Data processing agreement

Data processing agreement pursuant to Art. 28(3) GDPR between the customer (the “Controller”) and UTRANET GbR, Kleine Schmidtgasse 1, 63571 Gelnhausen, Germany (the “Processor” or “Provider”). This agreement forms part of the hosting contract (see Terms, section 8) and applies to every customer who processes personal data of third parties through the hosting services. It is concluded in electronic form (Art. 28(9) GDPR); no separate signature is required. The German version is authoritative.

1. Subject matter and duration

The subject matter is the provision of web hosting services (web space, databases, email, DNS, SSL, backups, customer portal) under the booked plan. The Processor processes personal data solely on behalf of and on the instructions of the Controller. The duration corresponds to the term of the hosting contract; the obligations under section 11 continue until the data has been fully deleted.

2. Nature, purpose and scope of processing

Nature: storage, provision, transmission (delivery to website visitors and email recipients), backup and deletion. The Provider does not evaluate the content of the data.

Purpose: operation of the websites, web applications (e.g. shops, CMS), databases and mailboxes hosted by the Controller.

Data subjects: visitors and users of the hosted websites, the Controller’s customers, prospects and suppliers, email correspondents, and the Controller’s staff.

Data categories: all data the Controller stores on the hosting or that its applications generate, in particular master and contact data, order, contract and payment data (excluding full card data), communication content (email), usage and log data (IP address, timestamp, requested URL, user agent). Special categories under Art. 9 GDPR are not part of the contract; if the Controller stores such data, it is responsible for its lawfulness.

3. Controller’s instructions

The Processor processes data only on documented instructions from the Controller. Instructions arise from the hosting contract and from the settings the Controller makes in the customer portal (e.g. creating or deleting domains, mailboxes, databases, backups). Any further instructions must be sent in text form to billing@utra.network. If the Processor considers an instruction unlawful, it will inform the Controller without delay and may suspend execution until the matter is clarified.

4. Obligations of the Processor

• Processing only within this agreement and the instructions; no use for its own purposes.
• All persons involved in processing are bound to confidentiality (Art. 28(3)(b) GDPR).
• Implementation and regular review of the technical and organisational measures in section 5 (Art. 32 GDPR).
• Appointment of a data protection officer where required by law; the contact for data protection matters is given in section 12.
• Prompt notification of the Controller if a supervisory authority or third party requests access to the Controller’s data, to the extent legally permitted.
• Maintenance of records of processing activities under Art. 30(2) GDPR.

5. Technical and organisational measures

The Processor implements at least the following measures under Art. 32 GDPR:

• Physical access control: servers are operated in certified data centres (Equinix, NTT; Frankfurt am Main) with access control, CCTV and 24/7 security staff.
• System access control: administrative access only via SSH with key or password authentication over secured connections; customer accounts with individual passwords (stored as hashes), rate limiting and lock-out after failed attempts.
• Data access control: strict separation of customer accounts at operating-system level (separate system users, separate PHP processes, open_basedir); customer data is not accessible to other customers.
• Separation control: separate databases and mailboxes per customer; tenant separation in the customer portal.
• Transfer control: TLS encryption for websites (Let’s Encrypt certificates), email (STARTTLS/TLS), SFTP, the customer portal and the API; encrypted transfer of backups.
• Availability control: daily backup of all customer data; copy to a second, geographically separate data centre; firewall, Fail2ban, monitoring, UPS and redundant power at the data centre.
• Input control: logging of administrative operations and changes in the customer portal.
• Deletion policy: periods under section 11; website access logs are deleted after four weeks, system logs after twelve months.

The measures may be adapted to the state of the art provided the level of protection is not reduced.

6. Sub-processors

The Controller grants general authorisation (Art. 28(2) GDPR) for the following sub-processors:

The data centre operators have no logical access to the data; their service is limited to rack space, power, network connectivity and physical security. No other sub-processors are used. Payment providers (PayPal, Stripe) process only the Controller’s own data for billing the hosting contract and are not sub-processors under this agreement. Intended changes will be announced by email at least four weeks in advance; the Controller may object within two weeks on substantial data-protection grounds. If no agreement is reached, either party may terminate the hosting contract as of the date of the change.

7. Place of processing

Processing takes place exclusively in Germany (hosting server and backup server in Frankfurt am Main). No transfer to countries outside the EEA takes place. If the Controller itself chooses services in third countries (e.g. through embedded scripts or email forwarding), this is its own responsibility.

8. Assistance to the Controller

The Processor assists the Controller by appropriate means in fulfilling data-subject rights (Art. 12 to 22 GDPR), in data protection impact assessments and in prior consultation of the supervisory authority (Art. 32 to 36 GDPR). If a data subject contacts the Processor directly, the request is forwarded to the Controller without delay. The Controller can handle most requests itself via the customer portal, SFTP, phpMyAdmin and webmail; additional effort is charged at the applicable hourly rate.

9. Personal data breaches

The Processor notifies the Controller of any personal data breach affecting the Controller’s data without undue delay and no later than 36 hours after becoming aware of it, by email to the address stored in the customer account. The notification contains the information listed in Art. 33(3) GDPR as far as known. Notifying the supervisory authority and the data subjects is the Controller’s responsibility.

10. Audit rights

The Processor makes available to the Controller all information necessary to demonstrate compliance with this agreement, in particular this description of the technical and organisational measures. The Controller may request a review once a year and on specific cause; reviews are primarily conducted by written information or submission of evidence (e.g. data centre certificates). On-site inspections are possible with reasonable notice (at least 14 days) during normal business hours and must not affect operations or the data of other customers.

11. Deletion and return

The Controller can export its data at any time during the contract term via SFTP, database export and backup download. After the hosting contract ends, all customer data (web space, databases, mailboxes, DNS zones) is deleted no later than 30 days after the end of the contract unless the Controller requests earlier deletion. Backups containing this data are overwritten no later than 30 days thereafter. Contract and billing data of the Controller itself that is subject to statutory retention periods is exempt from deletion.

12. Liability, final provisions

Liability is governed by Art. 82 GDPR and the liability clause of the Terms. Amendments to this agreement require text form. In the event of conflict between this agreement and the Terms, this agreement prevails in data protection matters. German law applies.

Contact for data protection matters and instructions:
UTRANET GbR, Kleine Schmidtgasse 1, 63571 Gelnhausen, Germany
Email: billing@utra.network

This page can be saved as a PDF using the browser’s print function and serves as evidence under Art. 28(9) GDPR.