Data Processing Addendum

1.1This Data Processing Addendum applies where Hosting UK processes personal data on behalf of the Customer in connection with the Services.

1.2Terms such as controller, processor, personal data, processing and data subject have the meanings given in applicable Data Protection Legislation.

2.1The Customer is the controller or processor, and Hosting UK is the processor or sub-processor, in respect of Customer personal data processed through the Services.

2.2Where Hosting UK provides colocation or services where it has no access to personal data, Hosting UK may not act as processor for that data.

3.1Hosting UK shall process personal data only in accordance with the Agreement, the Customer's documented instructions and applicable law.

3.2Hosting UK is not required to investigate the completeness, accuracy or sufficiency of Customer instructions.

4.1Hosting UK shall implement appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing and accidental loss, destruction or damage.

4.2The Customer is responsible for assessing whether the Services are appropriate for the nature and sensitivity of the personal data it processes.

5.1The Customer authorises Hosting UK to use sub-processors to provide the Services.

5.2Hosting UK shall ensure that sub-processors are subject to data protection obligations appropriate to the processing they perform.

5.3Hosting UK's current sub-processors, grouped by the service they support, are set out in the expandable list below.

5.4Domain registries and naming authorities process registration information as independent data controllers under their own policies and are not sub-processors of Hosting UK.

5.5Hosting UK may add, replace or remove sub-processors as its services evolve, and will update this list accordingly. The Customer may contact Hosting UK for the current version at any time.

6.1Hosting UK shall provide reasonable assistance, at the Customer's cost, to help the Customer respond to data subject requests where required by Data Protection Legislation.

7.1Hosting UK shall notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer personal data processed by Hosting UK.

7.2The Customer is responsible for determining whether notification to regulators or data subjects is required.

8.1Hosting UK may transfer personal data where necessary to provide the Services, subject to appropriate safeguards required by Data Protection Legislation.

9.1On termination, Hosting UK shall delete or return personal data in accordance with the Agreement, unless retention is required by law or technically unavoidable in backups or logs.

10.1Liability under this Data Processing Addendum is subject to the limitations and exclusions in the Master Services Agreement, except where liability cannot lawfully be limited or excluded.