SightMill is classed as a Processor, so your company will be classed as a data Controller and you will need to list SightMill as a recognised Processor.
Yes - we have updated our Privacy policy, our Terms and Conditions and have a general GDPR statement that outlines how SightMill has worked to GDPR compliance.