Data Processing Addendum

Who this addendum covers

If you host a site, store or mailbox with us that holds personal data about your own customers, members or users, UK and EU data protection law makes you the controller of that data and us your processor. This addendum sets out the terms Article 28 of the UK and EU GDPR requires for that relationship.

It forms part of our terms of service and applies of its own accord; nothing needs signing before you can rely on it. Where your organisation wants a countersigned copy for its own file, email info@hosting-n-domains.com and one will be arranged.

Data we hold about you as our customer — your account, billing and support records — is treated separately. For that data we are the controller, and our privacy policy applies instead.

1. Subject matter and duration

Personal data within your hosted content is processed for one purpose: delivering the hosting, mail, domain and support services you ordered. Processing continues for as long as your service stays active, plus the short copy-retention period described in section 8.

2. Nature and purpose of processing

Storing, hosting, transmitting, copying and restoring your content; operating the servers, network and mail systems that carry it; and providing technical support when you request it.

3. Categories of data, and of data subject

Both are determined by you, because you decide what is placed on the platform. In practice that usually means the names, email addresses, contact details, order records and message content of your website visitors, customers or members.

The platform is not designed for special-category data — health, biometric, political, religious and similar — nor for criminal-offence data. Should that be the use you have in mind, say so before buying and you will get a straight answer on whether the platform fits it.

4. Our obligations to you

• We process personal data only on your documented instructions, which include your ordinary use of the platform, unless the law requires otherwise — in which case we inform you first, unless we are legally prevented from doing so.
• Everybody with access is bound by a duty of confidentiality, and access is restricted to the people who need it to operate the platform or answer your support requests.
• We maintain appropriate technical and organisational security measures; section 5 describes them.
• Within reason we help you with data-subject requests, security-incident notification and any data protection impact assessment you undertake.
• We notify you without undue delay after becoming aware of a personal data breach affecting your data, providing with whatever detail your own notification duties require.

5. Security measures

Free auto-renewing TLS certificates, encrypting traffic in transit; isolation between accounts on shared infrastructure; a web application firewall backed by network-level DDoS mitigation; Imunify360 malware scanning; an automatic daily copy you can restore unaided; brute-force protection and optional two-factor authentication on the account itself; and platform software kept patched and current. Our security page sets the whole of it out, along with a frank note on what stays your responsibility.

6. Sub-processors

General authorisation is given for us to engage the sub-processors listed in section 5 of our privacy policy, a list we keep current. Each one is bound by data protection terms at least as protective as those in this addendum.

Reasonable notice reaches you before any sub-processor is added or replaced handling your hosted content. If you object on reasonable data protection grounds, we will work with you to find an alternative; where none is workable, you may terminate the affected service and receive a pro-rata refund of any prepaid, unused fees.

7. International transfers

Your hosted content is stored in a London datacentre. Should a transfer outside the UK or EEA happen through the sub-processors above, it is covered by an appropriate safeguard — a UK adequacy decision, the UK International Data Transfer Agreement or Addendum, or the European Commission's Standard Contractual Clauses.

8. Deletion and return

You can export or delete your content yourself at any time through the control panel. On termination we delete it from active systems, and it expires from the copies within the normal retention cycle. If you want a final export before that happens, ask before you cancel and we will assist.

9. Audit and information

We will provide the information reasonably necessary to demonstrate compliance with this addendum, and will answer reasonable written questions about our processing.

To be plain about our size: we are a small company, and we do not currently hold ISO 27001 or SOC 2 certification, so those reports are not ours to supply. If your compliance programme strictly requires a certified processor, it is better you know that now than after you have bought.

10. Liability and precedence

Liability under this addendum sits within the limitations set out in our terms of service. Where the two documents conflict on a data protection point, this addendum prevails. The law of England and Wales governs it.

Getting in touch

For data protection questions, sub-processor queries or a request for a countersigned copy, write to info@hosting-n-domains.com with “DPA” in the subject line.