to the Data Processing Agreement (Art. 28 GDPR) · Version 1 · 24 October 2026
This addendum supplements the Data Processing Agreement (“DPA”) between Magic Pages e.U. (“Service Provider”) and the Customer. Terms defined in the DPA have the same meaning here. Where this addendum and Annex A of the DPA differ for Form Data, this addendum prevails. Everything else in the DPA applies unchanged.
1. Forms
The Service Provider serves the following forms and pages on the Customer’s site, on the site’s own host, when the Customer switches them on (“Forms”):
(a) the contact form;
(b) the pages for withdrawing from and cancelling a contract with the Customer.
What visitors submit through a Form, and the data needed to deliver and protect it, is “Form Data”.
2. Data Subjects
Visitors to the Customer’s website who use a Form.
3. Categories of Personal Data
Contact form. Name (if given), email address, message, language, time of receipt, whether the Customer has marked it answered.
Withdrawal and cancellation pages. Name, email address, contract reference, type of cancellation, reason given, requested end date, the text of the page the visitor confirmed, time of receipt, and the result of matching the declaration against the Customer’s Ghost members and their subscriptions.
While a Form is used. IP address and browser metadata, processed to deliver the Form and to limit abuse, and not stored with the submission.
No special categories of personal data within the meaning of Art. 9 GDPR are requested. A visitor may still enter them in a free-text field; the Customer is responsible for asking visitors not to.
4. Nature and Purpose
Serving the Forms; protecting them against spam, including a proof-of-work task the visitor’s browser solves; storing submissions; delivering them to the Customer by email and in the customer portal; sending visitors the receipts the Forms provide for (declarations only); and deleting submissions.
5. Instructions
The Customer’s settings for a Form in the customer portal (switching it on or off, the notification address, the privacy policy link, the texts, what visitors without JavaScript see, and the retention period) are documented instructions under Section 4 of the DPA.
6. Retention
Contact messages are deleted automatically when the retention period the Customer chose for the site ends (1, 3, 6 or 12 months; 6 by default). The Customer can delete a message earlier. Declarations are kept for the duration of the Agreement as the Customer’s evidence of receipt. Section 10 of the DPA applies to all Form Data on termination.
7. Sub-processors
The Sub-processors in Annex B of the DPA. Form Data is processed by no other Sub-processor.
8. The Customer’s Responsibilities
The Customer remains the Controller. The Customer informs visitors about the processing, in particular through the privacy policy each Form links to, and decides whether a Form meets their own legal obligations, such as those on contact details, withdrawal and cancellation.
9. Conclusion and Term
The parties sign this addendum electronically through the Service Provider’s signing service. It applies from the Customer’s signature, for as long as the Service Provider processes Form Data for the Customer. Switching all Forms off does not end it while Form Data is still stored.
Last updated: 24 October 2026
