Data Processing Agreement

1. Object and duration

Processing is limited to providing the hosting/VPS/reseller services ordered, for the duration of the service and a short post-termination deletion window.

2. Nature and purpose

Hosting, storage, transmission, backup, and support access strictly as needed to deliver the service on documented customer instructions (including this DPA and the product configuration).

3. Data types and data subjects

As determined by the customer: content and personal data the customer chooses to host. Categories of data subjects are determined by the customer.

4. Documented instructions

Customer instructions are: (a) these Terms/DPA; (b) product configuration; (c) documented tickets. We will inform the customer if an instruction appears unlawful.

5. Confidentiality

Personnel authorized to process personal data are bound by confidentiality obligations.

6. Security measures (TOMs)

Access control, encryption in transit where applicable, isolation on shared platforms, logging, vulnerability management, and staff access on a need-to-know basis. Detailed TOMs are in the internal annex and Security overview.

7. Subprocessors

Customer authorizes subprocessors listed on Subprocessors. Material changes will be notified with an objection window where required by law.

8. Assistance with data-subject rights

We assist the customer, insofar as possible, with requests relating to hosted personal data.

9. Incidents

We will notify the customer without undue delay after becoming aware of a personal data breach affecting customer-hosted data, with information available to us.

10. DPIA and consultation

We will provide reasonable information to help the customer with DPIAs where required.

11. Return or deletion

On termination, customer may export data while access remains. After the retention window, remaining copies including backups are deleted or anonymized, except where law requires retention.

12. Audit and compliance information

We will make available information reasonably necessary to demonstrate compliance and allow audits as agreed in writing, subject to confidentiality and security.

13. International transfers

Where transfers occur, lawful transfer tools will be used as documented after counsel confirmation.

14. End of service

Obligations survive termination as needed for deletion, confidentiality, and legal retention.