Summary
- This agreement applies automatically when you use our hosting. You do not need to sign anything.
- You are the controller of the personal data on your websites and mailboxes. We process it only to provide the hosting.
- Your hosted data is stored in London, United Kingdom.
- We tell you about a personal data breach affecting your data without undue delay, and in any case within 48 hours.
1. Parties and incorporation
1.1 This Data Processing Agreement ("DPA") is between Getradi Ltd, company number 16034527, Suite 4.06, 86 Leonard Street, London EC2A 4RH, United Kingdom ("Getradi" or the "Processor"), and the customer named on the hosting account ("Customer" or the "Controller").
1.2 This DPA forms part of, and is incorporated into, our Terms and Conditions of Service (the "Terms"). It applies automatically whenever we process Customer Personal Data in providing the Services. If you need a signed copy for your records, email legal@getradi.eu.
1.3 This DPA is intended to meet the requirements of Article 28(3) of the UK GDPR. Where the EU GDPR applies to the Customer's processing, the parties agree that this DPA also meets Article 28(3) of the EU GDPR.
2. Definitions
- Data Protection Laws
- The UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 and, where applicable, the EU GDPR.
- Customer Personal Data
- Personal data that the Customer, or its end users, store on or transmit through the Services, including website databases, uploaded files, mailboxes and log data about visitors to the Customer's websites.
- Personal Data Breach
- A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
- Sub-processor
- Any third party appointed by Getradi to process Customer Personal Data.
Terms such as "controller", "processor", "data subject" and "processing" have the meanings given in the Data Protection Laws.
3. Roles and instructions
3.1 The Customer is the controller and Getradi is the processor of Customer Personal Data.
3.2 Getradi will process Customer Personal Data only on the Customer's documented instructions. The Terms, this DPA and the Customer's use and configuration of the Services are the Customer's complete instructions. Getradi will inform the Customer if, in its opinion, an instruction infringes Data Protection Laws.
3.3 If the law requires Getradi to process Customer Personal Data other than on the Customer's instructions, Getradi will tell the Customer before processing, unless the law prohibits this.
3.4 The Customer is responsible for having a lawful basis for its processing, providing privacy information to data subjects and ensuring that its instructions comply with Data Protection Laws.
4. Confidentiality
4.1 Getradi ensures that everyone authorised to process Customer Personal Data is bound by a duty of confidentiality and receives appropriate data protection training. Staff access the Customer's account only when needed to provide the Services, deliver support the Customer has requested, maintain security or comply with the law.
5. Security
5.1 Getradi implements the technical and organisational measures described in Annex 2 to ensure a level of security appropriate to the risk, as required by Article 32 of the UK GDPR.
5.2 The Customer is responsible for the security of its own content and configuration, including keeping its applications up to date, using strong credentials, and keeping its own backups. The Services do not include a backup service.
6. Sub-processors
6.1 The Customer gives general authorisation for Getradi to use the categories of Sub-processors listed in Annex 3.
6.2 Getradi will give the Customer at least 30 days' notice by email before adding or replacing a Sub-processor that will process Customer Personal Data. The Customer may object on reasonable data protection grounds within that period. If we cannot reasonably address the objection, the Customer may cancel the affected Services and receive a refund of fees paid for the period after cancellation.
6.3 Getradi imposes data protection obligations on each Sub-processor that are no less protective than those in this DPA, and remains liable to the Customer for each Sub-processor's performance.
7. International transfers
7.1 Customer Personal Data stored on the hosting servers is kept in London, United Kingdom.
7.2 Getradi will not transfer Customer Personal Data outside the UK unless the transfer is to a country covered by UK adequacy regulations, or is protected by the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses or another lawful transfer mechanism, together with a transfer risk assessment where required.
7.3 Customers subject to the EU GDPR can rely on the European Commission's adequacy decision for the United Kingdom for transfers of personal data to Getradi.
8. Assistance with data subject requests
8.1 Taking into account the nature of the processing, Getradi will assist the Customer, through appropriate technical and organisational measures, to respond to requests from data subjects exercising their rights. Most requests can be handled by the Customer directly using the tools in the control panel.
8.2 If Getradi receives a request directly from a data subject about Customer Personal Data, it will refer the data subject to the Customer and will not respond itself, unless legally required to.
9. Personal Data Breaches
9.1 Getradi will notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data.
9.2 The notice will describe, as far as known at the time: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Getradi will provide further information as it becomes available.
9.3 Getradi will take reasonable steps to contain and investigate the breach and to reduce its effects, and will assist the Customer with any notifications it must make to the ICO or to data subjects.
10. Other assistance
10.1 Getradi will provide reasonable assistance to the Customer with data protection impact assessments and prior consultations with supervisory authorities, where they relate to the Services and the information is available to Getradi.
11. Return and deletion
11.1 The Customer can download its data at any time during the term using the control panel.
11.2 After a Service ends, Getradi keeps Customer Personal Data for 14 days so the Customer can retrieve it, then deletes it from the hosting servers. Any residual copies in system logs or temporary storage are deleted within 30 days after the end of the Service, unless the law requires Getradi to keep them.
12. Audits
12.1 Getradi will make available to the Customer all information reasonably necessary to demonstrate compliance with this DPA, including summaries of its security policies and the results of independent assessments where available.
12.2 If that information is not sufficient to demonstrate compliance, or if a supervisory authority requires it, the Customer may carry out an audit, at its own cost, no more than once in any 12-month period, with at least 30 days' written notice, during normal business hours and in a way that does not disrupt Getradi's operations or compromise the security or confidentiality of other customers' data.
13. Liability and term
13.1 Each party's liability under this DPA is subject to the limitations of liability in the Terms, except where the law does not allow this.
13.2 This DPA remains in force for as long as Getradi processes Customer Personal Data.
13.3 This DPA is governed by the law of England and Wales.
Annex 1: Details of processing
| Subject matter | Provision of shared web hosting and email hosting services. |
|---|---|
| Duration | For the term of the Services and the deletion period set out in section 11. |
| Nature and purpose | Storage, hosting, transmission and retrieval of data; operation of web, database and email services; security scanning; technical support at the Customer's request. |
| Types of personal data | Determined by the Customer. Typically includes names, contact details, account credentials, order and transaction details, messages and email content, IP addresses and website access logs. |
| Special category data | Only if the Customer chooses to store it. The Customer is responsible for applying appropriate additional safeguards. |
| Data subjects | Visitors to and users of the Customer's websites, the Customer's customers, staff and contacts, and people who send email to or receive email from the Customer's mailboxes. |
Annex 2: Technical and organisational security measures
- Encryption in transit: free SSL/TLS certificates for hosted websites; encrypted protocols (HTTPS, IMAPS, SMTPS) for website and email access, and SSH for our staff's server administration.
- Access control: role-based access for staff on a least-privilege basis; two-factor authentication on administrative systems; account isolation between customers on shared servers.
- Malware and intrusion protection: a firewall on every hosting server and automatic brute-force login protection.
- Patching: regular security updates to operating systems, web servers and control panel software.
- Logging and monitoring: centralised logging of administrative access; 24/7 availability monitoring and alerting.
- Physical security: servers housed in a professionally managed data centre in London, United Kingdom with controlled access, CCTV, fire suppression and redundant power and cooling, operated by our data centre provider.
- People: confidentiality obligations and data protection training for all staff and contractors with access to systems.
- Incident management: a documented process for detecting, responding to and notifying Personal Data Breaches.
- Secure disposal: storage media are securely wiped or destroyed at the end of their life.
Annex 3: Sub-processor categories
| Category | Purpose | Location |
|---|---|---|
| Data centre and colocation provider | Physical hosting facilities, power, cooling and network connectivity for our servers | United Kingdom (London) |
| Network and DDoS mitigation provider | Filtering malicious traffic before it reaches our network | United Kingdom / EEA |
| Helpdesk platform | Managing support tickets that may include data the Customer chooses to share | United Kingdom / EEA |
An up-to-date list of named Sub-processors is available on request from legal@getradi.eu.