Definitions
Personal Data means information about an identifiable individual. The Controller determines the purposes and methods of processing; a Processor handles data on its behalf. Customer Data is information entrusted to Host × IT through the Service. Subprocessors are providers processing that information to help deliver the Service. Security Incidents are breaches affecting its confidentiality, integrity or availability.
Scope
This Data Processing Agreement (DPA) supplements the Host × IT Terms of Service wherever applicable data protection law, including the GDPR, governs our processing of Personal Data for the Customer. The Customer is the controller, or an authorized processor; Host × IT acts as processor or subprocessor accordingly.
The Customer is responsible for lawful collection, appropriate notices and the permissions necessary for its data and instructions. Host × IT will process hosted Personal Data on documented instructions to deliver hosting and requested support, or as required by law. Where legally permitted, we will notify the Customer of legally required processing and inform it if an instruction appears unlawful.
Processing lasts for the service term and includes storage, retrieval, transmission, maintenance and deletion of hosted files and databases. Data categories and individuals concerned depend on the Customer’s content, including its users, contacts and staff. Special-category data remains subject to applicable legal requirements.
Account administration, billing and information processed for our own purposes are governed by the Privacy Policy. This does not authorize unrelated use of hosted Customer Data.
Subprocessing
The Customer generally authorizes Subprocessors for service delivery. Host × IT will provide relevant provider information on request and give advance written notice of intended additions or replacements, allowing a reasoned data protection objection before the change.
We will impose equivalent data protection obligations on Subprocessors and remain responsible for their performance. The parties will seek a suitable resolution to objections; where none is available, they may agree to terminate the affected Service under its applicable terms.
Security
Host × IT will maintain technical and organizational safeguards appropriate to processing risks and limit authorized access to personnel subject to confidentiality obligations. Measures will take account of the data, available technology and potential consequences for individuals.
Upon becoming aware of a personal data breach affecting Customer Data, we will notify the Customer without undue delay and provide available details about its nature, likely effects and response measures, with further updates as information becomes available.
Customers remain responsible for their application security, credentials, access permissions and independent backups under the Terms of Service. Safeguards may evolve with technology and risks.
International Transfers
Processing locations depend on the selected service and supporting providers. Where Data Protection Laws restrict a transfer, Host × IT will ensure an applicable legal basis and required safeguards, including appropriate contractual safeguards where necessary. This DPA does not itself constitute Standard Contractual Clauses.
Return and Deletion of Data
Customers can export accessible files and databases and request support with available export options. Retrieve required content before ending a service.
At the end of processing services, Host × IT will, at the Customer’s choice, return or delete hosted Personal Data and remove copies unless retention is legally required. Residual backups will remain protected and excluded from ordinary use until removed through their applicable lifecycle. Legally required retention is limited to its required purpose and duration.
Cooperation
Taking account of the processing and information available, Host × IT will assist with individual rights requests, security obligations, breach response, impact assessments and required regulatory consultations. Requests received directly about hosted data will be referred to the Customer unless law requires otherwise; compelled disclosures will be notified where permitted.
We will provide information necessary to demonstrate our processing obligations and permit audits or inspections by the Customer or its auditor under reasonable confidentiality and security arrangements. Charges for additional assistance must be agreed in advance and cannot restrict mandatory rights.
Miscellaneous
The Terms of Service otherwise remain effective. This DPA takes priority for conflicts concerning processing covered here. Governing law and jurisdiction follow the Terms of Service, subject to mandatory Data Protection Laws.
Submit processing instructions, data protection requests and requests for Subprocessor information through a Host × IT support ticket.