Data processing agreement

1. When this agreement applies

This agreement is part of the Terms of service. It applies when you store or process personal data on our services. You are then the controller (or a processor for your own customer) and we are your processor: Hostingway B.V., trading as Stavane, Vlierweg 12, 1032 LG Amsterdam, the Netherlands. Chamber of Commerce (KvK) 98861468, VAT NL868675179B01.

2. What we process, and on whose instruction

• Subject matter: hosting of the servers, disks, backups and network traffic that you control.
• Duration: as long as you use the services, until the data is removed as described in chapter 9.
• Kinds of data and of people: decided by you. We do not know what you store and we do not look at it.
• Instructions: we process this data only to deliver the service as you configure it in the console or through support, and as the law requires. If we think an instruction breaks the law, we tell you.
• Application servers: on an application server we install a small management program that runs with full rights. It only runs actions that you start in the console (backups, restores, updates, restarts, logs, a new sign-in, a domain, mail settings), each one signed by us and valid for fifteen minutes. You can switch it off in the console or on the server. When you ask for logs, we keep a filtered copy for one day. Backups you choose to keep in our storage are encrypted with a key we manage.

3. Confidentiality

Our staff can only reach customer systems when that is needed for the service or for security, and they are bound to confidentiality. We do not log in to your server.

4. Security

We take these measures, among others:

• Separation between customers at the level of the virtual machine and the network.
• Encrypted connections to the website, the console and the payment form; no card numbers on our systems.
• Two-factor authentication required for all staff with access to customer administration, with a record of every staff action.
• Passwords stored as hashes only; secrets encrypted at rest.
• Security updates, monitoring and alarms on the platform, and backups of our own administration.
• Physical security of the data centres by their operators.

You are responsible for the security of what runs on your server: updates, access, encryption and your own backups.

5. Sub-processors

You give us general permission to use the sub-processors listed below. We tell you by e-mail at least thirty days before we add or replace one. You can object on reasonable grounds; if we cannot solve the objection, you can end the agreement and have your unused paid credit refunded. We bind every sub-processor to the same obligations as in this agreement and remain responsible for what they do.

6. Data outside the European Economic Area

Servers run in the location you choose. If you choose a location outside the European Economic Area, you instruct us to process the data there. For sub-processors outside the European Economic Area, the safeguards named in the list apply.

7. Helping you

Taking the nature of the service into account, we help you to answer requests of people about their data, to carry out data protection impact assessments and to consult the supervisory authority, as far as that concerns our part of the processing. We may charge reasonable costs for help that goes beyond the normal service.

8. Personal data breaches

When we find a breach of security that affects personal data on your services, we tell you without undue delay, and where we can within forty-eight hours after we found it, at the e-mail address of your account. We tell you what happened, which data is likely involved as far as we can know, and what we did. Reporting to the authority and to the people concerned is up to you as the controller.

9. Return and removal

You can take your data with you at any time, because you have full access to your servers. When you remove a server, its disk and its backups are removed. When the agreement ends, we remove what is left as described in the Terms of service, chapter 7, unless the law requires us to keep it.

10. Audits

On request we give you the information you reasonably need to show that we meet this agreement. If that is not enough, you may have an audit carried out by an independent auditor bound to confidentiality, at most once a year, announced at least thirty days in advance, at your cost, and without disturbing the service to other customers.

11. Liability and the rest

The limits of liability in the Terms of service apply to this agreement. Where this agreement and the Terms of service differ on the processing of personal data, this agreement applies.

Parties that receive personal data