English | Русский | Українська
This Data Processing Agreement (“DPA”) supplements the HOSTLIFE Terms of Service (the “Main Agreement”). It applies where the legal entity providing the relevant HOSTLIFE services and identified in the Main Agreement (“HOSTLIFE” or “Processor”) processes personal data on behalf of the customer party to the Main Agreement (“Customer” or “Controller”) on the Customer’s documented instructions.
Where the Customer itself processes data on behalf of another controller, the Customer confirms that it is authorised to appoint HOSTLIFE as a sub-processor and to give HOSTLIFE the relevant instructions.
This DPA governs only processing on behalf of the Customer. It does not apply to processing for which HOSTLIFE determines its own purposes and means, including administration of the Customer account, billing, payment collection, fraud prevention and HOSTLIFE’s own business correspondence. Such processing is described in the HOSTLIFE Privacy Policy.
The subject matter is the provision of HOSTLIFE services ordered by the Customer, including hosting and storage of data, operation of hosting infrastructure, transmission over networks, backups, technical maintenance, security monitoring and technical support to the extent these operations form part of the service and involve personal data.
Processing may include receiving, recording, organising, storing, altering, retrieving, using, transmitting, making available, restricting and erasing data. It takes place for the term of the relevant service and thereafter for the period necessary to return or delete data, comply with legal requirements, maintain security and handle substantiated claims.
Depending on the Customer’s use of the services, data may include identification and contact details of users of the Customer’s websites and applications; account, profile, enquiry and order data; uploaded content, documents, messages and database records; IP addresses, access logs, browser and device information, timestamps and diagnostic records; and other personal data stored or processed by the Customer using the services.
Data subjects may include visitors and users of the Customer’s websites or applications, its clients, employees, representatives, contractors and other individuals. The Customer determines the actual categories of data and data subjects. The Customer must not host special categories of personal data or other data requiring enhanced protection unless the selected service and agreed security measures are suitable for that processing.
HOSTLIFE processes data on the basis of the Customer’s documented instructions contained in the Main Agreement, service order, client area settings, technical requests and this DPA, unless otherwise required by law. Where processing is required by law, HOSTLIFE shall, unless prohibited, inform the Customer of that requirement.
The Customer is responsible for the lawfulness of its instructions, having an appropriate legal basis and providing required information to data subjects; determining the purposes and means of processing; managing access to its systems, applications and data, including user permissions and passwords; not providing data whose processing is prohibited by law, the Main Agreement or the AUP; promptly informing HOSTLIFE of changes to instructions; and fulfilling its controller obligations, including responding to data subject requests.
HOSTLIFE shall process data to provide the relevant services and in accordance with the Customer’s documented instructions, unless otherwise required by law; ensure confidentiality of persons authorised to process data; apply security measures under Section 6; provide reasonable assistance with data subject requests, security, incidents and impact assessments, taking into account the nature of processing and information available to HOSTLIFE; provide information reasonably necessary to demonstrate compliance with this DPA; and notify the Customer of incidents under Section 7.
HOSTLIFE applies technical and organisational measures appropriate to the nature of the service, the type of data and the risks. Depending on the service and infrastructure, these may include physical and administrative access controls; system access management and need-to-know restrictions for personnel; authentication and account protection; network security measures, availability monitoring and detection of suspicious activity; system updates and maintenance within HOSTLIFE’s responsibility; backups where included in the service; and incident response procedures.
The specific measures depend on the service type and configuration and the allocation of responsibilities between the parties. When using VPS and dedicated servers, security of the operating system, applications, databases and user accounts is the Customer’s responsibility unless the parties expressly agree otherwise. HOSTLIFE does not guarantee absolute security of data transmission or storage. The Customer is responsible for selecting an appropriate security architecture and using available security features.
If HOSTLIFE becomes aware of a personal data security breach affecting data processed on behalf of the Customer, HOSTLIFE shall notify the Customer without undue delay after establishing the breach with sufficient certainty to provide a notification. As information becomes available, HOSTLIFE shall provide information reasonably necessary to assess the incident and fulfil the Customer’s obligations; information may be provided in stages. The Customer is responsible for determining whether and when to notify a supervisory authority and data subjects where such obligations apply to it as Controller.
The Customer grants HOSTLIFE general written authorisation to engage third parties for processing operations necessary to provide the services, including data centre, network and server infrastructure, backup, technical support and other technology providers.
HOSTLIFE shall ensure that engaged sub-processors are bound by data protection obligations meeting applicable legal requirements and no less protective than the relevant HOSTLIFE obligations under this DPA. HOSTLIFE shall notify the Customer of intended additions or replacements of material sub-processors by a means reasonably enabling the Customer to receive notice. The Customer may raise a reasoned objection on data protection grounds. The parties shall discuss the objection and possible alternatives in good faith; if no agreement is reached, further steps are governed by the Main Agreement and applicable law. HOSTLIFE is responsible for sub-processors to the extent required by applicable law.
Data may be processed in countries where HOSTLIFE infrastructure and engaged providers are located. Depending on the service and provider, the infrastructure may include servers and other components in the Netherlands and Germany. Where data is transferred outside the European Economic Area, HOSTLIFE shall ensure an applicable transfer mechanism and appropriate safeguards where required by data protection law.
If HOSTLIFE receives directly from a data subject a request relating to data processed on behalf of the Customer, HOSTLIFE shall, where legally permitted, forward it to the Customer and shall not respond on its merits unless authorised by the Customer or required by law. HOSTLIFE shall provide reasonable assistance with the Customer’s obligations concerning data subject requests, security, impact assessments and consultation with a supervisory authority, limited to data and operations under HOSTLIFE’s control.
Upon the Customer’s reasonable written request, HOSTLIFE shall provide available information reasonably necessary to demonstrate compliance with this DPA. If insufficient, the parties shall agree on a reasonable method of further assessment. An audit shall be conducted on prior notice, during normal business hours, without unreasonable disruption to HOSTLIFE or other customers, and subject to confidentiality and security requirements. It shall not provide access to other customers’ data, source code, internal systems or information whose disclosure could threaten infrastructure security or third-party rights. Unless the law requires otherwise, the Customer shall bear reasonable costs of an individual audit beyond HOSTLIFE’s standard documentation.
Upon termination of the service, HOSTLIFE shall, at the Customer’s choice, delete or return personal data processed on the Customer’s behalf, unless continued retention is required by law. The method and timing of deletion, including from backups and technical systems, depend on the service, configuration and technical procedures. Data in backups may remain until the relevant overwrite or deletion cycle is completed; during that period it remains protected under this DPA and is not used except for security, restoration and compliance with mandatory requirements. The Customer is responsible for exporting necessary data before service termination unless the parties agree otherwise.
If HOSTLIFE receives a legally binding request from a public authority for data processed on behalf of the Customer, HOSTLIFE shall review it to a reasonable extent and disclose only data it is legally required to provide. Unless prohibited by law, HOSTLIFE shall notify the Customer before disclosure.
The parties’ liability is governed by the Main Agreement to the extent permitted by applicable law. Nothing in this DPA limits liability or data subject rights that cannot lawfully be limited by agreement. In the event of a conflict between this DPA and the Main Agreement concerning personal data processing, this DPA shall prevail; the Main Agreement applies to all other matters. The HOSTLIFE Privacy Policy describes processing carried out by HOSTLIFE as an independent controller and does not replace this DPA.
This DPA supplements the Main Agreement and remains in effect while HOSTLIFE processes personal data on behalf of the Customer in connection with the services. Termination of the Main Agreement does not affect obligations which by their nature survive the end of processing. Terms shall be interpreted in accordance with the GDPR and other applicable data protection laws. Invalidity of an individual provision does not affect the remaining provisions.