Data protection for resellers
This page is for owners and technical leads at resellers. When you host, run or support a customer's site, you usually process personal data on the customer's behalf: editors' accounts, members, orders, form entries, logs. This page names the duties that typically follow and what Exponential provides. It is not legal advice; data protection law differs by country, so ask a lawyer for your contracts.
Contents
- Your role
- Contracts and subprocessors
- What Exponential provides
- Known gaps to plan for
- Where data leaks in practice
- Checklist
Your role
| Situation | Typical role under laws such as the GDPR |
|---|---|
| You host or run the customer's site | Processor for the customer, who is the controller |
| You buy in hosting or white-label 7x services | Your supplier is your subprocessor |
| Your own leads, your own customers' contact data | You are the controller |
Confirm the roles with your lawyer; they decide what your contract must say.
Contracts and subprocessors
- To do: A data processing agreement with each customer, or processing terms in the contract.
- To do: A list of subprocessors (hosting supplier, backup storage, mail service, 7x for white-label services) and where the data is stored (White-label reseller).
- To do: How and when you notify the customer of a breach.
- To do: What happens to data at the end of the contract (Handing over).
What Exponential provides
From Privacy standards:
| Topic | What ships |
|---|---|
| Consent | Optional e-mail categories off until the person turns them on; double opt-in for newsletters and marketing |
| Records of consent | Table expmail_consent_log, with the exact text shown |
| Access and portability | Mail preferences and consent history downloadable as JSON or CSV; audit records by or about a user exportable with ./console exp:audit export --subject-user=<id> |
| Erasure | Removing a user account erases mail preferences and anonymizes the consent log; audit records are pseudonymized |
| Minimization in logs | Audit addresses truncated, session ids hashed; request logs with MaskIP=enabled; log viewer masks addresses and secrets |
| Storage limitation | Audit: 90 days live and 2 years archived; settings/logviewer.ini [RotationSettings] MaxAgeDays[] for some logs |
| No third-party calls from the administration | Admin scripts are served locally; admin4 loads no web fonts or scripts from other hosts |
Status in the standards page: Partly complies. The site operator still decides purposes and legal bases, keeps the record of processing, writes the privacy notice and answers requests. Hosts have their own page: Compliance and GDPR for hosts.
Known gaps to plan for
From Privacy standards:
- No single "export all my data" or "delete me" function; a person's data is reached through separate tools.
- User removal is manual and one account at a time.
- Kernel logs such as
error.loganddebug.logare rotated by size, without an age limit by default. - Information collection forms store what visitors type; the site must add a consent text and a retention rule.
- Search phrases are stored and can contain personal data.
Offer to handle these as part of your service, and say which ones the customer must handle.
Where data leaks in practice
| Place | Prevention |
|---|---|
| Support tickets and bug reports | Clean logs before pasting; placeholders such as customer-site.example |
| Screenshots | Test accounts; crop or blur |
| Database dumps for debugging | Share a reproduction, not a dump |
| Staging copies | Anonymize; protect staging like production |
| Demo sites | Never real data (Demo sites for resellers) |
| Leads passed on | Consent recorded first (Lead handoffs for resellers) |
| Case studies | Written approval (Case studies for resellers) |
Source: Protecting customer data.
Checklist
- To do: Roles confirmed; processing terms in every contract.
- To do: Subprocessor list current and shared with customers.
- To do: Staff trained on placeholders, screenshots and dumps.
- To do: Staging anonymized; demos without real data.
- To do: Log retention set where the customer needs it.
- To do: Breach notification procedure written.
- To do: Deletion routine for exports, dumps and departed customers.
Related pages
- Protecting customer data
- Log and data retention
- GDPR requests (for site owners)
- Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.
Become an Exponential Partner
Partners share their information, provide funding, contribute back and develop the products with us, and that is how Exponential grows. A partner website and dashboard are planned for mid-2027: please become a partner today to speed up our growth rate and land new features faster.