This Data Processing Agreement ("DPA") forms part of the Terms of Service between you (the "Controller") and Hostingoor (the "Processor"). It applies when personal data that you control is stored or processed on our Services, for example the content of your websites, databases and mailboxes, and it meets the requirements of Article 28 UK GDPR.
1. Subject matter
- Nature and purpose: hosting, storage, transmission, backup and email services.
- Duration: for as long as we provide the Services, and until the data is deleted afterwards.
- Data and data subjects: whatever personal data you choose to store, which may relate to your customers, users, employees and contacts.
2. Our obligations
We will:
- process the personal data only on your documented instructions, which are these Terms and your use of the Services, unless the law requires otherwise (in which case we will tell you, unless the law forbids it);
- ensure that our staff with access are bound by confidentiality;
- take appropriate technical and organisational security measures under Article 32 UK GDPR, including encryption in transit, access controls, monitoring, patching and backups;
- help you, as far as reasonably possible, to respond to requests from data subjects and to meet your obligations on security, breach notification and data protection impact assessments;
- notify you without undue delay after becoming aware of a personal data breach affecting your data;
- at the end of the Services, delete the data (after giving you the chance to download it), unless the law requires us to keep it;
- make available the information you reasonably need to show compliance with Article 28, and allow for audits on reasonable notice, normally by providing documentation.
3. Sub-processors
You authorise us to use sub-processors such as data centre, backup and email delivery providers. We impose data protection terms on them that are at least as protective as this DPA and remain responsible for their performance. We will tell you about intended changes to our sub-processors, and you may object on reasonable grounds.
4. International transfers
We will not transfer your personal data outside the UK unless the transfer is covered by UK adequacy regulations or appropriate safeguards such as the International Data Transfer Agreement or the UK Addendum.
5. Your obligations
You are responsible for having a lawful basis for the personal data you store, for the instructions you give us, and for the security of your own applications, passwords and accounts.
For a signed copy of this DPA, contact [email protected].