Data Processing Agreement

Data Processing Agreement (DPA)

This Data Processing Agreement ("DPA") is entered into between HostupCloud ("Data Processor") and you, the customer ("Data Controller"), in accordance with Article 28 of the EU GDPR, the UK GDPR as reformed by the Data (Use and Access) Act 2025, the Indian Digital Personal Data Protection Act 2023 + DPDP Rules 2025, and applicable US state privacy laws including CCPA/CPRA and the 20+ state comprehensive privacy laws active as of 2026. This DPA also addresses obligations under the EU Data Act 2023(effective September 2025) and NIS2 Directive (transposed October 2024). It forms part of the General Terms and Conditions.

Last updated: 22 February 2026 · Effective: 22 February 2026

This DPA is automatically incorporated into your agreement with HostupCloud when you use our services to process personal data of third parties (e.g. your customers' data hosted on our infrastructure). No separate signature is required — accepting the General Terms constitutes acceptance of this DPA.

Roles Subject Matter Processor Obligations Sub-processors Security Data Transfers Data Subject Rights Breach Notification Deletion Liability

1. Roles of the Parties

Data Controller

You (the Customer)

You determine the purposes and means of processing personal data stored on HostupCloud infrastructure (e.g. your end customers' data, employee data, user databases). You are responsible for your lawful basis for processing.

Data Processor

HostupCloud

HostupCloud processes personal data only on your documented instructions — by providing compute, storage, and network infrastructure. We do not determine the purpose of processing and do not use your data for our own commercial purposes.

2. Subject Matter & Nature of Processing

Nature

Hosting, storage, transmission, and backup of personal data on HostupCloud servers and network infrastructure as instructed by the Controller.

Purpose

To provide the contracted cloud infrastructure services (Shared Hosting, Cloud VPS, Bare Metal, Object Storage, etc.) to the Controller.

Duration

For the term of the service agreement. Processing ceases on termination; data is deleted within 30 days unless required by law.

Data types

Any personal data the Controller uploads or stores — typically contact details, account credentials, user records, logs, or application data.

Data subjects

End users of the Controller's applications and services, employees, or any individuals whose data the Controller hosts on HostupCloud.

Instructions

HostupCloud processes data solely on the Controller's instructions (service configuration, support tickets, backup/restore requests).

3. HostupCloud's Processor Obligations

3.1Process personal data only on documented instructions from the Controller — including transfers to third countries

3.2Ensure that authorised personnel are bound by confidentiality obligations

3.3Implement appropriate technical and organisational security measures (see Section 5)

3.4Assist the Controller with data subject access, rectification, erasure, and portability requests where technically feasible

3.5Assist the Controller in meeting GDPR obligations (security, breach notification, DPIAs, prior consultation)

3.6Delete or return all personal data to the Controller upon termination, at the Controller's election

3.7Provide all information necessary to demonstrate compliance with Article 28 GDPR and cooperate with audits

3.8HostupCloud will not sell, share, or use personal data stored by the Controller for HostupCloud's own marketing or analytics

3.9HostupCloud will not disclose personal data to third parties except sub-processors listed in this DPA or as required by law

4. Sub-processors

HostupCloud uses the following sub-processors to deliver services. By accepting this DPA, you provide general written authorisation for these sub-processors. We will notify you 30 days before adding or replacing a sub-processor.

Sub-processor	Purpose	Location
Razorpay	Payment processing (billing data only)	India
Sentry (Functional Software)	Anonymised error monitoring	USA (SCCs)
Crisp IM SAS	Live chat support	France (EU)
MaxMind	IP geolocation for fraud prevention	USA (SCCs)
Cloudflare	DDoS protection and CDN (edge caching)	USA (SCCs)

SCCs = EU Standard Contractual Clauses are in place for transfers to the USA. An up-to-date list is available at privacy@hostupcloud.com.

5. Technical & Organisational Security Measures

Encryption in transit

TLS 1.2+ enforced on all public-facing endpoints. HTTP redirected to HTTPS.

Encryption at rest

Storage volumes encrypted using AES-256. Backup data encrypted before transfer.

Access control

Role-based access control (RBAC), least-privilege principle, MFA mandatory for HostupCloud staff with infrastructure access.

Network isolation

Customer VMs are isolated at the hypervisor layer. Private networking available for inter-service communication.

Intrusion detection

Imunify360, WAF, and real-time network anomaly detection deployed across shared hosting infrastructure.

Audit logging

All administrative access to customer infrastructure is logged and retained for 90 days.

Vulnerability management

Regular patching cycles (OS, hypervisor, control panel). Critical CVEs patched within 24–72 hours.

Physical security

Data centres operate with biometric access, 24/7 CCTV, fire suppression, and N+1 power redundancy.

6. International Data Transfers

Customer data is processed in the data centre location selected at provisioning time. HostupCloud does not transfer Customer Content across regions without your instruction.

🇮🇳

India

Primary data centre. Governed by DPDPA 2023 + DPDP Rules 2025. Data localisation available. Data Protection Board of India being constituted.

🇪🇺

European Union

EU infrastructure planned. Governed by EU GDPR, EU Data Act 2023 (effective Sept 2025), and NIS2 Directive (Oct 2024). SCCs in place for US sub-processors.

🇬🇧

United Kingdom

Governed by UK GDPR as reformed by the Data (Use and Access) Act 2025. UK International Data Transfer Agreements (IDTAs) used for transfers outside the UK.

🇺🇸

United States

US-region available. Governed by applicable state privacy laws (CCPA/CPRA, TDPSA, VCDPA, and 17+ others active in 2026). SCCs and DPA between HostupCloud Inc. and EU/UK customers.

7. Data Subject Rights Assistance

HostupCloud will assist you in responding to data subject requests to the extent technically feasible for a processor. The Controller remains responsible for responding to data subjects.

7.1Access (Article 15 GDPR) — we can provide logs of data stored on request

7.2Erasure (Article 17 GDPR) — we will delete data upon your instruction via ticket or panel

7.3Portability (Article 20 GDPR) — data exports available in standard formats (e.g. cPanel backup, VM image)

7.4Rectification (Article 16 GDPR) — data correction is the Controller's responsibility; we provide the tools

7.5HostupCloud does not respond to data subject requests directly unless we are the Controller for that data (e.g. your account data with us)

8. Personal Data Breach Notification

8.1HostupCloud will notify the Controller without undue delay — and within 72 hours where feasible — upon becoming aware of a personal data breach affecting Customer Content

8.2Notification will include: nature of the breach, categories and approximate number of data subjects affected, likely consequences, and measures taken or proposed

8.3Notification sent to the primary account email and, if provided, a dedicated security contact email

8.4Controller remains responsible for notifying their supervisory authority and affected data subjects

8.5HostupCloud is not responsible for breaches caused by the Controller's application-level vulnerabilities, weak passwords, or misconfigured access controls

9. Data Retention & Deletion

9.1Upon service termination, Customer Content is retained for up to 30 days to allow data retrieval, then securely deleted

9.2Deletion uses NIST 800-88 media sanitisation standards for decommissioned hardware

9.3Backup data is deleted within 30 days of service termination

9.4At the Controller's request, HostupCloud will provide a written certificate of deletion within 10 business days

9.5Billing and account records are retained for 7 years as required by Indian GST and financial regulations — these are HostupCloud's own records, not Customer Content

10. Liability

Each party is liable for damage caused by processing that infringes GDPR or this DPA. A party is exempt from liability if it proves it was not in any way responsible for the event giving rise to the damage. HostupCloud's aggregate liability under this DPA is subject to the limitation of liability in the General Terms and Conditions.

Supervisory authority fines and penalties imposed directly on HostupCloud as Processor for breaches solely within our control are our responsibility. Fines imposed on the Controller for their own processing decisions are not HostupCloud's liability.

Need a signed DPA?

Enterprise customers may request a countersigned DPA for their compliance records. Contact our privacy team with your company details.

privacy@hostupcloud.com +91 87625 28280