Data Processing Agreement

Who is who

The moment your site stores a customer's name, an order address or a mailing list, that data is someone's personal data and the law wants to know who decides what happens to it. You do — you are the controller. We only hold and move it so the service you bought can run, which makes us your processor. This page is the written agreement between those two roles, and it forms part of the terms of service and the privacy policy.

1. We act on your instructions

We process the personal data on your account only to deliver the service, and otherwise only as you tell us in writing. If a law forces us to do something else, we will say so first, unless that same law forbids the warning.

2. What we promise as processor

• the people on our side who can reach your data are under a duty of confidence;
• the security behind an account is set out in the data security statement, and it applies here;
• where a visitor exercises a data right against you, we help you answer rather than answering for you;
• we help you meet your own breach-notification and impact-assessment duties, as far as the facts sit with us;
• a breach that touches your data reaches you without undue delay, with what we know at the time.

3. The others who touch it

No hosting company runs on itself alone. You agree in general terms that we can use sub-processors to deliver the service, and we stay answerable for what they do with your data. The current list — the upstream platform that runs the servers, the payment processor, the registry and registrar partners behind domains — lives in section 5 of the privacy policy rather than being retyped here, so there is one list to keep current. We will give you a way to hear about a new one before it starts, so you can object.

4. Sending it abroad

Where a sub-processor sits outside the UK or the EEA, the transfer rides on an adequacy decision or on the standard contractual clauses, with whatever extra safeguards the destination calls for. We do not move your data somewhere with no legal floor under it.

5. Giving it back, then deleting it

When your service ends, and after the short grace window the service terms describe, we delete or return the personal data we were holding for you, except the slice any law makes us keep. Backups age out on their own cycle rather than being picked through by hand.

6. Checking we mean it

Once a year, or sooner if a regulator insists, we will hand over what you reasonably need to see that we are keeping to this agreement. For most customers that is documentation rather than an on-site visit, which would put your data next to everyone else's.

7. A signed copy

Business customers who need this countersigned for their own records can ask at info@hosting-cheap.com. Hosting-Cheap is a trading name of Bohzo Ltd, a company registered in England and Wales under Company No. 15031604. Registered office: The Workspace Basildon, 7 High Pavement, Basildon, England, SS14 1EA.