Data Processing Agreement (Art. 28 GDPR)

The Art. 28 GDPR terms under which Hostna processes the personal data inside your hosting account.

This agreement forms part of your contract and applies automatically as soon as you process personal data on Hostna infrastructure. You can additionally conclude it expressly in the Client Area with one click — see section 11.

1. Roles

For the personal data inside your services — your website visitors, your customers, your mailboxes, your databases — you are the controller and KAUFEX is the processor. For the data of your own customer relationship with us, we are the controller; that is covered by the Privacy Policy.

2. Subject matter, duration, nature and purpose

The subject matter is the hosting and operation of the services you ordered. The processing lasts as long as the contract. Its nature is storage, hosting, transmission, backup within the platform, and deletion; its purpose is providing the service you bought. We process personal data only on your documented instructions, which for the ordinary operation of the service are given by the order itself and by your use of the control panel.

3. Categories of data and data subjects

Which categories occur is determined by you, because you decide what to put on the service. Typically: contact and account data, content data, usage and connection data, and communication content, relating to your visitors, your customers, your employees and your contacts.

If you intend to process special categories of data under Art. 9 GDPR — health, biometric, religious, political or trade union data — on shared hosting, tell us first. Shared hosting is not the right environment for it, and you may need a dedicated setup and a separate agreement.

4. Our obligations

process personal data only on your instructions, and inform you if we consider an instruction to infringe data protection law;
bind everyone with access to confidentiality;
implement the technical and organisational measures required by Art. 32 GDPR, described in section 6;
assist you, as far as we reasonably can, with data subject requests, with data protection impact assessments and with notifications to authorities;
notify you without undue delay after becoming aware of a personal data breach affecting your data;
make available the information needed to demonstrate compliance and allow audits as described in section 8;
delete or return your personal data at the end of the contract, subject to storage required by law.

5. Sub-processors

You give general authorisation for the use of sub-processors. Those currently engaged are the ones named in the recipients table of the Privacy Policy — principally Hetzner Online GmbH for the data centre. We impose the same data protection obligations on any sub-processor, and remain fully liable to you for their performance.

We inform you of an intended change of sub-processor with reasonable notice in text form or in the Client Area. If you object on reasonable data protection grounds and we cannot accommodate you, either side may terminate the affected service with effect from the date the change takes effect.

6. Technical and organisational measures

data centre in Germany with physical access control, redundant power and fire protection;
transport encryption by TLS for the website, the Client Area and mail submission;
separation of customer environments at account, container or virtual machine level;
role-based administrative access, individually attributable, with multi-factor authentication for privileged accounts;
automated patching of the platform components we operate;
edge filtering, rate limiting and automated blocking of repeated authentication failures;
access, mail and administrative logging, retained for operation and security analysis;
documented deletion at the end of the contract.

These measures develop with the state of the art. We may replace one with an equivalent or better measure; we will not reduce the level of protection.

The measures above protect the platform. They do not protect an application you configured insecurely, and they are not a security service. Where the line runs is set out in the Shared Responsibility policy.

7. Third-country transfers

Processing takes place in Germany. A transfer to a third country happens only where you configure one yourself, or where a domain registry outside the EU requires registrant data for a domain you ordered, in which case Art. 49 (1) (b) GDPR applies.

8. Audits

On reasonable request, and no more than once a year unless there has been an incident, we provide the information needed to demonstrate compliance with this agreement. Where an on-site inspection is genuinely required, it is arranged with reasonable notice, during business hours, without disrupting operations, subject to confidentiality, and at your cost.

9. Deletion at the end

At the end of the contract your data is deleted, subject to any storage we are required by law to maintain. Export what you need before the end date; see section 6 of the Terms of Service.

10. Liability

Art. 82 GDPR governs liability between the parties and towards data subjects. Beyond that, section 11 of the Terms of Service applies.

11. Concluding and evidencing this agreement

Art. 28 (9) GDPR requires a processing agreement to exist in writing, and expressly allows electronic form. Incorporation by contract, as described in the introduction, already meets that — but many controllers need to show their supervisory authority a concluded agreement with a date on it.

For that, the Client Area offers express conclusion: under Profile, the "Data Processing Agreement" panel shows the version currently in force and an "Accept the DPA" action. One click records the accepted version, your account, the date and time and the IP address, sends a confirmation to the email address on file, and the panel shows the standing acceptance from then on. When the agreement changes substantively, the panel shows the new version and asks again; the record of what you accepted earlier is kept.

A countersigned paper copy is available on request to privacy@hostna.com where an auditor insists on ink.