This agreement forms part of the contract with WPhost under the terms and conditions at https://wphost.bg/en/terms. It covers the personal data in customers' sites and servers that we access while working on them, for example the data of buyers in an online store. Here “the Regulation” means Regulation (EU) 2016/679, and terms defined in the terms and conditions have the same meaning.
1. Parties and scope
1.1. The parties are the Customer as controller (the “Controller”) and Private DevOps LTD (ПРАЙВЪТ ДЕВОПС ЕООД) as processor (the “Processor”). Where the Customer itself is a processor for its own client, for example as an agency, the Processor is its sub-processor and the Customer warrants that its controller has authorised this.
1.2. This agreement does not apply to the extent the Regulation does not apply to the Customer, for example where a natural person uses the Site for purely personal or household activities.
2. Subject matter, duration, nature and purpose
2.1. In maintenance and Projects the Processor gains access to the files and databases of the Site and to the Server. It processes the personal data in them only as far as needed for maintenance, the staging copy, backups, monitoring and the agreed Projects. Processing includes copying and storing copies, viewing, changing and restoring data while working on the Site, and deleting the copies after the contract ends.
2.2. This agreement applies for the term of the contract and until the data is deleted under clause 9.1.
3. Types of data and data subjects
3.1. The data and data subjects depend on the Site. Usually they are the Site's buyers, registered users, visitors and subscribers and the Controller's staff, and the data are names, email addresses, phone numbers, delivery and billing addresses, orders and payments, accounts and logins, IP addresses and the content of messages, reviews and comments. The Processor does not check what data the Controller keeps on the Site.
3.2. Do not store full payment card data on the Site, and use a payment provider for card payments. If the Site holds special categories of data under Article 9 of the Regulation, tell us in advance. You are responsible for the additional measures for them.
4. Processor's obligations
4.1. The Processor:
- a) processes the data only on documented instructions from the Controller, such as the contract, accepted quotes and support requests, and informs the Controller immediately if in its opinion an instruction infringes data protection law. If the law requires it to process data otherwise, it informs the Controller beforehand, unless the law prohibits this;
- b) gives access to the data only to team members who need it for their work and who have committed to confidentiality;
- c) applies the security measures in section 5;
- d) engages sub-processors only under section 6;
- e) helps the Controller respond to requests from data subjects, for example by finding, exporting, correcting or deleting data on the Site on the Controller's instruction. It does not answer data subjects directly but refers them to the Controller;
- f) helps the Controller meet its obligations on security, breach notification, impact assessment and prior consultation, taking into account the nature of the processing and the information available to it;
- g) returns or deletes the data after the services end, under section 9;
- h) makes available to the Controller the information needed to demonstrate compliance with this agreement and allows audits under section 8.
4.2. The usual assistance under points e) and f) comes at no extra charge.
5. Security measures
5.1. The Processor applies the following measures and reviews them when needed.
- It works with separate access for itself only, which the Controller can revoke at any time, and never asks for passwords by email.
- Only team members who need it have access to customers' sites and servers and to the copies held by the Processor.
- It connects to customers' sites and servers only over encrypted connections.
- Every change is a version in Git, is tested in staging and reaches the live site after the tests, with a plan for rolling back.
- The staging copy and backups serve only the maintenance of the Site in question, are kept off its Server, and restoring from them is tested regularly.
- The software it maintains is kept updated, including with security fixes, and plugins and themes are monitored for known vulnerabilities.
6. Sub-processors
6.1. The Controller gives general authorisation for the following sub-processor.
| Sub-processor | Activity | Data location |
|---|---|---|
| Hetzner Online GmbH | servers on which we keep the staging copy and the backups | Germany |
6.2. We notify the Controller by email at least 30 days in advance of a new or replacement sub-processor. The Controller may object within that time, and if the objection is reasonable and cannot be resolved, terminate the contract. We then refund the unused part of the Paid Period or, for a Project, what was paid for work not done.
6.3. We impose the same data protection obligations on sub-processors by contract and remain responsible for their performance. If a Project needs another sub-processor, for example an artificial intelligence service provider, the quote names it, and by accepting the quote the Controller authorises it.
6.4. Cloudflare, when we set it up in the Controller's own account, and the Controller's Hosting Provider, including a cloud provider in its account, are not our sub-processors. They act for the Controller under its contract with them.
7. Security breaches
7.1. We notify the Controller without undue delay and no later than 48 hours after becoming aware of a breach affecting the data under this agreement, and provide the information available. The Controller decides whether to notify the supervisory authority and the data subjects.
8. Audits
8.1. We provide the information needed to demonstrate compliance with this agreement, for example a description of the measures and answers to a questionnaire.
8.2. The Controller may carry out an audit or appoint an auditor bound by confidentiality, with 30 days' notice, up to once a year unless after a security breach. The audit takes place during working hours without disrupting the services, and its costs are borne by the Controller.
9. End of processing
9.1. Within 30 days after the contract ends, the Controller may ask for a copy of the data. After that we delete it together with its copies, as described in the terms and conditions, unless the law requires us to keep it.
10. Other provisions
10.1. We do not transfer the data outside the European Economic Area unless an accepted quote says so, and then only under the conditions of Chapter V of the Regulation. Where the Server is located is the Controller's decision.
10.2. If an authority requests access to the data, we inform the Controller unless the law prohibits it, and disclose data only where there is a legal basis.
10.3. The Controller is responsible for the legal basis of the processing, for informing data subjects, for cookies on the Site and for the lawfulness of its instructions.
10.4. The parties' liability is governed by the terms and conditions, without affecting data subjects' rights under Article 82 of the Regulation. On data protection matters this agreement takes precedence over the terms and conditions.