Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the HostPowr Terms of Service and applies where HostPowr processes personal data on your behalf in the course of providing hosting services. It is entered into between you (the "Controller") and HostPowr, operated under BizPowr (the "Processor"), and reflects the parties' obligations under the General Data Protection Regulation (GDPR), Article 28.

By using our services to store or process personal data of your own users or customers, you accept this DPA.

1. Definitions

Terms such as "personal data," "processing," "data controller," "data processor," "data subject," and "supervisory authority" have the meanings given in the GDPR.

• Controller — you, the customer, who determines the purposes and means of processing the data you host.
• Processor — HostPowr, which processes that data on your behalf.
• Sub-processor — a third party engaged by HostPowr to assist in processing.

2. Roles of the Parties

• 2.1 For personal data you store, host, or process using our services, you are the Controller and HostPowr is the Processor.
• 2.2 You are responsible for ensuring you have a lawful basis to collect and process the data you host, and that your own privacy notices and consents are in place.
• 2.3 HostPowr processes such data only to provide the services and only on your documented instructions, which include these Terms and your use of the services.

3. Subject Matter & Details of Processing

• Subject matter: Provision of hosting services.
• Duration: For the term of your service, plus any legally required retention period.
• Nature & purpose: Storage, hosting, and technical processing of data necessary to operate your hosted services.
• Types of personal data: As determined by you — typically names, emails, contact details, and any data your users submit to your hosted sites/applications.
• Categories of data subjects: As determined by you — typically your website visitors, users, or customers.

You control and are responsible for the specific data you choose to host.

4. Processor Obligations

HostPowr agrees to:

• 4.1 Process personal data only on your documented instructions, unless required by law.
• 4.2 Ensure persons authorized to process the data are bound by confidentiality.
• 4.3 Implement appropriate technical and organizational security measures (see Section 7).
• 4.4 Respect the conditions for engaging sub-processors (see Section 5).
• 4.5 Assist you, where reasonably possible, in responding to data subject rights requests.
• 4.6 Assist you in ensuring compliance with security, breach notification, and impact assessment obligations, taking into account the nature of processing and information available to us.
• 4.7 Delete or return personal data at the end of the services, as set out in Section 8.
• 4.8 Make available information necessary to demonstrate compliance with Article 28 and allow for audits as described in Section 9.

5. Sub-Processors

• 5.1 You provide general authorization for HostPowr to engage sub-processors necessary to deliver the services (for example, EU-based infrastructure providers, payment processors, and registrars).
• 5.2 We impose data protection obligations on sub-processors equivalent to those in this DPA.
• 5.3 We remain responsible for our sub-processors' performance of their data protection obligations.
• 5.4 We will inform you of intended changes to sub-processors where required, giving you the opportunity to object on reasonable data protection grounds.

6. International Transfers

• 6.1 HostPowr prioritizes processing personal data within the European Union.
• 6.2 Where any transfer outside the EU/EEA occurs, it will be subject to appropriate safeguards under GDPR (such as Standard Contractual Clauses or an adequacy decision).

7. Security Measures

Taking into account the state of the art and the nature of processing, HostPowr implements appropriate technical and organizational measures, including:

• EU-hosted infrastructure
• Encryption where appropriate
• Access controls and authentication
• Network and server security monitoring
• Firewalls and intrusion protection
• Regular system hardening and updates
• Logical separation of customer accounts

These measures are reviewed and updated as appropriate. You remain responsible for the security of your own applications, code, and credentials.

8. Return & Deletion of Data

• 8.1 On termination or cancellation of your services, personal data may be deleted in line with our Backup Policy and Terms.
• 8.2 Before your services end, you are responsible for exporting and retrieving any data you wish to keep.
• 8.3 We may retain data where required by law, for the period required.

9. Audits

• 9.1 We will make available information reasonably necessary to demonstrate compliance with this DPA.
• 9.2 Where you require further audit, it must be requested in writing, conducted at reasonable intervals, during business hours, without disrupting our operations or other customers, and subject to confidentiality. We may satisfy audit requests by providing relevant documentation or third-party certifications where available.

10. Personal Data Breach

• 10.1 We will notify you without undue delay after becoming aware of a personal data breach affecting your data.
• 10.2 The notification will include available information to help you meet your own breach-notification obligations.
• 10.3 You are responsible for notifying your supervisory authority and affected data subjects where required, as you are the Controller.

11. Your Obligations as Controller

You agree to:

• Ensure a lawful basis for the data you process and host
• Provide required privacy notices to your data subjects
• Obtain any necessary consents
• Respond to your data subjects' rights requests
• Not use our services to process data unlawfully
• Configure and secure your own applications appropriately

12. Liability

Liability under this DPA is subject to the limitations of liability set out in the HostPowr Terms of Service, to the extent permitted by law.

13. Changes

We may update this DPA to reflect changes in law, our services, or sub-processors. The current version is always available on our website.

14. Contact

For data protection matters: hello@hostpowr.com Address: Geraardsbergse Steenweg 120, B-9090 Melle, Belgium

Last updated: June 2026