Short answer: yes, we are the processor and you are the data controller. We establish this in a Data Processing Agreement.
What that means: you determine what happens with your customers’ data, and we execute within that mandate. We do not use your data for anything else and do not pass it on without reason.
What you can expect from us: an overview of who has access, where the data is stored, and what happens if something goes wrong.
What we need from you: that you inform us which sensitive personal data ends up on your site. A contact form is different from an intake form for a healthcare practice.