Data Processing Agreement (DPA)

For personal data submitted by the Customer to hosting or managed services, the Customer is controller and HOSTUVO — środowisko wdrożeniowe is processor. Processing follows documented Customer instructions unless required by law.

Authorised personnel are bound by confidentiality. Risk-based measures include access control, segmentation, transport encryption, backups, logging and vulnerability management.

After confirming a breach affecting entrusted data, we notify the Customer without undue delay and provide available information needed for the Customer’s obligations.

The Customer gives general authorisation for sub-processors listed in the current register. Material planned changes are notified in advance so a reasoned objection can be made. Equivalent data-protection duties are imposed on sub-processors.

We reasonably assist with data-subject rights, impact assessments and consultations and provide information needed to demonstrate compliance. Audits must not compromise security or other customers’ confidentiality.

At service end, data is deleted or returned according to instructions, retention schedules and law. Backup copies expire through the normal rotation cycle.