Data Processing Addendum (DPA)

This DPA provides baseline data-processing terms for business customers that use HostingTom to process personal data.

1. Roles

Where a Customer determines the purposes and means of processing personal data stored in the Services and HostingTom processes that data only to provide the Services, the Customer acts as controller/business and HostingTom acts as processor/service provider, to the extent those concepts apply under relevant law.

2. Instructions

HostingTom will process Customer Personal Data only on documented instructions reflected in the Agreement, Customer configuration and support requests, unless processing is required by law. If we cannot comply with an instruction, we may notify the Customer and suspend affected processing.

3. Confidentiality and Security

Personnel authorized to process Customer Personal Data are subject to confidentiality obligations. HostingTom maintains reasonable technical and organizational measures appropriate to the Services, such as access control, authentication, logging, network protections and incident response.

4. Subprocessors

Customer authorizes HostingTom to use subprocessors necessary to provide the Services, including datacenters, cloud/network providers, support systems, payment providers and registrars. A high-level Subprocessor & Data Location Notice is provided separately. HostingTom remains responsible for imposing appropriate data-protection obligations where required.

5. International Transfers

Where Customer Personal Data is transferred across borders, the parties will use applicable legal transfer mechanisms where required. The Customer is responsible for selecting server regions compatible with its own legal obligations.

6. Assistance

Taking into account the nature of processing, HostingTom will provide reasonable assistance with data-subject requests, security incidents, impact assessments or regulator inquiries where required by applicable law and reasonably possible. Additional work outside standard support may be chargeable.

7. Personal Data Breach

HostingTom will notify the Customer without undue delay after becoming aware of a confirmed breach of Customer Personal Data for which notification is required, and will provide information reasonably available to support the Customer’s obligations.

8. Return and Deletion

At termination, Customers should export their data. HostingTom will delete or render inaccessible Customer Personal Data according to normal service and backup deletion cycles, except where retention is required by law.

9. Audits

We will make reasonably available information necessary to demonstrate compliance with this DPA. On-site audits require advance agreement, must protect other customers and security, and may be limited where independent reports or equivalent evidence reasonably satisfy the request.