Data Processing Agreement

This agreement is part of our Terms of Service and applies to every HOST4DK plan, free of charge. It meets the requirements of Article 28 of the GDPR. You do not need to sign anything: it applies from the moment you order.

1. The parties

The controller is you, the customer. The processor is HOST4DK, Bybakken, 3600 Frederikssund, Denmark, CVR-nr.: 46837525, info@host4dk.com.

2. What we process, and why

Purpose and nature: storing, hosting and backing up your website, its databases and your email accounts, and delivering email, so that your website and email work. Duration: as long as you have a plan with us, and until the data is deleted as described in section 10. Types of data: whatever personal data you put on your website, in its databases and in your mailboxes, for example names, contact details, orders, messages and user accounts. You decide this. If you store sensitive data (Article 9), you must tell us and make sure you have the right protection in place. Data subjects: your website’s visitors, users and customers, your employees and the people you exchange email with.

3. Your instructions

We process the data only to provide the service you ordered and on your documented instructions, which are these terms, your settings in My account and your written requests. We do not use your data for our own purposes, and we never sell it. If an instruction would break data protection law, we tell you. If the law requires us to process data in another way, we tell you first, unless the law forbids it.

4. Confidentiality

Only HOST4DK staff who need access to run the service can access your data, and they are bound by confidentiality.

5. Security (Article 32)

• Servers run by HOST4DK on our own equipment in Denmark.
• Encrypted connections (TLS 1.2/1.3) for websites, email and administration; free SSL for every website.
• Each website isolated from the others on the server.
• Admin panels that cannot be reached from the internet; two-factor and key-based sign-in for our staff.
• Firewalls and automatic blocking of password guessing and attacks.
• Regular security updates.
• Daily backups kept for up to 30 days on our own equipment in Denmark.

6. Subprocessors

Your website files, databases and email stay on our servers in Denmark. You give us general permission to use the subprocessors below for the parts of the service listed. We have agreements with them that give at least the same protection as this agreement.

We will email you at least 30 days before we add or replace a subprocessor. If you have a reasonable objection, tell us; if we cannot solve it, you can end your plan before the change, and we refund any period you have paid for but not used.

7. Transfers outside the EU

We do not move your website or email data outside the EU/EEA. The subprocessors above may process domain names and DNS records in the USA under the EU-US Data Privacy Framework and/or the European Commission’s standard contractual clauses.

8. Helping you

We help you, as far as we reasonably can, to answer requests from data subjects (access, correction, deletion and so on), to keep your data secure, and with data protection impact assessments and contact with Datatilsynet. Much of this you can do yourself in your website and in My account.

9. Personal data breaches

If we become aware of a personal data breach that affects your data, we tell you without undue delay, and no later than 48 hours after we find it, with what we know about what happened, the likely consequences and what we are doing about it. This gives you time to report to Datatilsynet within 72 hours where the law requires it.

10. When the service ends

Before your plan ends you can download a backup of your website and copy your email. We delete your website files, databases and mailboxes within 30 days after the plan ends, and our backups of them are overwritten within a further 30 days, unless the law requires us to keep them.

11. Audits

We give you the information you need to show that this agreement is followed. If you need an audit or inspection, write to us; it is carried out at an agreed time, with reasonable notice, at your cost, and without access to other customers’ data.

12. Liability, law and order of precedence

Liability follows our Terms of Service and the GDPR. This agreement is governed by Danish law. If it conflicts with our Terms of Service on data protection, this agreement takes precedence. We may update it; important changes are emailed to you at least 30 days in advance.