Data Processing Agreement

Roles

When you store personal data on a server, you are the controller and [Company legal name] is the processor. This agreement sets out the terms required by Article 28 of the GDPR and the UK GDPR.

Scope of processing

• Subject matter: hosting of the data you place on your server
• Duration: for as long as the service is active, plus the time needed to delete it
• Nature: storage on infrastructure we operate. We do not view, change or analyze the contents of your server.
• Data subjects and categories: decided by you, based on what you store

Our obligations

• Process personal data only to provide the service and on your documented instructions, which are these terms and your use of the service
• Make sure staff with access are bound by confidentiality
• Apply appropriate technical and organizational security measures, including physical security of data centers and access controls on infrastructure
• Help you respond to data subject requests and meet your security and breach notification duties, taking into account the self-managed nature of the service
• Notify you without undue delay, and within 72 hours where possible, after becoming aware of a personal data breach affecting your service
• Delete your server data when the service ends
• Make available the information needed to show compliance with this agreement

Sub-processors

We use data center operators in the countries where our locations sit to provide physical hosting. A current list is available from privacy@example.com. We will tell you about new sub-processors at least 30 days in advance, and you may object on reasonable data protection grounds.

International transfers

You choose the location of each server. We do not move server data to another location without your instruction. Where a transfer outside the EEA or the United Kingdom happens on your instruction, the standard contractual clauses apply.

Your obligations

You are responsible for the lawfulness of the data you store, for securing the software inside your server and for keeping your own backups.