described below, including transmission of data to the AI sub-processor (art. 4 bis.3). Absent an order, none of the processing described in this article is carried out and no data is transmitted to that sub-processor. A User who does not wish this processing refrains from ordering the service; accordingly, the 30-day prior information and objection procedure (art. 8.2) does not apply to this sub-processor for the User who orders.
4 bis.2. Nature, purposes and data. AI-assisted analysis of the elements of the designated site (files, database contents, logs, configuration) for the purposes of security diagnosis and malware detection/remediation. Operations: transmission to the AI provider, analysis, production of findings and a report, return to LIVEN STUDIO, deletion. The categories of data subjects are identical to art. 4.2. The data submitted may contain personal data of the site’s end clients and users; the User warrants that no special-category data (art. 9 GDPR) is entrusted without appropriate measures agreed in writing beforehand (art. 4.3) and endeavours to limit the data exposed where technically feasible.
4 bis.3. Sub-processor — Anthropic. LIVEN STUDIO engages Anthropic PBC (San Francisco, USA) for the provision of the AI model (“Claude”). Anthropic processes the submitted data solely to return the analysis to LIVEN STUDIO and does not use that data to train its models. LIVEN STUDIO concludes with Anthropic a data processing agreement imposing data-protection obligations equivalent to those of this DPA (art. 8.3) and remains fully liable to the User for Anthropic’s performance of its obligations (art. 8.4). Anthropic appears on the list of sub-processors provided on request (art. 8.1).
4 bis.4. Transfer outside the EU. As Anthropic is established in the United States, the processing entails a transfer of Personal Data outside the EEA. LIVEN STUDIO shall ensure that any such transfer is made pursuant to a valid transfer mechanism under Chapter V GDPR. Where the transfer is covered by a valid adequacy decision, including the EU–US Data Privacy Framework where Anthropic holds a valid certification, LIVEN STUDIO may rely on that decision. Where no adequacy decision applies, LIVEN STUDIO shall implement appropriate safeguards under Article 46 GDPR, namely the Standard Contractual Clauses adopted under Implementing Decision (EU) 2021/914, Module 3 (processor-to-processor), completed with the appropriate annexes and, where required, a transfer impact assessment (TIA). Data in transit is encrypted (TLS).
4 bis.5. Retention. Data transmitted to Anthropic for an On-demand Service is deleted upon completion of the intervention, subject to the limited technical retention applied by the provider for security and abuse-prevention purposes. The audit report and the summary of actions are made available to the User (Annex 1 to the T&C, A.9) and deleted according to the timeframes of art. 14 at the end of the contract.
4 bis.6. Applicable provisions. Articles 7 (security), 10 (assistance), 11 (breach — notification within 48h), 13 (audit) and 15 (liability) apply to this processing. A pre-existing compromise of the site falls to the User as controller, LIVEN STUDIO assisting under this DPA.
4 ter.1. Scope and basis. This article applies to a User subscribed to the Security add-on (T&C art. 7.2.1). From time to time, to detect malware, the malware scan may be assisted by an AI provider. By subscribing to or maintaining the Security add-on under the T&C, the User provides LIVEN STUDIO with its documented instruction within the meaning of Article 28 GDPR to carry out the processing described in this Article, including the occasional transmission of elements of the designated site to the AI sub-processor, for as long as the User has not disabled AI-assisted scanning. Anthropic is engaged as a sub-processor under the general authorisation (art. 8.1); its introduction is notified under the prior-information-and-objection procedure of art. 8.2, which applies to this sub-processor (unlike the on-demand processing governed by art. 4 bis). The User may disable this AI assistance at any time, for a given site or for the whole account, from the Application; the malware scanner continues to operate without it and the transmission ends for the future.
4 ter.2. Nature, purposes and data. Occasional AI-assisted analysis of elements of the designated site, which may include files, database contents, logs or configuration, for the sole purpose of detecting malware and security threats, performed from time to time while AI-assisted scanning remains active. Operations include transmission to the AI provider, analysis, return of findings to LIVEN STUDIO and deletion of Personal Data following the analysis. The categories of data subjects are identical to those described in Article 4.2. The data submitted may contain Personal Data of the site’s end clients and users. The User shall not intentionally submit Special Categories of Personal Data within the meaning of Article 9 GDPR or Personal Data relating to criminal convictions and offences through this processing unless expressly authorised by LIVEN STUDIO in writing and subject to appropriate safeguards. LIVEN STUDIO applies data minimisation and shall transmit only data reasonably necessary to perform the analysis. Personal Data is processed solely for the purpose of performing the analysis for the User and shall not be used to train, fine-tune or otherwise improve any general-purpose AI model or malware detection model. Following the analysis, LIVEN STUDIO may retain aggregated, anonymised or otherwise non-personal threat indicators derived from the analysis, such as malware signatures, patterns or indicators of compromise, solely to maintain, secure and improve the malware detection service. Such retained indicators shall not contain Personal Data.
4 ter.3. Sub-processor — Anthropic. LIVEN STUDIO engages Anthropic PBC (San Francisco, USA) for the provision of the AI model (“Claude”). Anthropic processes the submitted data solely to return the analysis to LIVEN STUDIO and does not use that data to train its models. LIVEN STUDIO concludes with Anthropic a data processing agreement imposing data-protection obligations that are materially equivalent to those applicable to LIVEN STUDIO under this DPA, insofar as relevant to the processing entrusted to Anthropic (art. 8.3), and remains fully liable to the User for Anthropic’s performance of its obligations (art. 8.4). Anthropic appears on the list of sub-processors provided on request (art. 8.1).
4 ter.4. Transfer outside the EU. As Anthropic is established in the United States, the processing may involve a transfer of Personal Data outside the EEA. LIVEN STUDIO shall ensure that any such transfer is made pursuant to a valid transfer mechanism under Chapter V GDPR. Where the transfer is covered by a valid adequacy decision, LIVEN STUDIO may rely on that decision. Where no adequacy decision applies, LIVEN STUDIO shall implement appropriate safeguards under Article 46 GDPR, including the applicable Standard Contractual Clauses adopted by the European Commission under Implementing Decision (EU) 2021/914, with the appropriate module and annexes completed to reflect the actual roles of the parties and the relevant transfer. Where required, LIVEN STUDIO shall carry out and maintain an appropriate transfer impact assessment. Data in transit is encrypted using industry-standard encryption.
4 ter.5. Retention. Personal data transmitted to Anthropic for an analysis is deleted upon completion of that analysis, subject only to any limited retention strictly required by the provider for security, abuse-prevention or legal-compliance purposes. No copy is retained by the AI provider for other purposes, and the data is not used to train, fine-tune or otherwise improve its models using the User’s Personal Data. Only non-personal threat indicators (art. 4 ter.2) may be retained by LIVEN STUDIO.
4 ter.6. Applicable provisions. Articles 7 (security), 8 (sub-processing — including the information/objection procedure of art. 8.2), 10 (assistance), 11 (breach — notification within 48h), 13 (audit) and 15 (liability) apply to this processing.
5.1. LIVEN STUDIO processes data only on the User’s documented instructions, including for transfers outside the EU, and does not use it for its own purposes.
5.2. LIVEN STUDIO informs the User without delay if, in its opinion, an instruction infringes the GDPR or another applicable data-protection provision; LIVEN STUDIO may suspend performance of the instruction concerned until it is confirmed or amended.
5.3. Where LIVEN STUDIO is required by Union or Member State law to carry out a processing operation (in particular a transfer), it informs the User before processing, unless that law prohibits it on important public-interest grounds.
LIVEN STUDIO ensures that persons authorised to process the data (staff, contractors) are bound by an appropriate confidentiality obligation. This obligation operates together with art. 16 bis of the T&C (mutual confidentiality) and survives the end of the contract.
7.1. LIVEN STUDIO implements appropriate technical and organisational measures designed to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing. Such measures include, as appropriate, encryption of Personal Data at rest and in transit using industry-standard technologies, access controls, multi-factor authentication for privileged access, role-based access restrictions, logging and monitoring, data minimisation, backup and recovery measures, vulnerability management, incident-response procedures and measures designed to ensure the ongoing confidentiality, integrity, availability and resilience of the Services.
7.2. These measures may be modified or updated from time to time to reflect technological developments, changes to the Services or the state of the art, provided that LIVEN STUDIO maintains an appropriate level of security having regard to the requirements of Article 32 GDPR.
8.1. General authorisation. The User grants LIVEN STUDIO a general authorisation to engage sub-processors for hosting, payment, audience measurement, infrastructure and AI-assisted security analysis. The current list of sub-processors is provided on request at support@wp-umbrella.com.
8.2. Notification of changes. LIVEN STUDIO informs affected Users at least thirty (30) days before any addition or replacement of a sub-processor, by email or notice in the User space, and gives them the opportunity to object on reasonable data-protection grounds. Failing a resolution, the User may terminate the affected Services without penalty, with a refund of any unused prepaid credit (T&C art. 7.3). (For the AI-assisted malware scanner (art. 4 ter), a User who does not wish this sub-processing may instead simply disable AI-assisted scanning while keeping the rest of the Security add-on.)
8.3. Equivalence of obligations (flow-down). LIVEN STUDIO shall impose on each sub-processor, by contract or other legal act, data-protection obligations that are materially equivalent to those applicable to LIVEN STUDIO under this DPA, insofar as relevant to the processing entrusted to that sub-processor, including appropriate confidentiality, security, assistance, deletion and audit obligations.
8.4. Liability. LIVEN STUDIO remains fully liable to the User for its sub-processors’ performance of their obligations.
9.1. Data is processed within the European Economic Area (EEA), except as provided in articles 4 bis, 4 ter and 9.2. The Application is hosted on servers located in the EU.
9.2. Where a sub-processor or other recipient is located outside the EEA in a country for which no adequacy decision applies, LIVEN STUDIO shall ensure that any transfer of Personal Data is subject to an appropriate transfer mechanism under Chapter V GDPR, including appropriate safeguards under Article 46 GDPR where applicable. Where the Standard Contractual Clauses adopted by the European Commission under Implementing Decision (EU) 2021/914 are used, LIVEN STUDIO shall use the module and annexes appropriate to the actual roles of the parties and the relevant transfer. Where required, LIVEN STUDIO shall carry out and maintain an appropriate transfer impact assessment. Where a valid adequacy decision applies, LIVEN STUDIO may rely on that decision.
10.1. Data-subject rights. LIVEN STUDIO assists the User, through appropriate technical and organisational measures and insofar as possible, in responding to requests to exercise rights (arts. 12 to 23 GDPR).
10.2. User obligations (arts. 32 to 36). LIVEN STUDIO assists the User, taking into account the nature of the processing and the information available to it, with: security (art. 32); notification of a breach to the supervisory authority and to data subjects (arts. 33 and 34); data protection impact assessments (art. 35); prior consultation (art. 36).
In the event of a personal data breach, LIVEN STUDIO notifies the User without undue delay and no later than forty-eight (48) hours after becoming aware of it. The notification describes the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed.
12.1. In accordance with art. 30(2) GDPR, LIVEN STUDIO maintains a record of processing carried out on the User’s behalf.
12.2. LIVEN STUDIO’s privacy point of contact is Mr Aurelio Volle, reachable at support@wp-umbrella.com. As LIVEN STUDIO is established in the Union, it is not required to designate a representative within the meaning of art. 27 GDPR.
13.1. LIVEN STUDIO makes available to the User all information necessary to demonstrate compliance with the art. 28 obligations and allows for and contributes to audits, including inspections.
13.2. Terms: once per twelve (12) month period (and following a confirmed breach affecting the User), on reasonable prior notice of at least thirty (30) days, during business hours, without disrupting operations. An audit may take the form of a questionnaire, the provision of existing certifications or reports, or a documentary/on-site review conducted by the User or a mandated third party bound by confidentiality. Each party bears its own costs, except where the audit reveals a material non-compliance, in which case LIVEN STUDIO bears the reasonable costs of the review.
14.1. At the User’s choice, LIVEN STUDIO deletes or returns all personal data at the end of the contract, and deletes existing copies, unless legally required to retain them.
14.2. Timeframes: deletion within ninety (90) days of the end date; residual backups are deleted within fifty (50) days (consistent with T&C arts. 10.2 and 11.3). On request made before the end date, LIVEN STUDIO provides a machine-readable copy (CSV/JSON).
14.3. Free trial: trial data (dashboard, backups, reports) is deleted ninety (90) days after the end of the trial (consistent with T&C art. 6).
14.4. LIVEN STUDIO may retain anonymised or aggregated data that does not allow re-identification.
The parties’ liability under this DPA is governed by article 20 of the T&C, without prejudice to the allocation provided for in article 82 GDPR.
The DPA takes effect on account creation and applies for the duration of the processing. It is governed by French law; any dispute falls under the courts having jurisdiction under article 22 of the T&C. The English version of this DPA is authoritative and prevails over any other version.
