This Data Processing Addendum ("DPA") forms part of the DrivenHost Terms of Service for any customer ("Controller", or "Business" under US state law) that stores personal data using the Services, and applies automatically without signature. It is drafted to satisfy Article 28 of the EU and UK GDPR, the service-provider and processor requirements of the California Consumer Privacy Act and similar US state laws, and the accountability principle of PIPEDA.
1. Roles and scope
The Controller determines the purposes and means of processing personal data it stores using the Services. DrivenHost ("Processor") processes that data only to provide the Services in accordance with the Terms and the Controller's documented instructions, which for this purpose include configuration through the client area and support requests. The subject matter is the hosting, storage, transmission and backup of Controller data; the duration is the term of the Services; the data subjects and categories of data are those the Controller chooses to store.
2. Processor obligations
DrivenHost will: process personal data only on the Controller's instructions, unless required by law, in which case it will inform the Controller where legally permitted; ensure personnel with access are bound by confidentiality; implement appropriate technical and organisational measures, including access control with multi-factor authentication, encryption in transit, encrypted off-site backups, logging and regular review; assist the Controller, so far as reasonably possible, in responding to data subject requests and in meeting its obligations on security, breach notification and impact assessments; notify the Controller without undue delay, and in any event within 72 hours, on becoming aware of a personal data breach affecting Controller data; delete or return Controller data at the end of the Services, and delete remaining copies within 30 days unless law requires retention; and make available the information reasonably necessary to demonstrate compliance, and allow audits by the Controller or an auditor mandated by it, on reasonable notice and no more than once a year unless required by a supervisory authority.
3. US state law terms
Where the CCPA or a similar US state law applies, DrivenHost acts as a service provider or processor. It will not sell or share personal information received from the Controller, retain, use or disclose it for any purpose other than providing the Services or as permitted by that law, or combine it with personal information from other sources except as permitted. DrivenHost certifies that it understands these restrictions, will notify the Controller if it can no longer meet them, and grants the Controller the right to take reasonable steps to stop and remediate unauthorised use.
4. Sub-processors
The Controller authorises DrivenHost to use sub-processors to provide the Services, currently: data centre and infrastructure providers in Canada, the United States and the European Union, our payment processor (for billing data only), and our domain registrar (for registrant data only). We will give at least 30 days' notice of any new sub-processor that will process Controller data; the Controller may object on reasonable grounds, in which case the parties will work in good faith to resolve the objection, failing which the Controller may terminate the affected Service with a pro-rated refund.
5. International transfers and data location
Controller data is stored in the region in which the Service is provisioned (Canada, the United States or the European Union) and, for encrypted backups, may be replicated to another of those regions unless the Controller has requested single-region storage in writing. Canada is recognised by the European Commission as providing adequate protection for commercial organisations. Transfers of EU or UK personal data to the United States are made under the EU Standard Contractual Clauses (module two, controller to processor) and the UK International Data Transfer Addendum, which are incorporated by reference and will be provided on request.
6. Liability
Each party's liability under this DPA is subject to the limitations in the Terms of Service.
7. Precedence
In the event of conflict between this DPA and the Terms concerning the processing of personal data, this DPA prevails.