Terms and Conditions

1. The Provider

2. Definitions

• User: anyone who orders or uses the Services.
• Consumer: a natural person acting outside their trade, business or profession.
• Business: a person acting within their trade, business or profession.
• Website: the WordPress website named by the User to which a Service applies.
• Hub: the Provider's central cloud service, which schedules tasks, stores data and provides the dashboard.
• ITBit Assistant: the WordPress plugin installed on the Website that carries out the Hub's instructions.
• Emergency Entry: FTP or SFTP access to the Website's hosting that works independently of WordPress, and the service built on it under point 4.
• Services: the products and services listed in point 4.
• Partner: a Business taking part in the partner program under point 13 (web agency, freelancer, hosting provider) that buys the Services for its own clients' websites.
• Affiliate: a User taking part in the affiliate program under point 14 who brings new Users with their referral link or code and earns commission on them.

3. Scope and formation of the contract

1. These Terms apply to all Services provided on itbit.cc, scan.itbit.cc and the ITBit dashboard, for Consumers and Businesses alike. Where a provision applies only to Consumers or only to Businesses, the Terms say so.
2. The contract is concluded electronically, at a distance, when the Provider confirms the order by email. If no confirmation arrives within 48 hours, the User is released from their order.
3. Before registering and ordering, the User must accept these Terms and read the Privacy Notice. Placing an order creates an obligation to pay, as the label of the order button indicates.
4. Before sending the order, the User can correct input errors on the order page.
5. The contract language is Hungarian. The contract is not a written contract and is not filed by the Provider; order details and the confirmation remain available on the dashboard and by email.
6. The free security scan can be used without registering; the parts of these Terms on payment, withdrawal and warranty do not apply to it.

4. The Services

The detailed technical content of the Services is set out in the product descriptions at https://scan.itbit.cc/products, which form part of the contract. The Services build on each other and can only be ordered for WordPress websites.

1. Limits. Sentinel is not a real-time firewall; blocking attacks is the job of the web application firewall (WAF) set up by Lockdown. Emergency Entry does not prevent intrusions and does not restore the site; restoration is only part of "Help, I've been hacked!", which Sentinel does not include either.

   Purpose of restoration. "Help, I've been hacked!" aims to stop the intrusion and the related data loss, prevent further damage and restore the Website's security. The Provider does not undertake to return the Website to its original state. After restoration, some visual elements and functions of the Website (for example search, booking, calculators) may not work until the User's developer checks and restores them (see 5.7).

2. Prerequisites. Sentinel requires Security Lockdown: the annual Sentinel includes it, for the monthly Sentinel it must be bought separately. After restoration, "Help, I've been hacked!" also installs Security Lockdown and Emergency Entry; Emergency Entry keeps working free of charge after the 30-day monitoring until the User cancels it or the website moves to Sentinel. The Provider may end the free Emergency Entry with 30 days' notice by email. "Help, I've been hacked!" requires at least one of: a paired ITBit Assistant, a working Emergency Entry, or working FTP or SFTP access to the Website's hosting.
3. Time to complete. The Provider sets no deadline for "Help, I've been hacked!", because its length depends on the size and structure of the Website, the number and type of plugins (especially custom and premium plugins and themes), the kind of damage and how far the infection has spread. The Provider starts work as soon as payment has arrived and at least one access method under 4.2 is available.
4. Closing the case. "Help, I've been hacked!" is completed at the end of the 30-day monitoring, when the closing report is sent. If infected files remain after the repeated checks, a member of the Provider's staff reviews the findings and the report includes them. The guarantee for the monitoring period is in 8.3.
5. Third-party components. The Services use the free version of the Wordfence plugin and the Wordfence Intelligence database, so no licence fee applies. Their developer's terms also apply to them.
6. Changes. The Provider may improve the technical solutions of the Services as long as this does not reduce the functions promised.

5. The User's obligations and consents

1. Authority. The User warrants that the Website is theirs, or that they have the owner's written authority to order the Service and hand over access details. Scanning or changing someone else's website without permission is forbidden; the User is liable for any resulting damage. The same applies to the free scan.
2. Access details. The User provides real, working access: administrator rights for pairing, and FTP or SFTP details for Emergency Entry. If they change these, they update them on the ITBit dashboard. The Provider is not liable for failures caused by wrong or outdated details.
3. Service account. While the Service runs, the User does not delete or restrict the Provider's service admin account, its application password or the ITBit Assistant.
4. Consent to interventions. By ordering, the User expressly agrees that the Provider may carry out on the Website the operations described for the Service ordered, in particular:
   • updating and reinstalling plugins, themes and WordPress core, and removing unused themes;
   • changing configuration files (e.g. .htaccess, wp-config.php);
   • enforcing two-factor authentication and locking out admins who have not set it up after a grace period;
   • during restoration, temporarily locking the site (up to 6 hours), downgrading administrators, replacing sessions, keys and passwords, and quarantining files that cannot be replaced or look suspicious.
5. Steps that need separate consent. Another security plugin is replaced only with express consent given at purchase. A restore from backup that overwrites data starts only after the User's express confirmation.
6. Own backups. The User acknowledges that the Provider's backups do not replace their own backup obligations, and is advised to keep independent backups.
7. Custom code. The User acknowledges that custom or premium components may be quarantined during restoration, so some functions may not work until their developer checks and restores them. Quarantined items are not deleted.
8. Prohibited use. The Service may not be used for a website publishing unlawful content, or to attack or reverse-engineer the Provider's systems. If this is breached, the Provider may suspend the Service or terminate it with immediate effect.

6. Prices, payment, subscriptions

1. Prices. Current prices are at https://scan.itbit.cc/pricing. On the Hungarian site prices are in forints and include 27% Hungarian VAT for Consumers; for EU Businesses with a VAT number the invoice is issued under reverse charge, without VAT. Consumers are always shown the total amount payable. Payment in forints is only possible from Hungary, from a Hungarian IP address; from other countries payment is in euros, US dollars or pounds sterling.
2. Payment methods. Payment is by card, through Stripe. The Provider neither sees nor stores card details. The Provider may add further payment methods later; the order page shows the methods currently available.
3. Invoices. The Provider issues electronic invoices and sends them by email. Invoices are also available at https://scan.itbit.cc/account/purchases.
4. Start of performance. Performance starts once payment has arrived.
5. Subscriptions. Sentinel is available monthly or annually, Emergency Entry annually. The annual Sentinel price is in the price list under 6.1; it is a price of its own, not a discount (6.13); the annual Sentinel includes Security Lockdown, which must be bought separately for the monthly Sentinel. Fees are payable in advance at the start of each period.
6. Automatic renewal. A subscription renews for the same period at its end unless the User cancels before. Before an annual renewal, the Provider emails the amount and how to cancel at least 30 days in advance.
7. Cancellation. Services and subscriptions are cancelled at https://scan.itbit.cc/account. Cancellations within 14 days of the order are covered by point 7. A subscription cancelled after day 14 runs until the end of the paid period and then ends; no new fee is charged and the fee for the paid period is not refunded.
8. Price guarantee. The Provider does not raise the price of existing subscriptions: as long as a subscription continues without a break, the User pays the price that applied when it was taken out. Price changes apply only to new orders.
9. End of a subscription. On termination the Provider makes no new backups and keeps the stored backups for 90 days, during which the User can download them on the Backups page. The Provider emails the User when the 90 days start (with the deletion date) and 7 days before deletion, and on day 90 permanently deletes every backup it stores. The backup on the Website's own hosting is not deleted. If the User subscribes again before the deletion date, the backups are kept. The User may remove the ITBit Assistant and the service account.
10. Switching from Emergency Entry to Sentinel. As soon as Sentinel is active on a website, the Provider stops billing Emergency Entry for the same website and credits its unused, pro-rata fee against the Sentinel fee.
11. Backup freshness. With Emergency Entry and Sentinel the Provider undertakes that the latest backup it restores from is at most one week old. Emergency Entry takes a full backup and a database backup weekly. Sentinel takes a full backup weekly, a database backup every few days (typically every three days), and a backup before every intervention (e.g. an update).
12. Subscriber price for "Segítség, betörtek!" (Hacked-Site Recovery). If the User buys "Segítség, betörtek!" for a website that has an active Emergency Entry or Sentinel subscription at the time of purchase, they pay 15% less than the list price, rounded down to a whole forint, euro, dollar or pound. The subscriber price is tied to the website: a subscription for another of the User's websites does not qualify. The Provider applies it automatically at payment.
13. Discounts are not combined. One discount applies per purchase. Such discounts include coupons, the subscriber price under 6.12, the referral discount (point 14) and the partner discount (point 13). If the User qualifies for several discounts on a purchase, the Provider automatically applies the one that takes the largest amount off that payment. Annual fees are a price of their own, not a discount, so discounts apply to them too.

7. 14-day money-back guarantee and right of withdrawal

1. Guarantee. Within 14 days of ordering, the User may cancel any paid Service without giving a reason, and the Provider refunds the full fee without deduction. "Help, I've been hacked!" is the exception (7.4). The guarantee applies to Consumers and Businesses alike and includes the Consumer's statutory right of withdrawal.
2. Effects of cancellation:
   • Fix-It Guide: the User may keep the downloaded material.
   • Security Lockdown: the Provider reverses its changes and returns the Website to its state before the contract. After day 14 the hardened setup stays and the fee is not refunded.
   • Sentinel and Emergency Entry: the Provider switches the service off. The Security Lockdown included in the annual Sentinel is reversed as well.
3. How to cancel. Cancellation is made at https://scan.itbit.cc/account with the "Cancel / Withdraw from contract" function. Consumers may also withdraw by any other clear statement, including an email to info@itbit.cc or the model form in Annex 1. The Provider refunds within 14 days of the cancellation, using the original payment method.
4. "Help, I've been hacked!" Restoration starts immediately after the order, so the money-back guarantee does not apply to this service; the guarantee in 8.3 applies instead. When ordering, the Consumer expressly asks for performance to begin immediately and acknowledges that if they cancel after performance has begun they must pay for the service provided up to cancellation, and that they lose the right to cancel once the service has been fully performed. The proportionate fee is the sum of the shares of the stages completed by the time of cancellation: assessment and locking the site 20%, restoration 50%, installing Security Lockdown and Emergency Entry 15%, and 0.5% for each day of the 30-day monitoring. The dashboard records when each stage is completed.

8. Warranty, guarantee and liability

1. What the Provider undertakes. The Services significantly reduce the chance of a successful attack and prepare the Website for fast recovery. But no security service can give complete protection: a new, unknown vulnerability, a compromised device or password of the User, or a fault at the hosting provider can lead to an attack despite the Services. The Provider therefore does not undertake that the Website will never be successfully attacked or that all malicious code will be found. An attack despite the Services does not in itself mean that the Service was performed defectively.
2. Statutory warranty. The Provider is liable for performing the Services in line with the contract under the applicable law, including, for Consumers, the rules on digital content and digital services. In case of defective performance, the User may first ask for the service to be brought into conformity and, failing that, for a proportionate price reduction, or may terminate the contract.
3. Guarantee for "Help, I've been hacked!". If, during the 30-day monitoring, the Website is broken into again through a technical vulnerability despite the protection the Provider set up, the Provider restores it again free of charge. The guarantee does not cover intrusions using valid access details (for example a password obtained by phishing or otherwise), or through a component the User installed afterwards. The Provider analyses the new intrusion, examines whether the point of entry can be determined, and tells the User the result. If the point of entry cannot be determined, the Provider restores the Website free of charge in that case too.
4. Sentinel guarantee. If a Website monitored by Sentinel is broken into and the Provider restores it with "Help, I've been hacked!", the Provider refunds the restoration fee. There is no refund if the analysis made at the end of the restoration shows clearly that:
   • the intrusion came from the hosting side: the Website's files changed without a single request reaching WordPress, while the Provider's event log was working without gaps, the Website was clean just before, and the hosting's own access log, where it is available through Emergency Entry, shows no PHP file run directly on the Website and no write request missing from the event log (for example through the hosting account, FTP, the hosting control panel or another website on the same hosting); or
   • the damage was done through a normal login: the login of the session that did the damage is recorded in the Provider's event log before the damage, the event log has no gap for that period, and the login was either on an account without two-step sign-in or passed two-step sign-in too (in that case the password and the second step were obtained on the User's side, for example by phishing or from an infected device). In the latter case the fee is still refunded if the component handling the login or the two-step sign-in had a known vulnerability at the time.
5. Conditions and process of the Sentinel guarantee:
   • In every other case, including when the way in cannot be determined clearly or the evidence is incomplete, the Provider refunds the fee.
   • The guarantee starts when Sentinel is running on the Website, Security Lockdown has completed, and Sentinel's nightly check first finds nothing suspicious. It ends when Sentinel ends; with a new Sentinel subscription it starts again with the first clean check.
   • The guarantee can be used once per Website in 12 months.
   • The User pays the "Help, I've been hacked!" fee when ordering. The Provider decides at the end of the restoration, gives the reasons in the closing report together with the evidence (the login's time, account and IP address, or the first unexplained change), and in case of a refund pays the fee back to the original payment method at that time. The refund does not affect the monitoring and guarantee under 8.3.
   • The decision is based on the event log and hourly file snapshots stored on the Provider's servers, which the Website sends over every hour, so they cannot be changed on the Website afterwards. The User may dispute the decision at help@itbit.cc; the Provider then looks at the evidence again.
6. Safety measures. A backup is taken before every automatic change and a health check runs afterwards; if something fails, the change is rolled back. Restoration never deletes anything irreversibly.
7. The Provider is not liable for:
   • wrong or outdated access details given by the User, or damage caused by breaching the obligations in point 5;
   • faults of the hosting provider, third-party plugins, themes or Wordfence;
   • compatibility problems that come with new component versions, where it made rollback possible;
   • the consequences of changes the User makes based on the Fix-It Guide.
8. Limitation of liability (Businesses only). The Provider's liability for damages relating to a Service is limited to the fees paid for it in the 12 months before the event, and excludes lost profits and indirect damage.
9. These Terms do not limit the Provider's liability for intentional or fraudulent conduct, or for damage to life, body or health. Towards Consumers, liability can only be limited as far as the law of the Consumer's place of residence permits.
10. Website availability. The Website's availability depends mainly on the hosting provider; the Provider measures it but does not guarantee it. The Provider restricts the Website only in these cases: for a few minutes during the one-off Security Lockdown run (typically at most 10 minutes), when resolving a serious fault, and during restoration after an intrusion (5.4). In these cases the Provider does not undertake any minimum availability.

9. Data protection, data processing, security

1. The processing of the User's personal data (name, email, billing details) is governed by the Privacy Notice.
2. Data processing. Backups, logs and the Website's database may contain personal data of the Website's visitors. For that data the User is the controller and the Provider a processor under Article 28 GDPR. The terms of processing are in the Data Processing Agreement in Annex 2, which is concluded by accepting these Terms.
3. Security. The Provider stores access details and backups encrypted and keeps each owner's data separate. Backups can only be downloaded or restored on a request made from the User's own signed-in account.
4. Storage and sub-processors. The Provider stores backups encrypted on the Hub and in external cloud storage (Google Drive). Further processors handling Website data: Supabase (database and file storage, data in Ireland), Google (Google Drive, encrypted backup copies), Anthropic (AI security analysis, USA), Resend (sending email, USA), Telegram (alerts, if the User turns them on); the full list is in the Privacy Notice.
5. Notifications. Alerts are sent by email and, if the User chooses, by Telegram. An alert suggesting a repeat intrusion is checked by a member of the Provider's staff before it is passed on.

10. Intellectual property

1. The ITBit Assistant, the Hub, the dashboard, the report templates and the Fix-It Guide are the Provider's intellectual property.
2. During the Service the User may use the ITBit Assistant on their own Website. They may not pass this right on, and the Provider may grant similar rights to others. The User may use the Fix-It Guide and the reports to run their own Website without time limit, but may not publish or sell them.
3. The Website's content and data remain the User's property.
4. Reference. When connecting a Website the User may give the Website's name, address and logo, and may consent to the Provider showing them among its partners on its own websites and in its marketing materials, free of charge. Consent is optional and the User may withdraw it at any time at info@itbit.cc; the Provider then takes the listing down within 8 days. The User warrants that they are entitled to the name and logo they give.

11. Complaints and disputes

1. Complaints are made in writing to info@itbit.cc. There is no telephone or in-person customer service. The Provider answers written complaints on the merits, in writing, within 30 days, and gives reasons for any rejection.
2. If a complaint is rejected, a Consumer may turn to:
   • Conciliation board (Hungary): the board for the Consumer's place of residence or stay, or the one named in the request. List and contacts: https://bekeltetes.hu/udvozlo?id=testuletek. The Provider cooperates in conciliation board proceedings.
   • Consumer protection authority: the authority for the Consumer's place of residence.
   • Courts: the court with jurisdiction under the rules of civil procedure.
3. For disputes with Businesses, the parties agree to the exclusive jurisdiction of the courts of England and Wales.

12. Final provisions

1. Governing law. These Terms and the contract are governed by the law of England and Wales. For Consumers, this choice of law does not deprive them of the protection of the mandatory consumer protection rules of the law of their place of residence, and the provisions of these Terms that refer to those rules apply accordingly.
2. Changes to the Terms. The Provider may change these Terms unilaterally and does not send separate notice of a change. The version published at scan.itbit.cc/terms always applies, from the effective date shown at the top of that page. It is the User's responsibility to keep track of the current version. A change does not affect one-off Services already paid for. Anyone who does not accept a change may cancel their subscription.
3. If any provision of these Terms is invalid, the other provisions remain valid.
4. These Terms take effect on 11 November 2026. The Provider keeps earlier versions and sends the version that applies to a User on request.

13. Partner program (agencies and resellers)

1. Who can take part? Web agencies, freelancers and hosting providers, only as Businesses, by creating a partner account. The provisions for Consumers do not apply to Partners.
2. How it works. The Partner buys the Services in its own name for its clients' websites and invoices its clients itself, at prices it sets. The contract is between the Provider and the Partner; there is no contract between the Provider and the Partner's client. For these Terms, the Partner is the User.
3. Discount. The Partner gets a discount on list prices. Its size and conditions are set by the Provider's current partner offer or an individual agreement with the Partner; the partner account shows the current rate. The partner discount is not combined with other discounts; if a bigger discount applies to a purchase, that one is used under 6.13.
4. Applying the discount. The discount is the rate in force at the time of each purchase or subscription renewal. The price guarantee in 6.8 applies to list prices, not to the discount rate: the discount can rise or fall, and the price the Partner pays changes with it. The discount belongs to the partner account and cannot be transferred.
5. Conditions. There is no monthly fee, minimum purchase or lock-in. The Partner may leave at any time; Services already bought keep working until the end of the paid period.
6. The Partner's obligations towards its clients. The Partner:
   • obtains the owner's authority for every website (5.1);
   • informs its clients about the content and limits of the Services, especially 4.1 and 8.1;
   • is itself responsible towards its clients for its obligations as a reseller (its own terms, consumer protection and tax obligations);
   • ensures under point 7 of Annex 2 that its client agrees to the Provider acting as a sub-processor.
7. Refunds on partner accounts. The 14-day guarantee in point 7 applies to Partners too, per purchase, for the website the Service was bought for.
8. Changes to the program. The Provider may change the partner offer and the program's conditions under point 12.2, without separate notice; the current version of these Terms always applies. Individual agreements may differ.

14. Affiliate program

1. Participation. Every registered User takes part in the affiliate program automatically, Consumers and Businesses alike. Each Affiliate gets two referral links and a referral code: one link for the international site (itbit.cc) and one for the Hungarian site (itbit.cc/hu). Commission is the same whichever link or the code is used. Statements, commissions and their status are at https://scan.itbit.cc/affiliate.
2. How a referral is recorded. Each User can have one Affiliate: the registered User whose referral link or referral code they use first. Purchases require signing in, so the referral is recorded on the User's account: when they open the referral link or enter the referral code on the pricing page while signed in, or – if they clicked the link while signed out – when they sign in within 30 days of the click. The pricing page shows the recorded Affiliate's name, and no other code can be entered then. A recorded referral is permanent, applies to every later payment, and another Affiliate's link or code does not change it: commission still goes to the original Affiliate. The Provider does not move a referral to another Affiliate either. A referral ends in one case only: if the Affiliate closes their account. The Users they referred may then use another registered User's referral link or code, who becomes their new Affiliate. A User's own referral link or code records no referral. The visitor's browser keeps the click for 30 days only with cookie consent; without consent a referral by click is recorded only if the User signs in during the same visit. Entering the code works regardless of cookies. The Provider is not liable for commission lost this way.

   Discount for the referred User. The referred User gets a referral discount on their first purchase after their Affiliate is recorded, at the rate shown per product in the price list (currently 20%); for subscriptions it applies to the first payment only. Further purchases under the same Affiliate get no referral discount. If the User's referral ends because the Affiliate closed their account and they choose a new Affiliate, they get the discount again on their first purchase with the new Affiliate, at the rate then in force. Discounts are not combined (6.13): if a bigger discount applies to the first purchase, such as a partner price, coupon or subscriber price, the Provider applies that one. The referral discount then does not carry over to the next purchase either. Commission is paid on the net amount actually paid after the discount.

3. Commission. The Affiliate earns commission on every payment by the referred User – one-time purchases, subscriptions and their renewals alike – calculated on the net amount paid. The rate is currently 20%; the affiliate page shows the current rate. Commission is paid for as long as both the Affiliate and the referred User remain registered. Commission is paid on every payment the referred User makes, also when they got a discount or partner price on the purchase. If the referred User is a Partner, commission is paid on every purchase from their partner account, whether for their own website or their clients' websites. No commission is paid on payments by Users they refer in turn: the program has one level only.
4. Approval. Commission is pending until the 14-day guarantee in point 7 has expired, and approved after that. If the referred User asks for a refund, the commission on it is lost.
5. Payout. The Provider pays commission only against an invoice, so only an Affiliate entitled to issue invoices (a business) can receive a payout. On the first day of every month the Provider emails the Affiliate a statement of the previous month, also shown on the affiliate page; approved commission to be paid is put on a separate statement for each currency. The Affiliate issues the Provider an invoice for the statement amount as a net amount, under reverse charge, in the statement's currency, and uploads it on the affiliate page. If the invoice's net amount, currency, buyer and bank account match the statement, the Provider pays the amount, with no minimum, by bank transfer to the account the Affiliate gave, in the currency the referred User paid in. If the invoice differs from the statement, the Provider emails the difference and the payout waits until a corrected invoice is uploaded. Without an invoice, commission is not paid out; until then it stays recorded on the affiliate page. The Provider checks the bank details before the first transfer and after every change to them. The Provider is not liable for delays caused by wrong bank details.
6. Tax. Commission is the Affiliate's income; the Affiliate declares and pays any tax and contributions due on it.
7. Prohibited methods. An Affiliate may not earn commission on their own purchases, and may not use unsolicited messages (spam), misleading claims, or paid ads bidding on the ITBit name or domain. Affiliates must disclose that they are sharing a referral link or code. If these rules are breached, commission earned in breach is lost and the Provider may suspend the Affiliate's links and code. While suspended, Users the Affiliate already referred stay assigned to them but earn them no commission; the Affiliate's links and code give no discount, and no new referral is recorded to them. Suspension affects only the affiliate program: the user account and purchased Services keep working.
8. Partner and Affiliate at once. A User can be both a Partner and an Affiliate, but cannot receive both a partner discount and affiliate commission for the same website. If a Partner buys a Service from its partner account for a website that a User it referred also pays for, it earns no commission on payments for that website while a Service for it is active on the partner account. The referred User's contract with the Provider is unaffected, and their purchased Services keep working. Payments from user accounts created or managed by the Partner count as the Partner's own purchases (14.7).
9. Changes to the program. The Provider may change the commission rate and the program's conditions under point 12.2, without separate notice; the current version of these Terms always applies. Changes apply only to payments made after they take effect.

Annex 1 – Model withdrawal form

(Complete and return this form only if you wish to withdraw from the contract. You can also withdraw more simply with the "Cancel / Withdraw from contract" function at https://scan.itbit.cc/account.)

To: Attila Bognar-Tarjanyi (ITBit), 5200 Törökszentmiklós, Kiss János u. 6., Hungary; email: info@itbit.cc

I/We hereby give notice that I/we withdraw from my/our contract for the provision of the following service / supply of digital content:

• Service: …………………………
• Ordered on: …………………………
• Name of consumer(s): …………………………
• Address of consumer(s): …………………………
• Signature of consumer(s) (only if this form is notified on paper): …………………………
• Date: …………………………

Annex 2 – Data Processing Agreement

(Under Article 28(3) GDPR. The agreement is concluded by ordering a Service and accepting these Terms.)

1. Parties. Controller: the User. Processor: the Provider (details in point 1 of the Terms).
2. Subject and duration. While providing the Services, the Processor has access to personal data stored on the Website. The agreement lasts for the term of the Service and until the backups are deleted under 6.9 of the Terms.
3. Data and data subjects. Data stored in the Website's database and files, in particular names, email addresses, usernames and IP addresses of the Website's users, comments, messages sent through forms, for shops order data, and the IP addresses, requested addresses, times and browser identifiers in the hosting's access log. Data subjects: visitors, registered users and customers of the Website, and the Controller's staff. If the Website processes special categories of data (e.g. health data), the Controller informs the Processor in advance.
4. Nature and purpose of processing. Backup, encrypted storage, file integrity and malware checks (automated and AI-assisted), updates and their rollback, restoration, for shops keeping the order journal, and keeping a copy of the hosting's web access log of the Website, taken through Emergency Entry, and examining it for the Sentinel guarantee decision (point 8.4), solely to provide the Service ordered. The Processor does not use the data for its own purposes, analyse its content or pass it on.
5. The Processor's obligations. The Processor:
   • processes the data only on the Controller's documented instructions, which include these Terms and the description of the Service ordered, and promptly says if it believes an instruction is unlawful;
   • ensures that persons with access to the data are bound by confidentiality;
   • takes the security measures required by Article 32 GDPR: encryption at rest and in transit, access restriction, separation of each owner's data, logging;
   • may engage further processors under the general authorisation given in this point, on the same data protection obligations. It sends the list on request and announces changes at least 14 days in advance by email. The Controller may object, and if no solution is found, may terminate the Service;
   • assists the Controller in responding to data subject requests and in meeting the obligations in Articles 32–36 GDPR;
   • notifies the Controller of any personal data breach it becomes aware of without undue delay and at the latest within 24 hours;
   • deletes the data when the Service ends, under 6.9 of the Terms; before deletion, makes the backups available for download on the Controller's request;
   • makes available to the Controller all information needed to demonstrate compliance with this agreement, and allows audits by prior arrangement.
6. Transfers. The Processor transfers data outside the European Economic Area only with safeguards under Chapter V GDPR. The Controller acknowledges that during malware analysis excerpts of the files examined are sent to Anthropic's AI service (USA), which processes them as a sub-processor with Chapter V safeguards and does not use them to train models.
7. The Controller's obligations. The Controller is responsible for having a legal basis for the data processed on the Website, and for its privacy notice mentioning the use of a processor.

   Services bought by a Partner. If the User is a Partner buying a Service for a client's website, the client is the controller, the Partner the client's processor and the Provider a sub-processor. In that case this agreement is between the Partner and the Provider, and the Partner ensures that its client authorises the use of the Provider under Article 28(2) and (4) GDPR.

8. Retention. During the Service the Processor keeps the data for the following periods and then deletes it automatically: database backup on the Website's hosting: the newest only; on the Hub: 30 days (the very first backup at most 90 days); on Google Drive: the latest 14 backups (Emergency Entry alone: 4); weekly full file archives: the latest 4; shop order journal: 30 days; copies of the hosting's access log (weekly and when a recovery starts): 4 weeks; when a hacked Website is restored, the copy of its infected state: 120 days. The Controller may quote these periods in its own privacy notice. When the account is deleted, the backups and log copies are deleted without delay.
9. Signed version and governing law. On the Controller's request (info@itbit.cc) the parties may also sign a detailed version of this agreement, which then applies instead of this Annex. Notwithstanding the choice of law in point 12, this agreement is governed by the GDPR and Hungarian law.