Data Processing Agreement (DPA)

1. The parties and roles

For the personal data that the Client stores or processes through HostX services (files, databases, mailboxes and email messages, backups), the Client acts as Controller and HostX Web Services SRL acts as Processor. For the Client's account, billing, and contact data, HostX acts as controller, governed by the Privacy Policy.

2. Subject matter, duration, nature, and purpose of processing

The subject matter and duration of processing correspond to the contracted services; the nature and purpose consist of the provision of hosting and related services. The types of data and the categories of data subjects are those the Client inputs/stores through the Services. Processing is carried out for the duration of the actual provision of services, regardless of the duration of other agreements.

3. The Controller's instructions

The Processor processes data exclusively based on the Controller's documented instructions (including on transfers outside the EU/EEA), except for obligations imposed by EU or national law. The order, this DPA, and requests submitted through the Client Account or by email constitute documented instructions. The Processor informs the Controller if an instruction infringes applicable law.

4. Confidentiality

The Processor ensures that persons authorized to process the data have undertaken confidentiality obligations or are under a statutory obligation of confidentiality and are appropriately trained.

5. Security measures (Art. 32)

The Processor implements technical and organizational measures appropriate to the risk, described in the Annex – Technical and Organizational Measures, an integral part of this DPA, available at [link]. The measures may be updated in line with technical developments, without reducing the level of security.

6. Subcontractors (sub-processors)

The Controller grants general authorization for the use of subcontractors. The up-to-date list is published at https://www.hostx.eu/subprocessors. The Processor informs the Controller of any intention to add/replace a subcontractor, and the Controller may object with reasons within 14 days. The Processor imposes the same data-protection obligations on subcontractors.

Liability (Art. 28(4)): if a subcontractor fails to fulfill its data-protection obligations, the Processor remains fully liable to the Controller for the fulfillment of that subcontractor's obligations.

7. Assistance with data-subject rights

The Processor assists the Controller, through appropriate technical and organizational measures, in fulfilling the obligation to respond to requests to exercise data-subject rights. Requests received directly from data subjects are promptly forwarded to the Controller, who is responsible for responding.

8. Incident notification and impact assessment

The Processor notifies the Controller without undue delay and, in any event, within 48 hours of becoming aware of a personal-data breach, providing the information required under Art. 33(3) GDPR that is available to it, so that the Controller can meet its obligation to notify ANSPDCP within 72 hours. The Processor assists the Controller with data-protection impact assessments (DPIAs) and consultations with the supervisory authority.

9. Deletion or return of data

Upon termination of the services, the Processor deletes or returns the personal data to the Controller, at the Controller's choice, unless retention is required by law. The methods and deadlines are those set out in the Terms & Conditions.

10. Audit and availability of information

The Processor makes available to the Controller the information necessary to demonstrate compliance with its obligations and allows audits, including inspections, carried out by the Controller or by a mandated auditor, under reasonable conditions (prior notice, during business hours, without disrupting activity, respecting confidentiality), at the Controller's expense.

11. International transfers

Any transfer outside the EU/EEA is carried out only on the basis of a valid transfer mechanism (adequacy decision, standard contractual clauses, or another basis provided by the GDPR). The Processor concludes the standard contractual clauses in the name of and in accordance with the instructions of the Controller, who grants the necessary authority for this purpose.

12. Contact details

Data Protection Officer / contact person for data protection: privacynospam-do-not-harvest​@hostx.ro. The Controller's (Client's) contact details are those in the Client Account.

13. Order of precedence and applicable law

In case of inconsistency between this DPA and the Terms & Conditions or other agreements, on data-protection matters this DPA prevails. The applicable law is Romanian law, in conjunction with the GDPR.