Data Processing Agreement

Who is who

Store a customer's name on your site, or a delivery address from an order, or a mailing list, and you are holding somebody's personal data, which means the law wants to know who decides what becomes of it. That decision is yours, so the controller is you. All we do is hold it and shift it about so the service you paid for can run, and that makes us your processor. What you are reading is the written agreement between those two roles, and it forms part of the terms of service and the privacy policy.

1. Your instructions govern what we do

Personal data on your account gets processed for one purpose, which is delivering the service, and beyond that only where you have told us in writing. Should some law compel us to do otherwise, you will hear about it beforehand, unless that very law bars us from warning you.

2. Our undertakings in that role

• every person on our side who is able to reach your data carries a duty of confidence;
• what secures an account is written out in full in the data security statement, and it applies here;
• when a visitor puts a data right to you, our part is helping you answer, not answering on your behalf;
• we assist with your own breach-notification and impact-assessment duties, to the extent the facts happen to sit with us;
• any breach touching your data comes to you without undue delay, carrying whatever we happen to know at that point.

3. Everybody else who handles it

No hosting company runs entirely on its own resources. In general terms, you agree that sub-processors may be used to deliver the service, and we remain answerable for whatever they do with your data. Who is on the current list, meaning the upstream platform running the servers, the payment processor, and the registry and registrar partners behind domains, is set out in section 5 of the privacy policy rather than being typed out again here, which leaves a single list to keep up to date. A route will be there for hearing about any new one before it starts, leaving room for you to object.

4. Sending it abroad

If a sub-processor sits beyond the UK or the EEA, that transfer rests on an adequacy decision or on the standard contractual clauses, together with any additional safeguards the destination country demands. Your data does not get moved anywhere that has no legal floor beneath it.

5. Return of the data, then deletion

Once your service ends, and once the short grace window described in the service terms has passed, the personal data held on your behalf is deleted or handed back, apart from whatever portion a law obliges us to retain. Backups age out on their own cycle instead of being picked through by hand.

6. Checking we mean it

Annually, or earlier where a regulator presses for it, we will provide what you reasonably need in order to satisfy yourself that this agreement is being kept. Most customers get documentation instead of a visit to the premises, since a visit of that kind would sit your data beside everyone else's.

7. A signed copy

Any business customer needing a countersigned copy for their own files should write to info@hosting-cheap.com. Hosting-Cheap is a trading style of Bohzo Ltd, a company registered in England and Wales under Company No. 15031604. Registered office: The Workspace Basildon, 7 High Pavement, Basildon, England, SS14 1EA.