1. Object and duration
Processing is limited to providing the hosting/VPS/reseller services ordered, for the duration of the service and a short post-termination deletion window.
2. Nature and purpose
Hosting, storage, transmission, backup and support access strictly as needed to deliver the service on documented customer instructions.
3. Data types and data subjects
As determined by the customer: content and personal data the customer chooses to host. Categories of data subjects are determined by the customer.
4. Documented instructions
Customer instructions are: (a) the Terms/this DPA; (b) product configuration; (c) documented tickets. We will inform the customer if an instruction appears unlawful.
5. Confidentiality
Personnel authorised to process personal data are bound by confidentiality obligations.
6. Security measures (TOMs)
Access control, encryption in transit where applicable, isolation on shared platforms, logging, vulnerability management, and staff access on a need-to-know basis. A high-level overview is in the Security section of the Privacy Policy. Detailed internal TOMs are not a public certification claim.
7. Subprocessors
The customer authorises subprocessors listed on /legal/subprocessors. Material changes will be notified with an objection window where required by law.
8. Assistance with data-subject rights
We assist the customer, insofar as possible, with requests relating to hosted personal data.
9. Incidents
We will notify the customer without undue delay after becoming aware of a personal data breach affecting customer-hosted data, with information available to us.
10. DPIA
We will provide reasonable information to help the customer with a DPIA (data protection impact assessment) where required.
11. Return or deletion
On termination, the customer may export data while access remains. After the retention window, remaining copies including backups are deleted or anonymised, except where law requires retention.
12. Audit
We will make available information reasonably necessary to demonstrate compliance and allow audits as agreed in writing, subject to confidentiality and security.
13. International transfers
Where transfers occur, lawful transfer tools will be used as required by applicable law.
14. End of service
Obligations survive termination as needed for deletion, confidentiality and legal retention.