Yes. We have a UK GDPR Data Processing Agreement (DPA), and it applies to every customer automatically – there’s nothing to sign.
Who is responsible for what
- Data you store with us (your website visitors, your customers, your email contacts): you are the controller and we are your processor. We handle it only on your instructions, under our Data Processing Agreement.
- Our own records about you (your account, billing and support history): we are the controller, and our Privacy Policy applies.
What our Data Processing Agreement covers
- Your instructions – we process your data only as you instruct.
- Confidentiality and security – appropriate technical and organisational measures, listed in Annex 2 of the DPA.
- Sub-processors – we only use those on our Sub-processor List, and give at least 30 days’ notice before adding or replacing one. You can object, and if we can’t reasonably meet your concern you can cancel the affected services and receive a pro-rata refund.
- Breach notification – we’ll tell you without undue delay, and in any case within 48 hours, of becoming aware of a personal data breach affecting your data.
- Help with requests – if someone contacts us about their data held in your services, we pass it to you.
- Audits – on request, we’ll provide information such as our Cyber Essentials certificate and answers to reasonable security questionnaires.
- Deletion – your data is deleted within 30 days of your services ending, with backups overwritten within a further 30 days.
Your part as controller
You’re responsible for having a lawful basis for the personal data you process using our services, and for the security of what’s under your control – including turning on two-factor authentication, keeping website software and plugins updated, and keeping your own backups.
Useful details for your records
| Item | Details |
|---|---|
| Company | PAC WEBHOSTING LTD, registered in England and Wales, company number 06221654 |
| ICO registration | ZA343655 |
| Security certification | Cyber Essentials |
Microsoft 365 is covered by Microsoft’s own customer agreement and data protection terms, not our DPA.
Read the full Data Processing Agreement, Sub-processor List and Privacy Policy. For privacy questions, use the privacy contact listed in section 1 of our Privacy Policy.
Any questions about this? Please contact our support team and we’ll be happy to help.
