Controller, processor and the software
This page is for data protection officers and project managers. The project's statement is plain: "Exponential is software, not a data controller. Compliance ... is the responsibility of the organization that runs the site" (Privacy standards). Around a public site several parties touch personal data; this page helps you name them.
Note This page describes features and common practice; it is not legal advice. Check the law that applies to your organization with your legal counsel.
Contents
Typical parties
| Party | Usual role (to be confirmed with your counsel) | What they touch |
|---|---|---|
| Your public body | controller | everything the site processes |
| Hosting company | processor | the server, database, backups, logs |
| Implementation partner or agency | processor, when it accesses production data | content, user accounts, form submissions during work |
| Support provider (7x or a partner) | processor, when it accesses the installation | as above, for support cases |
| The Exponential project | none for your site: it publishes software | nothing, unless you send data in a support request |
The project's own error report in the help system builds its installation summary from a fixed list of facts and removes e-mail addresses, IP addresses, credentials and paths before anything leaves your site (Privacy standards: GDPR).
Third-party services that extensions add
Some extensions installed with Exponential send visitor data to a third party when a site activates them (Privacy standards: Third-party services):
| Extension | Third party |
|---|---|
bcwebsitestatistics | Google Analytics / Google Tag Manager |
recaptcha | Google reCAPTCHA |
hcaptcha | hCaptcha |
sevenx_authentication_2fa social login | the chosen identity provider |
ezgmaplocation | Google Maps (editors' map, and maps in your templates) |
Each of these is a separate relationship (processor or independent controller, depending on the service and your counsel's view) with its own terms.
Agreements and records
- A data processing agreement with each processor (hosting, implementation, support).
- An entry in your record of processing for the website's processing activities (see "Records of processing").
- A list of active extensions with third parties: Setup > Extensions, or
./console exp:ini where site.ini/ExtensionSettings/ActiveExtensions --allow-root-user. - The privacy notice names the recipients (see "A privacy notice outline").
Related pages
- Privacy standards
- Hosting companies: compliance and GDPR
- Implementation partners
- Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.
Become an Exponential Partner
Partners share their information, provide funding, contribute back and develop the products with us, and that is how Exponential grows. A partner website and dashboard are planned for mid-2027: please become a partner today to speed up our growth rate and land new features faster.