For Squarespace
Data Processing Agreement

The DPA, pre-signed.

Effective 21 May 2026; last updated 23 October 2026. Pengon (Quad Studio) is the Processor; the Pengon customer is the Controller. By creating a Pengon account and installing the snippet, you accept this DPA on behalf of your organisation. No separate signature required.

1. Parties

Processor: Quad Studio, Zürich, Switzerland (“Pengon”, “we”).

Controller: The natural or legal person who operates the Squarespace site on which the Pengon snippet is installed (“Customer”, “you”).

Agencies and freelancers: someone who sets Pengon up or manages it for a site’s operator acts on the operator’s behalf. If the Pengon account is the operator’s own, the operator is the Controller and party to this DPA. If an agency holds the account for a client, the agency accepts this DPA as its client’s processor, Pengon is the agency’s sub-processor, and the agency passes these terms on to its client.

This DPA supplements the Terms of Service and forms part of the agreement between the parties. It implements the requirements of GDPR Art. 28 (EU 2016/679), the UK GDPR, and the Swiss Federal Act on Data Protection (revFADP, in force since 1 September 2023).

2. Subject matter & duration

Subject matter: Pengon classifies submissions from the Customer’s Squarespace contact forms as “spam” or “clean” using AI, and stores them in a dashboard for human review. Pengon checks each submission before Squarespace receives it: one classified as spam is held back and never reaches Squarespace or anything connected to the form, until the Customer recovers it.

Duration: For the lifetime of the Customer’s Pengon account. Terminates automatically when the account is deleted.

3. Nature & purpose of processing

Processing consists of receiving form submissions, running them through an AI classifier, storing the classification result and the submission text, and presenting them in the Customer’s dashboard. Purpose: spam filtering for the Customer’s contact-form inbox. If the Customer turns on visitor copies, processing also includes emailing the visitor a copy of their own submission, on the Customer’s behalf, for submissions that pass the spam filter. Pengon also emails the Customer about its own site: alerts, a weekly digest and recovered messages, which can include parts of submissions.

Training examples. When the Customer corrects a classification (Recover or Report spam), Pengon keeps that message’s text as a training example, with the sender’s name, email addresses, links and phone numbers replaced by tokens and without any link to the Customer, its site or the sender. Pengon uses these examples only to test and improve its spam filter, never shares them, and keeps them for as long as they are useful for that. The Customer authorises this use. Because the examples aren’t linked to an account, Pengon can find and delete one only from its text.

4. Categories of data subjects

Visitors who submit the Customer’s Squarespace contact form - typically prospective clients, leads, or members of the public reaching out.

5. Categories of personal data

Pengon does not intentionally collect special-category data (GDPR Art. 9). If a visitor voluntarily includes such data in a free-text message field, it’s stored alongside the rest of the message until the submission is deleted.

Retention: submissions are deleted automatically 90 days after they arrive, or sooner when the Customer deletes them. Security logs are kept for 90 days. Nightly backups of the database are kept for 30 days.

6. Processor obligations

Pengon will:

7. Sub-processors

The Customer authorises Pengon to engage the following sub-processors:

We’ll give 30 days’ notice by email before adding or replacing a sub-processor. The Customer may object on legitimate data-protection grounds; if we can’t resolve the objection, the Customer may terminate this DPA and the Pengon account with a pro-rated refund as described in Terms §7.

8. International transfers

Some sub-processors are based outside Switzerland and the EEA (notably Clerk and TypeSafe in the US, and Stripe’s global infrastructure). Transfers are covered by:

9. Security measures

Technical & organisational measures (TOMs):

10. Data-subject requests

Pengon’s dashboard lets you delete individual submissions and bulk-delete by selection. To delete the entire account and its data, use Settings → Delete my account, or email [email protected] (actioned within 7 business days).

If a data subject contacts Pengon directly with a request, we forward it to the relevant Customer within 5 business days. The Customer remains responsible for handling the underlying request.

11. Audits

Given Pengon’s scale (one-person operation, edge-deployed on managed infrastructure), on-site audits are not practical. Instead, the Customer may request, no more than once per year:

12. Liability

Each party’s liability under this DPA is subject to the limitations in the Terms of Service, section 10. Statutory liability under GDPR Art. 82 is not excluded.

13. Governing law

This DPA is governed by Swiss law. Place of jurisdiction: Zürich. Mandatory data-protection law in the Customer’s or data subject’s jurisdiction is not affected.

14. Contact

DPA-related inquiries: [email protected], subject line “DPA - [your domain]”.

Need a counter-signed PDF for your records? Send your countersigned copy to [email protected] and we’ll return a signed PDF within 5 business days at no charge.