EXTERNAL DATA PROCESSING AGREEMENT in accordance with article 28 of regulation 2016/679 (EU) of the European Parliament and of the council of 27.4.2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing directive 95/46/ec (general regulation on data protection – “GDPR”)
Version 2.0 — effective from 17 October 2026. It replaces the previous, unnumbered version.
Between
The Customer who has purchased a Service offered for sale by SupportHost OÜ on the website supporthost.com, as the Data Controller (Data Controller), in the person of its legal representative
and
SupportHost OÜ, with registered office at Ahtri tn 12, 15551 Tallinn, Estonia, registry code 16285499, VAT number EE102402247, as the Data Processor (Data Processor), in the person of its legal representative
(the Data Controller and the Data Processor jointly, the “Parties”).
I. Purpose
The purpose of these clauses is to define the conditions under which the Data Processor undertakes to carry out on behalf of the Data Controller the Personal Data Processing operations defined below.
In the context of their contractual and professional relations, the Parties undertake to comply with the Personal Data Protection Legislation applicable from time to time and, in particular, the GDPR.
This Addendum is an integral part of the Agreement and is deemed accepted with the order of the Service.
This Addendum covers the data that the Data Controller uploads, stores or transmits through the Services, for example: website files and databases, mailboxes and messages, server contents, DNS records, logs generated by the Services.
This Addendum does not cover the data of the Customer and its contacts that SupportHost processes to manage the contractual relationship (customer details, invoicing, payments, support, fraud prevention): for this data SupportHost is an independent controller and processes it according to its own Privacy Policy.
II. Definitions
“Agreement”: the SupportHost Terms of Service and the documents they refer to, accepted by the Data Controller with the order, of which this document is an addendum.
“Addendum”: this document, including any attachments thereto.
“Personal Data”: the personal data, as defined in Article 4.1 of the GDPR, which is the subject of this Addendum.
“GDPR”: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation).
“Data Subject”: has the meaning set forth in Article 4.1 of the GDPR.
“Security Measures”: the technical and organisational measures described in Annex 1.
“Personal Data Protection Legislation”: means any law or regulation, including the laws and regulations of the European Union, the Member States and the UK, applicable to the processing of Personal Data, including the GDPR.
“Data Processor”: has the meaning set forth in Article 4.8 of the GDPR.
“Services”: the services purchased by the Data Controller (shared hosting, reseller hosting, VPS, dedicated servers, email, certified email (PEC), domains, SSL certificates and ancillary services).
“Sub-processor”: another processor engaged by the Data Processor to carry out specific processing activities on behalf of the Data Controller (Article 28.4 GDPR).
“Data Controller”: has the meaning set forth in Article 4.7 of the GDPR.
“Processing”: has the meaning set forth in Article 4.2 of the GDPR.
“Personal Data Breach”: has the meaning set forth in Article 4.12 of the GDPR.
III. Description of the Processing entrusted to the Data Processor
The Data Processor is authorised to process on behalf of the Data Controller the Personal Data that the Data Controller uploads, stores or transmits through the Services, to the extent necessary to provide them.
The Processing operations entrusted to the Data Processor are as follows:
- Storage and backup copies
- Consultation, only when needed for support requested by the Data Controller or for the security of the systems
- Restriction and erasure
- Collection and recording, on behalf of the Data Controller and through the Services
- Organisation
- Transmission and making available, according to the features of the Service chosen by the Data Controller
The purpose of the Processing entrusted to the Data Processor is solely to perform the Agreement by providing the Services. The Data Processor does not process the Personal Data for its own purposes.
The categories of Personal Data whose Processing is entrusted to the Data Processor are those chosen by the Data Controller, whose content the Data Processor neither knows nor checks in advance. Typically:
- Identification and contact data
- Browsing data and logs generated by the Services
- Contents of email messages
- Data of customers and users of the Data Controller’s websites and applications
The categories of Data Subjects to whom the Personal Data relate are users, customers, prospective customers, employees and collaborators of the Data Controller, senders and recipients of email, visitors to the Data Controller’s websites.
Special categories of data (Articles 9 and 10 GDPR): the Data Controller may upload them only under its own responsibility, assessing whether the Security Measures in Annex 1 are appropriate to the risk; if they are not, it adopts further measures (for example application-level encryption).
IV. Duration of the Addendum
This Addendum takes effect from the order of the Service and for the entire duration of the Agreement, so that, once the Agreement terminates for any reason, the effects of this Addendum also cease immediately. The confidentiality obligations and the prohibitions on disclosure and/or communication shall be observed by the Data Processor even after the termination of the Agreement and of this Addendum.
V. Obligations of the Data Processor towards the Data Controller
The Data Processor undertakes:
- to process the Personal Data solely for the purpose of this Addendum and, in particular, as indicated in section III above, solely for the proper performance of the Agreement and the proper provision of the Services;
- not to communicate, disseminate or disclose the Personal Data to third parties in any way, except to further processors, where appointed by the Data Processor in accordance with Article 28 GDPR and Article VIII below, and to persons authorised to process personal data under the authority of the Data Processor (“Authorised Persons”), where they have been instructed accordingly by the Data Processor, in accordance with Article 29 GDPR, and formally appointed by it under this article;
- to process the Personal Data in accordance with any instructions given by the Data Controller (“Instructions”), including with regard to transfers of Personal Data to a third country or an international organisation, unless required to do so by Union or Member State law to which the Data Processor is subject; in such a case, the Data Processor shall inform the Data Controller of that legal requirement before Processing, unless that law prohibits such information on important grounds of public interest. If the Data Processor considers that an instruction infringes the GDPR and/or other Union or Member State data protection provisions, it shall immediately inform the Data Controller and may suspend its execution until the Data Controller confirms or amends it.
Documented Instructions are: the Agreement and this Addendum; the configuration and use of the Services by the Data Controller, including the choice of data center location; written requests sent by ticket from the client area.
VI. Confidentiality
The Data Processor authorises to the Processing only the staff who need it to provide the Services or to give support.
Authorised staff are instructed on the internal procedures and bound by a contractual or statutory duty of confidentiality, which remains in force after the end of the relationship.
Staff access the Data Controller’s contents only when needed: for support requested by the Data Controller, for the security of the systems or as required by law.
VII. Security of Processing
The Data Processor adopts the Security Measures described in Annex 1, appropriate to the risk under Article 32 GDPR, and updates them over time according to the state of the art, without reducing their overall level.
The Security Measures depend on the type of Service, as described in Annex 1. In particular, on unmanaged servers (VPS and dedicated servers without management) the Data Controller has full administrative access: the measures concerning the operating system, applications and data (updates, system firewall, access management, encryption, backups) are therefore the responsibility of the Data Controller, unless additional services have been purchased.
The Data Processor is certified ISO/IEC 27001, ISO/IEC 27017 and ISO/IEC 27018. The current status of its certifications is published on the Certifications page of the website.
VIII. Sub-processors
General authorisation
The Data Controller generally authorises the Data Processor to engage one or more other processors (“Sub-processors”) to carry out specific processing activities, pursuant to Article 28.2 GDPR. The up-to-date list of Sub-processors, with the activity performed and the location of the processing, is published in the Sub-processors section of the Security page of the website.
Changes and right of withdrawal
Before adding or replacing a Sub-processor, the Data Processor updates the list and notifies the Data Controller by email, at the client area address, at least 14 days in advance. If the replacement is urgent for reasons of security or continuity of the Service (for example the failure or closure of a supplier), the Data Processor may proceed immediately and informs the Data Controller as soon as possible.
If the Data Controller does not accept the change for reasons related to data protection, it may withdraw from the affected Services only, by giving notice within the notice period, and is entitled to a refund of the portion of the fee already paid for the unused period. The choice of Sub-processors remains with the Data Processor. The Data Controller authorises the Data Processor to receive on its behalf the notices by which Sub-processors announce the appointment or replacement of their own sub-processors, and to exercise the related right of objection on its behalf.
Obligations of Sub-processors
The Data Processor imposes on Sub-processors, by contract, data protection obligations no less protective than those of this Addendum, in particular sufficient guarantees as to technical and organisational measures (Article 28.4 GDPR), and remains fully liable to the Data Controller for their performance.
IX. Assistance to the Data Controller
Taking into account the nature of the Processing, the Data Processor assists the Data Controller with appropriate measures in responding to requests from Data Subjects (Articles 15–22 GDPR). In most cases the Data Controller can do so on its own, through the control panels of the Services.
If the Data Processor receives a request from a Data Subject concerning the Data Controller’s data directly, it forwards it to the Data Controller without delay and does not respond on the merits, unless instructed otherwise.
The Data Processor also assists the Data Controller in complying with Articles 32–36 GDPR (security, breach notification, data protection impact assessment, prior consultation), providing the information available to it.
Assistance requiring technical work not included in the Service (for example extracting or deleting data from backups) may be quoted separately, unless it results from a breach by the Data Processor.
X. Personal Data Breach
The Data Processor notifies the Data Controller of any Personal Data Breach affecting its data without undue delay and in any case within 48 hours of becoming aware of it (Article 33.2 GDPR).
The notification is sent to the client area email address and contains, as far as available: the nature of the breach, the categories and approximate number of Data Subjects and records concerned; the contact at the Data Processor from whom more information can be obtained; the likely consequences; the measures taken or proposed to address the breach and mitigate its effects. Information not available at once is provided in phases, without further delay.
The Data Processor immediately takes reasonable measures to contain the breach and documents the facts, effects and remedial action taken.
The risk assessment, the notification to the supervisory authority (Article 33 GDPR) and the communication to Data Subjects (Article 34 GDPR) remain with the Data Controller. The Data Processor does not communicate the breach to the Data Controller’s Data Subjects without its instructions, unless required by law. This notification to the Data Controller is separate from the Data Processor’s obligations towards the authorities: as an entity subject to the NIS2 legislation as a provider of domain name registration services, the Data Processor also notifies significant incidents to the competent Estonian authority (CERT-EE) within the time limits set by law.
XI. Information to be provided to the Data Subject
It is the Data Controller’s responsibility to provide Data Subjects with the information referred to in Articles 13 and 14 of the GDPR, in the cases, in the manner and within the time limits set out in those articles and in Article 12 of the GDPR.
XII. Retention of Personal Data during the term of the Addendum and their erasure or return after its termination
During the term of the Addendum, the Data Processor undertakes to retain the Personal Data only for the time strictly necessary to achieve the purposes of the Processing and to properly fulfil the obligations of the Addendum, as indicated by the Data Controller in the Instructions, without prejudice to the need to retain the Personal Data because of obligations imposed on the Data Processor by Union or Member State law.
Upon termination of the Addendum for any reason, the Data Processor undertakes to:
a) cease the Processing; and
b) without prejudice to the retention obligations imposed on the Data Processor by Union or Member State law, at the choice of the Data Controller, within the time limits set out below:
- destroy and/or delete all Personal Data, irreversibly and permanently and, in any case, on the basis of the Instructions; or
- return all Personal Data; or
- send the Personal Data to a processor designated by the Data Controller.
The return or transfer must be accompanied by the deletion and/or destruction of all existing copies in the Data Processor’s information systems, unless Union or Member State law requires the retention of such data. Upon written request of the Data Controller, the Data Processor confirms the deletion in writing.
Before termination, the Data Controller may download its data with the tools of the Service, or ask by ticket for it to be returned in a commonly used format.
The Personal Data is deleted from the production systems: in case of cancellation, on the date chosen by the Data Controller (immediately or at the end of the Service period); in case of non-payment, 30 days after the due date. In the latter case the Service is first suspended, 5 days after the due date, and until deletion the Data Controller can still renew it and recover the data.
Backup copies are deleted within 30 days of the deletion of the Service. Until then they remain protected by the Security Measures and are not used except for a restore requested by the Data Controller. At the Data Controller’s request, the Data Processor deletes them earlier.
XIII. Data Protection Officer (“DPO”)
The Data Processor has not appointed a DPO, as it is not required to do so under Article 37 GDPR. For data protection matters, the Data Controller can open a ticket from the client area or use the details on the Contact us page.
XIV. Records of processing activities
The Data Processor keeps a record of the categories of processing activities carried out on behalf of controllers (Article 30.2 GDPR) and makes it available to the supervisory authority on request. The lead supervisory authority for the Data Processor is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).
XV. Documentation and audits
The Data Processor makes available to the Data Controller all the information and documentation necessary to demonstrate compliance with the obligations of the GDPR, including Article 28, and of this Addendum, primarily through the Certifications page, the Security page and written answers to the Data Controller’s requests.
If this information is not sufficient, the Data Controller or an auditor appointed by it and bound by confidentiality may carry out an audit, including inspections, under the following conditions: written notice of at least 30 days, stating what is to be verified; no more than once a year, except after a Personal Data Breach or at the request of a supervisory authority; as a rule remotely, during business hours and without compromising the security and confidentiality of other customers; at the Data Controller’s expense, including the time spent on the audit by the Data Processor’s staff.
Physical inspections of the Sub-processors’ data centers are subject to their own rules; in their place the Data Processor may provide their certifications.
XVI. Obligations of the Data Controller towards the Data Processor
The Data Controller undertakes to provide the Data Processor with the Personal Data where, by reason of the Agreement and/or the Services, they are not collected and/or acquired directly by the Data Processor on behalf of the Data Controller.
The Data Controller warrants that it has a legal basis for the Processing entrusted to the Data Processor and that it has provided Data Subjects with the information notice (Articles 13–14 GDPR).
The Data Controller assesses whether the Security Measures in Annex 1 are appropriate to the data it uploads and adopts those for which it is responsible according to the type of Service (Article VII).
XVII. Data location and transfers to third countries
Personal Data is stored in data centers located in the European Union, in Germany, Finland, France, the Netherlands and Italy; for each Sub-processor the list referred to in Article VIII states its location. The Data Processor’s staff and collaborators who access the data operate from the European Union or from countries covered by an adequacy decision; failing that, with the safeguards provided by Chapter V GDPR (Standard Contractual Clauses).
For certain Services, the Data Controller may choose a data center in the United States (Ashburn, Virginia; Hillsboro, Oregon), operated by the same Sub-processor as the European data centers (Hetzner). In that case the data of that Service is stored in the USA on the Data Controller’s instruction, and the transfer is based on the European Commission’s Standard Contractual Clauses (Decision 2021/914).
Some Sub-processors of ancillary services (for example network protection and backups) may process data outside the EU or be established outside the EU. For each of them, the list referred to in Article VIII states the country and the safeguard adopted under Chapter V GDPR (adequacy decision, including the EU-US Data Privacy Framework, or Standard Contractual Clauses; for domain registrars, also the necessity of the transfer to register the domain requested by the Data Controller, Art. 49(1)(b) GDPR). New transfers follow the procedure of Article VIII.
XVIII. Communications
All communications under this Addendum take place: from the Data Processor to the Data Controller, at the email address associated with the Customer’s account in the client area, which the Data Controller undertakes to keep up to date; from the Data Controller to the Data Processor, by ticket from the client area or using the details on the Contact us page.
XIX. Liability
Each Party is liable for damage caused by the breach of its own obligations under Article 82 GDPR.
XX. Changes
The Data Processor may update this Addendum to adapt it to the Personal Data Protection Legislation or to the Services, by publishing a new numbered and dated version.
Changes that reduce the Data Controller’s protections are notified to it by email at least 14 days in advance; within the same period the Data Controller may withdraw from the affected Services.
XXI. Applicable law and jurisdiction
This Addendum is governed by Estonian law. The courts of Tallinn, Estonia, have exclusive jurisdiction over any dispute concerning its application and/or interpretation, without prejudice to the mandatory rights granted to the Data Controller by law.
XXII. Miscellaneous
The Parties acknowledge that this Addendum does not limit or reduce the commitments made by the Data Processor to the Data Controller in the Agreement, provided that in the event of a conflict between the provisions of the Agreement and those of the Addendum regarding the processing and/or protection of personal data, the provisions of the Addendum shall prevail.
Annex 1 — Technical and organisational measures (Article 32 GDPR)
A. Measures common to all Services
- Qualified technical staff (system administrators), bound by confidentiality.
- Documented internal procedures for security, incident management and access to customer data, available to all staff.
- Access to systems restricted to authorised staff, on a least-privilege basis. Access is revoked immediately when a person leaves the company or changes role, and is reviewed at least once a year.
- SSH access to servers only with a personal key for each staff member; password login is disabled. Two-factor authentication on supplier and registrar panels.
- Client area with two-factor authentication available to the Customer.
- Logging of administrative access to servers, with logs kept for 30 days.
- Network-level DDoS protection, provided by the data centers on all Services.
- Sub-processors’ data centers certified ISO/IEC 27001, with electronic access control, 24/7 video surveillance, fire protection, and redundant power, cooling and connectivity.
- Procedure for managing security incidents and notifying customers of personal data breaches (Article X).
B. Shared hosting and reseller hosting
The Data Processor manages the operating system and the server software.
- Automatic updates of the control panel software; operating system updates installed periodically by staff.
- Isolation between accounts at operating system level.
- Application firewall, brute-force protection, malware and antivirus scanning, including email.
- 24/7 monitoring of the availability of servers and individual services, with automatic alerts to the staff on duty.
- Automatic daily backups, kept for 30 days, on storage separate from the production servers, in the Netherlands (Amsterdam). The Customer can restore them on its own from the control panel.
C. Managed VPS and dedicated servers
The Data Processor manages the operating system and the agreed services:
- security updates of the operating system and of the software installed by the Data Processor;
- firewall configuration and management;
- 24/7 monitoring of the server and services;
- backups: for VPS, daily snapshots of the whole server, kept for 7 days at the data center; for dedicated servers no backup is included, except the additional “Disaster Recovery” service, with frequency and retention agreed with the Customer based on the space purchased.
If the Data Controller does not purchase a backup service, keeping copies of its own data remains its responsibility.
D. Unmanaged VPS and dedicated servers
The Data Controller has full administrative access. The Data Processor guarantees the physical infrastructure, the network, network-level DDoS protection and the replacement of faulty hardware; it does not monitor the server or the installed services. The Data Controller is responsible for:
- installing and updating the operating system and applications;
- system firewall, management of users, passwords and access keys;
- monitoring of the server and services;
- data encryption;
- backups: the Service does not include any backup copy, unless an additional service has been purchased separately.
The Data Processor’s staff do not access unmanaged servers, unless requested by the Data Controller.
E. Resold services (domains, SSL certificates, certified email)
Domain registrars, the SSL certificate reseller and the certified email (PEC) provider are Sub-processors and are included in the list. Domain registries and SSL certificate authorities receive the data needed for registration or issuance as independent controllers, according to their own rules.