This schedule applies where a business customer is a controller and Strange Duck Hosting processes personal data contained in hosted websites, databases or email solely to provide the service.
1. Roles and instructions
The customer is the controller and Strange Duck Hosting is the processor for customer-hosted personal data, unless the facts require a different legal classification.
We will process that data only:
- on the customer’s documented instructions, including instructions inherent in using the service;
- as necessary to provide, secure, back up and support the hosting service; or
- where UK law requires processing, in which case we will inform the customer unless law prohibits notice.
The customer is responsible for ensuring that its instructions and use of the service comply with data-protection law.
2. Processing details
- Subject matter: provision of shared web hosting, email, databases, security, backups and support.
- Duration: the service term plus deletion and backup-rotation periods.
- Nature: storage, transmission, retrieval, backup, restoration, security scanning, troubleshooting and deletion.
- Purpose: supplying and protecting the customer’s hosting service.
- Data subjects: people whose information the customer places in the service, such as website users, customers, staff, volunteers, members or contacts.
- Data types: any personal data uploaded by the customer. The service is not designed for unlawfully collected data or special-category/high-risk processing without an appropriate written assessment and safeguards.
3. Confidentiality and security
We will ensure that people authorised to access hosted personal data are subject to confidentiality obligations. We will maintain measures appropriate to the risk, including access controls, encrypted transport, account isolation, patching, malware scanning, monitoring and backups.
The customer remains responsible for application-level security, permissions, passwords, software updates and lawful configuration.
4. Subprocessors
The customer gives general authorisation for subprocessors reasonably required to provide the service. Current categories and principal providers include:
- Krystal Hosting Ltd — UK hosting infrastructure, backups and platform support;
- cPanel/WebPros — hosting control-panel software and associated services;
- CloudLinux/Imunify360 — account isolation and security services; and
- providers used for email, DNS, monitoring or technical support where they process relevant hosted data.
We remain responsible for imposing appropriate data-protection obligations on subprocessors where required. We will give reasonable notice of a material new subprocessor where practicable. A customer with a legitimate data-protection objection should contact us promptly; if no reasonable alternative is available, either party may end the affected service.
5. Assistance
Taking into account the nature of processing and information available to us, we will provide reasonable assistance with:
- data-subject requests;
- security and breach assessment;
- data-protection impact assessments; and
- regulator consultations,
where the request relates to our processing. Extensive work outside normal support may be chargeable if agreed in advance.
6. Personal-data breaches
We will notify the customer without undue delay after becoming aware of a personal-data breach affecting customer-hosted data and will provide information reasonably available to us. The customer remains responsible for deciding whether it must notify individuals or a regulator.
7. Return and deletion
During the active service, the customer can normally export hosted data using available tools. At the end of the service, the customer must retrieve required data before termination.
We will delete or make inaccessible customer-hosted data after termination, subject to backup rotation, legal obligations and limited security evidence. Residual backup data will remain protected and will not be restored except for legitimate recovery, legal or security purposes.
8. International transfers
Customer-hosted data is intended to reside on the selected UK hosting infrastructure. If a support or security subprocessor makes a restricted international transfer, we will use a lawful transfer mechanism where required.
9. Information and audit
We will provide information reasonably necessary to demonstrate compliance with this schedule. Audits must be proportionate, protect other customers and systems, use existing independent reports where sufficient, and be arranged on reasonable notice. The customer will bear reasonable costs of a bespoke audit unless it identifies our material breach.