This article is a starting point for forum administrators who need to run their forum in line with the General Data Protection Regulation (GDPR), and similar laws such as the UK GDPR and the Swiss Federal Act on Data Protection (FADP). It collects the tools built into Website Toolbox and the related help articles in one place.
Be transparent about cookies and consent
Privacy laws require you to tell your visitors what cookies your forum sets, what they are for, how long they last, and who sets them. The cookie list article gives you the full list for your forum, ready to copy into your own privacy documentation.
If your forum also runs optional services, such as analytics or advertising, you must ask visitors for consent before those services run. The cookie consent dialog article shows you how to add a consent banner to your forum with copy-paste code.
Handle requests about member data
Members in the European Union and similar jurisdictions can ask you for a copy of their data, or ask you to delete it. You can export your forum's content from the admin area with the forum content export, and you can delete a user and their posts from the admin area. Keep a record of what you did for each request.
Our data retention article explains how long Website Toolbox keeps forum data in backups and in active storage, which you may need when answering questions about deletion.
Use a Data Processing Agreement
For data protection law, Website Toolbox acts as the data processor and you act as the controller for your forum's data. We offer a Data Processing Agreement (DPA) that you can review and download; it covers our obligations, your choices for data return or deletion, and the list of our sub-processors. See also Is the forum GDPR compliant? for the short answer.
Keep your own documentation current
Publish a privacy policy on your website that matches your forum's actual settings, review it when you add integrations, and respond to member requests promptly. Where a visitor questions a specific technology on your forum, the cookie list article describes each cookie's purpose and duration so you can answer without guessing.
Common compliance questions
Is Website Toolbox certified under the EU-U.S. or Swiss-U.S. Data Privacy Framework?
No. Website Toolbox is not certified under the Data Privacy Framework. International data transfers are covered by our Data Processing Agreement, which provides for Standard Contractual Clauses where data is transferred outside the EEA.
Where is my forum hosted?
All Website Toolbox infrastructure is located in the United States. We do not offer EU data centers or EU-only hosting.
Does Website Toolbox hold SOC 2 or ISO 27001 certifications?
No. Website Toolbox does not hold these certifications itself. Our infrastructure sub-processors (Amazon AWS and Google Cloud Platform) hold them, and the technical and organizational measures for our sub-processors are listed in Appendix A of our Data Processing Agreement.
Can we get our own version of the DPA, or other custom GDPR changes?
Our DPA is a standard agreement and it already provides for Standard Contractual Clauses where data is transferred outside the EEA. Custom GDPR work (for example added clauses, advance notice of sub-processor changes, or a fixed breach-notification window) requires a Pro plan subscription; custom changes to the DPA are an Enterprise-plan feature with separate additional one-time and monthly fees. We assess each request individually and we may be able to fulfill your request.
How do we get a signed copy of the DPA?
Send a request through our contact form, where the subject line is pre-filled for DPA requests. A Pro plan subscription is required. We review each request and return a countersigned copy of the Data Processing Agreement to the requesting organization's contact.
Does the forum's bot protection share data with Google?
Google reCAPTCHA runs only when a visitor must prove they are human, so ordinary visitors never see it. At that moment Google may process the visitor's IP address and browser details under Google's own policies, and this is treated as strictly necessary for security. If you would prefer not to use it on your forum, contact us and we can discuss the options for your forum.
How long is data retained?
Data protection laws do not set fixed retention periods. They require keeping data only as long as it is necessary for its purpose, and stating either the period or the criteria used to set it (for example GDPR Article 13 and Swiss FADP Article 25). Forum data is kept while the account is active, and for a limited period afterwards only where still needed for legal obligations, disputes, rule enforcement, or security. Technical records such as server logs and IP addresses are kept only as long as they are needed for security and abuse prevention, and deleted content is removed from active systems promptly and ages out of rotating backups on their normal cycle. See our data retention article for platform-level details.