Data Processing Addendum

Who this addendum covers

Where a site, a store or a mailbox you host with us holds personal data about your own customers, members or users, data protection law in the UK and EU makes you the controller over that data, while we become your processor. Article 28 of the UK and EU GDPR demands certain terms for that relationship, and this addendum sets them out.

It forms part of our terms of service and applies of its own accord. No signature is required before you can rely on it. Should your organisation need a countersigned copy for its records, email info@hostingfastnet.com and we will arrange one.

Data we hold about you as our customer, meaning your account, billing and support records, is handled separately. Over that data we act as the controller, and our privacy policy applies instead.

1. Subject matter and duration

Personal data inside your hosted content gets processed for one purpose alone: delivering the hosting, email, domain and support services you ordered. That processing runs for as long as the service stays active, together with the short backup-retention period set out in section 8.

2. What processing means here, and why

Storing your content, hosting it, transmitting it, backing it up and restoring it; running the servers, network and mail systems that carry it; and giving technical support whenever you ask for it.

3. Data types, and the categories of data subject

You determine both, since you decide what goes onto the platform in the first place. In practice that tends to mean names, email addresses, contact details, order records and message content belonging to your website visitors, your customers or your members.

The platform is not designed for special-category data, meaning health, biometric, political, religious and the like, nor is it built for criminal-offence data. Where that is your intended use, tell us before you buy and you will get a straight answer on whether the platform suits it.

4. Our obligations to you

• Personal data is processed only on your documented instructions, and your ordinary use of the platform counts as those instructions, unless the law requires something else. In that event we tell you first, except where the law prevents us from telling you.
• A duty of confidentiality binds everyone who has access, and that access reaches only the people who need it in order to run the platform or answer your support requests.
• Appropriate technical and organisational security measures are maintained, and section 5 describes them.
• So far as is reasonable, we help you with data-subject requests, with notifying a security incident, and with any data protection impact assessment you carry out.
• We notify you without undue delay of the point at which we become aware of a personal data breach touching your data, with the detail you need to meet your own notification duties.

5. Security measures

Free auto-renewing TLS certificates that encrypt traffic in transit; isolation between accounts on shared infrastructure; a web application firewall sitting behind network-level DDoS mitigation; Imunify360 malware scanning; daily automatic backups you restore yourself; brute-force protection with optional two-factor authentication on the account; and platform software kept patched and current. Our security page sets out every part of it, including an honest note on what stays your responsibility.

6. Sub-processors

Each sub-processor named in section 5 is engaged under a general authorisation you give us, which appears in our privacy policy, and that list is kept current. Every one of them is bound by data protection terms at least as protective as the ones in this addendum.

Before we add or replace a sub-processor that touches your hosted content, you get reasonable advance notice. Object on reasonable data protection grounds and we will work with you to find an alternative. Where no alternative works, you may end the affected service and take a pro-rata refund of any prepaid fees you have not used.

7. International transfers

We store the content you host inside a London datacentre. Should a transfer outside the UK or EEA happen through the sub-processors above, an appropriate safeguard covers it: a UK adequacy decision, the UK International Data Transfer Agreement or Addendum, or the Standard Contractual Clauses issued by the European Commission.

8. Deletion and return

Exporting or deleting your content is something you can do yourself at any hour, straight from the control panel. Once the service terminates, we remove it from active systems, and it expires out of backups within the normal backup-retention cycle. Need a final export before that? Ask before you cancel and we will help you get it.

9. Audit and information

Information reasonably necessary to demonstrate compliance with this addendum will be provided, and we will answer reasonable written questions put to us about our processing.

Plainly, on the question of size: this is a small company, and we hold neither ISO 27001 nor SOC 2 certification at present, so those reports are not ours to hand over. Where your compliance programme strictly demands a certified processor, far better you learn that now than once you have paid.

10. Liability and precedence

Any liability arising under this addendum falls subject to the limitations written into our terms of service. Should those two documents conflict on any data protection point, this addendum takes precedence. The law of England and Wales governs it throughout.

Getting in touch

For questions on data protection, queries about a sub-processor, or a request for a countersigned copy, email info@hostingfastnet.com putting DPA into the subject line of the message.