GDPR Data Processing Agreement

1. Scope, Status, and Governing Legislation

1.1. Application: This Addendum applies whenever Blended Hosts processes personal data on behalf of the Customer in the course of providing web hosting, managed WordPress, cloud VPS, domain registration, professional mailboxes, DNS management, and related infrastructure services.

1.2. Statutory Roles of the Parties:

• The Customer is the Data Controller (or an authorised intermediary acting on behalf of a third-party controller) who determines the purposes, legal bases, and means of processing personal data stored within hosted websites, databases, and mailboxes.
• Blended Hosts is the Data Processor acting strictly upon the documented instructions of the Customer to provide hosting compute, storage, routing, and platform maintenance.

1.3. Governing Data Protection Law: This Agreement is construed in accordance with the laws of England and Wales and the data protection statutes of the United Kingdom, specifically:

• The UK General Data Protection Regulation (UK GDPR) as defined in Section 3(10) (as supplemented by Section 205(4)) of the Data Protection Act 2018;
• The Data Protection Act 2018 (DPA 2018); and
• The Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), together with any applicable successor legislation.

2. Details of Processing (Article 28(3) Specifications)

2.1. Subject Matter: The hosting, dynamic compute execution, database queries, network routing, and automated snapshot backup of websites, applications, emails, and digital files configured by the Customer.

2.2. Duration of Processing: The duration of the Customer’s active subscription term plus the post-cancellation 30-day timeline backup overwrite lifecycle specified in Section 6.

2.3. Nature and Purpose: Storing, transmitting, and serving electronic files and data across the Blended Hosts Cloud Platform in accordance with Customer configurations and commands.

2.4. Categories of Data Subjects: Individuals whose personal data is submitted, hosted, collected, or stored by the Customer via their website or mailboxes (including, without limitation, end-user visitors, registered account holders, e-commerce customers, employees, and digital correspondents).

2.5. Types of Personal Data: Any personal data uploaded or processed across our infrastructure at the Controller’s sole discretion, including names, contact details, postal addresses, IP addresses, access log records, customer transaction histories, user authentication credentials, and email correspondence.

3. Obligations and Warranties of the Processor

Blended Hosts warrants, undertakes, and agrees that it shall:

3.1. Process Only on Documented Instructions: Process personal data solely upon the documented instructions of the Controller (including with respect to data transfers outside the UK), unless required to do so by applicable UK or English law. In such a case, we will notify the Controller of that legal requirement before processing, unless prohibited by law on public interest grounds.

3.2. Confidentiality Commitments: Ensure that all internal staff, systems engineers, and technical support agents authorised to access Customer data or platform hypervisors are bound by statutory or contractual duties of confidentiality.

3.3. Technical and Organisational Security Measures (Article 32): Implement and maintain technical and organisational measures appropriate to protect Customer data against unauthorised or unlawful processing, accidental loss, destruction, damage, or disclosure, including:

• Hosting servers in secure, ISO 27001-certified UK data facilities equipped with 24/7/365 biometric access controls, perimeter monitoring, continuous CCTV, and VESDA automated fire protection;
• Multi-terabit automated Distributed Denial of Service (1 Tbps+ DDoS) mitigation and enterprise Web Application Firewall (WAF) shielding;
• Automated daily 30-day snapshot Timeline Backups with self-service 1-click restore functionality;
• Modern encryption in transit via Transport Layer Security (TLS 1.2 / TLS 1.3) protocols; and
• Proactive platform security updates, automated malware scanning routines, and kernel patching without downtime.

3.4. Assistance with Data Subject Rights: Taking into account the nature of the processing, assist the Controller (primarily via self-service administration tools in the Blended Hosts Control Panel or direct support ticket triage) in fulfilling its obligations to respond to data subject requests under Chapter III of the UK GDPR (including rights of access, rectification, erasure, restriction, and data portability).

3.5. Personal Data Breach Notification: Notify the Controller in writing without undue delay (and in any event within 48 hours) upon confirming any personal data breach affecting Customer data hosted on our infrastructure. We will provide reasonable diagnostic details, affected resource identifiers, and mitigation steps taken to assist the Controller in fulfilling its statutory reporting duties to the Information Commissioner’s Office (ICO).

3.6. Regulatory Audits and Compliance Demonstrations: Make available to the Controller all information reasonably required to demonstrate compliance with Article 28 of the UK GDPR. The Customer may conduct an audit or review of our compliance policies no more than once in any 12-month period upon providing at least thirty (30) calendar days’ advance written notice, during regular UK business hours and subject to reasonable security and non-disclosure agreements.

4. Authorised Sub-Processors

4.1. General Written Authorisation: The Controller provides general written authorisation for Blended Hosts to engage the trusted third-party sub-processors listed in Annex 1 to assist in delivering platform connectivity, domain routing, and billing administration.

4.2. Sub-Processor Contractual Pass-Through: Where a sub-processor is appointed, Blended Hosts enters into a formal written contract imposing data protection obligations no less protective than those set out in this DPA.

4.3. Prior Notification of Changes: We will notify Customers of any planned additions or replacements of sub-processors at least thirty (30) calendar days in advance via updates to this policy or announcements in the Blended Hosts Client Portal. This notice period affords the Controller the opportunity to raise reasonable objections or cancel rolling monthly services without exit penalty before the change takes effect.

5. International Data Transfers and UK Sovereignty

5.1. UK Data Residency: All primary hosting nodes, web server clusters, production MySQL/MSSQL databases, and automated daily snapshot backups are located physically within enterprise data facilities in the United Kingdom.

5.2. Cross-Border Transfers: Where an individual service requires the transmission of personal data outside the United Kingdom (such as registering an international top-level domain with an overseas central registry under ICANN mandates):

• Transfers to countries within the European Economic Area (EEA) operate under current UK Adequacy Regulations;
• Transfers to third countries without UK adequacy regulations are governed by approved statutory transfer instruments, including the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses (SCCs).

6. Data Deletion and Backup Lifecycle Post-Cancellation

6.1. Production Data Deletion: Upon the effective cancellation or termination of a hosting service in accordance with our Terms and Conditions of Service:

• All active production website directories, databases, and mailbox stores are permanently unprovisioned and deleted from active server clusters;
• Automated secondary snapshot Timeline Backups roll off and are permanently overwritten within thirty (30) calendar days in accordance with our daily rotation cycle.

6.2. Controller Export Obligations: Because automated timeline backups permanently overwrite after thirty days, the Controller is strictly responsible for downloading and securing independent, off-site archives of all website databases, files, and mailboxes via the Blended Hosts Control Panel prior to executing an account cancellation request.

Annex 1 — Authorised Sub-Processors

The third-party entities listed below are approved sub-processors engaged in the technical delivery, network security, and billing operations of Blended Hosts services: