Forum owners contact Website Toolbox with the same GDPR questions again and again. This article collects the questions clients typically ask us and our answers in one place, so you can use it directly for your own compliance documentation.
Is Website Toolbox certified under the EU-U.S. or Swiss-U.S. Data Privacy Framework?
No. Website Toolbox is not certified under the Data Privacy Framework. International data transfers are covered by our Data Processing Agreement, which provides for Standard Contractual Clauses where data is transferred outside the EEA.
Which sub-processors process our members' data, and do any of them run on our forum?
Our sub-processors are listed in Appendix A of our Data Processing Agreement. Analytics and advertising tags and the Olark support chat appear only on Website Toolbox platform pages and in the admin area, never on your forum's discussion pages - this is described in the "Third parties in the admin area" section of our cookie list article. Message text is sent to the Google Perspective API for inappropriate-content analysis only when AI moderation is enabled for your forum.
Do you notify us in advance of sub-processor changes?
Our standard DPA allows sub-processor changes without prior notice. An advance-notice commitment is a custom GDPR request: it requires a Pro plan subscription, custom changes are an Enterprise-plan feature with separate additional one-time and monthly fees, and we assess each request individually and may be able to fulfill your request.
Where is my forum hosted?
All Website Toolbox infrastructure is located in the United States. We do not offer EU data centers or EU-only hosting.
Can you commit to a fixed breach-notification window, for example 24 or 48 hours?
Our DPA commits to notification without undue delay. A fixed window is a custom GDPR request under the same terms as an advance-notice commitment: a Pro plan subscription is required, custom changes are an Enterprise-plan feature with separate additional one-time and monthly fees, and we assess each request individually and may be able to fulfill your request.
How long is data retained?
Data protection laws do not set fixed retention periods. They require keeping data only as long as it is necessary for its purpose, and stating either the period or the criteria used to set it (for example GDPR Article 13 and Swiss FADP Article 25). Forum data is kept while the account is active, and for a limited period afterwards only where still needed for legal obligations, disputes, rule enforcement, or security. Technical records such as server logs and IP addresses are kept only as long as they are needed for security and abuse prevention, and deleted content is removed from active systems promptly and ages out of rotating backups on their normal cycle. See our data retention article for platform-level details.
What cookies does my forum set, and do we need a consent banner?
Privacy laws require you to tell your visitors what cookies your forum sets, what they are for, how long they last, and who sets them. Our cookie list article gives you the full list, ready to copy into your own privacy documentation. If you add optional services such as analytics or advertising, you must ask visitors for consent before those services run - the cookie consent dialog article shows you how to add a consent banner with copy-paste code.
A member asked for a copy of their data, or asked us to delete it. What do we do?
You can export your forum's content from the admin area with the forum content export, and you can delete a user and their posts from the admin area. How long deleted data and backups are then retained is covered by the retention answer above and by our data retention article. Keep a record of what you did for each request.
Do you offer a Data Processing Agreement?
Yes. For data protection law, Website Toolbox acts as the data processor and you act as the controller for your forum's data. Our Data Processing Agreement (DPA) covers our obligations, your choices for data return or deletion, and the list of our sub-processors. See also Is the forum GDPR compliant? for the short answer.
What do we need to include in our own privacy policy?
Publish a privacy policy on your website that matches your forum's actual settings, and review it when you add integrations. For the technology details on your forum, the cookie list article describes each cookie's purpose and duration so you can answer visitor questions without guessing.
Does Website Toolbox hold SOC 2 or ISO 27001 certifications?
No. Website Toolbox does not hold these certifications itself. Our infrastructure sub-processors (Amazon AWS and Google Cloud Platform) hold them, and the technical and organizational measures for our sub-processors are listed in Appendix A of our Data Processing Agreement.
Can we get our own version of the DPA, or other custom GDPR changes?
Our DPA is a standard agreement and it already provides for Standard Contractual Clauses where data is transferred outside the EEA. Custom GDPR work (for example added clauses, advance notice of sub-processor changes, or a fixed breach-notification window) requires a Pro plan subscription; custom changes to the DPA are an Enterprise-plan feature with separate additional one-time and monthly fees. We assess each request individually and we may be able to fulfill your request.
How do we get a signed copy of the DPA?
Send a request through our contact form, where the subject line is pre-filled for DPA requests. A Pro plan subscription is required. We review each request and return a countersigned copy of the Data Processing Agreement to the requesting organization's contact.
Does the forum's bot protection share data with Google?
Google reCAPTCHA runs only when a visitor must prove they are human, so ordinary visitors never see it. At that moment Google may process the visitor's IP address and browser details under Google's own policies, and this is treated as strictly necessary for security. If you would prefer not to use it on your forum, contact us and we can discuss the options for your forum.