Data Processing Agreement

This Data Processing Agreement ("DPA") is part of the Terms of Service between you, the customer ("you"), and Netkeel LLC, WY, USA ("Netkeel", "we"). It applies when we process personal data on your behalf while providing the Services, and it is meant to meet Article 28 of the EU General Data Protection Regulation (GDPR) and the UK GDPR. You accept it by accepting the Terms of Service; no separate signature is needed. If you need a signed copy, email support@netkeel.com.

Words such as "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meaning given in the GDPR. If this DPA and the Terms of Service conflict on the processing of personal data, this DPA applies.

1. Roles

For personal data inside the websites, applications, files, databases and backups you host on Netkeel ("Customer Data"), you are the controller and Netkeel is your processor. Where you are yourself a processor for someone else (for example an agency hosting a client's website), Netkeel is your sub-processor, and you confirm that your client has authorised you to use us.

For the data we need to run your account (your name, email address, billing and sign-in details), Netkeel is the controller. Our Privacy Policy covers that data, not this DPA.

2. Subject matter and duration

We process Customer Data to provide the Services: creating and maintaining servers in the region you choose, hosting your websites and applications on them, and making, storing and restoring backups. We process it for as long as you use the Services, and afterwards only for the deletion periods in section 10.

3. Nature and purpose of the processing

Storage, hosting, copying (backups, staging copies, moves between servers and restores), transmission, and technical operations needed to keep servers secure and running (monitoring, updates, security scanning and logs). We do not look at the content of your websites except where needed to provide the Services, to answer a support request you made, to investigate abuse under our Acceptable Use Policy, or where the law requires it.

4. Personal data and data subjects

You decide what personal data your websites collect, so the list depends on what you host. It typically includes:

• Data subjects: visitors to your websites; your customers and your websites' users (for example shop customers, members and people who fill in forms); and the people who manage your websites, such as your staff, clients and contractors with access to them.
• Types of data: contact details, account and order data stored by your applications, form submissions and any other content in your files and databases; and technical data such as IP addresses, user agents, requested addresses and timestamps in web server and access logs.

You should not use the Services for special categories of personal data (such as health data) unless you have assessed that the measures in this DPA are appropriate for it.

5. Our obligations

• Instructions: we process Customer Data only on your documented instructions. The Terms of Service, this DPA and your use and settings of the panel are your instructions. If the law requires us to process it otherwise, we will tell you first unless the law forbids that. We will tell you if we believe an instruction breaks data protection law.
• Confidentiality: only people who need access to provide the Services or support can access Customer Data, and they are bound by confidentiality.
• Security: we apply the measures in section 6 and keep them appropriate to the risk.
• No other use: we do not sell Customer Data, use it for advertising, or use it to train any model.

6. Security measures

A summary of the technical and organisational measures in place today. We may change them over time, but we will not reduce the overall level of protection.

• Isolation: each customer server is a separate virtual machine. On a server, each website runs as its own system user with its own files, PHP processes and database user, so one website cannot read another's files.
• Encryption in transit: websites are served over HTTPS with certificates managed for you. The panel, its connection to your servers and transfers of backups use encrypted connections (TLS or SSH).
• Encrypted backups: off-site backup copies are encrypted on your server before they leave it, so the storage provider holds only encrypted data. Credentials we store for you are encrypted.
• Access control: panel access is per person with roles; two-factor sign-in is available for every account and recorded sign-ins can be reviewed and ended. Our staff use individual accounts with two-factor sign-in, and use support access to a workspace only when needed.
• Server hardening: a firewall, automatic banning of attackers, blocking of known bad networks, and regular security updates of the operating system and web stack.
• Backups: automatic backups kept on the server, with off-site copies on by default, and restores you can run yourself.
• Monitoring: servers, services and backups are monitored, and failures alert our team.

You are responsible for the security of what you install and manage yourself, such as your applications, plugins, themes, code, user accounts and passwords, and for keeping your own copies of important data.

7. Sub-processors

You give us general authorisation to use sub-processors. The current list of sub-processors and what they do is on our sub-processor page. Where personal data leaves the EU, the EEA or the UK, the Standard Contractual Clauses in section 12 apply; details of a sub-processor's processing location are available on request. Before we add or replace a sub-processor, we update that page and email the owners of every workspace at least 30 days in advance. You may object on reasonable data protection grounds within those 30 days by emailing support@netkeel.com. We will then try to find a reasonable solution with you; if we cannot, you may stop using the affected Service and we will not charge you for it after that point.

We use sub-processors only under written terms that protect Customer Data at least as well as this DPA, and we remain responsible to you for their work.

The cloud provider that hosts a server is the one you choose when you create it. If you connect your own backup storage, that provider works under your agreement with it and is not our sub-processor.

8. Helping you

• Data subject requests: you can access, export, correct and delete the data in your websites yourself through the panel, SSH, the file manager and database tools. If we receive a request from one of your data subjects, we will pass it to you and not answer it ourselves, unless the law requires otherwise. If you need more help, we will give reasonable assistance.
• Assessments and authorities: we will give reasonable help with data protection impact assessments and consultations with supervisory authorities, as far as they concern our Services.

9. Personal data breaches

If we become aware of a personal data breach affecting Customer Data, we will notify the workspace owner by email without undue delay, aiming to do so within 72 hours. We will tell you what we know: what happened, the data and number of people likely to be affected, the likely consequences, and what we have done or propose to do. Where we do not have all of this at first, we will send it as we learn it. We will take reasonable steps to contain the breach and limit its effects. Notifying you is not an admission of fault.

10. Deletion and return at the end

• Return: while your account is active you can download your websites, databases and backups at any time. When we terminate an account, we normally keep its data for 7 days so you can retrieve it, as described in the Terms of Service.
• Servers and websites: when you delete a server, it is deleted at the cloud provider with everything on it, including the backups kept on it. Deleting a website deletes its files and database from the server.
• Off-site backups: off-site backup copies of a deleted website held by Netkeel are kept for 30 days, so a website deleted by mistake can be restored, and are then deleted. When an account is closed, its servers and websites are deleted, and the websites' off-site copies follow the same 30-day rule.
• Billing records: invoices, payments and usage records are kept for 7 years to meet tax and accounting rules. They are our records as controller and do not contain the content of your websites.

We may keep Customer Data longer only where the law requires it, and then only for that purpose.

11. Audits

We will make available the information reasonably needed to show that we meet this DPA, such as answers to security questionnaires and descriptions of our measures. If that is not enough, or a supervisory authority requires it, you may audit our compliance with this DPA, at your own cost, on at least 30 days' written notice, no more than once a year (unless after a personal data breach or at an authority's request), during business hours, in a way that does not disrupt the Services or expose other customers' data, and under confidentiality. Audits of our sub-processors are done through the reports and terms they make available. We do not currently hold certifications such as ISO 27001 or SOC 2.

12. International transfers

Netkeel LLC is a company in the United States, and some sub-processors are in the United States or other countries. Your servers run in the region you choose, but our team may access them from outside that region to provide support and maintenance. Where Customer Data from the European Economic Area, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) apply between you as data exporter and Netkeel as data importer, and are incorporated into this DPA by reference: Module 2 (controller to processor) where you are a controller, and Module 3 (processor to processor) where you are a processor. For those clauses: the optional clause 7 does not apply; under clause 9 the general authorisation and notice period in section 7 of this DPA apply; the optional wording in clause 11 does not apply; clauses 17 and 18 choose the law and courts of Ireland; and Annexes I and II are completed by sections 2 to 6 of this DPA and the sub-processor page. For UK transfers the UK International Data Transfer Addendum applies, and for Swiss transfers the clauses apply with references read as the Swiss Federal Act on Data Protection. If the clauses conflict with this DPA, the clauses apply.

13. Liability

Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Terms of Service, except where the law or the Standard Contractual Clauses do not allow this.

14. Changes and contact

We may update this DPA, for example to reflect changes in the law or in our Services. We will not reduce the protection it gives Customer Data without telling you at least 30 days in advance by email or in the panel. Questions about this DPA or how we process Customer Data: support@netkeel.com.