1. Parties and subject
You are the controller. Zustack (KvK 67721540) is the processor. We process personal data on your behalf only to provide the services in our terms and conditions. Terms such as "personal data", "processing" and "data breach" have the meaning they have in the General Data Protection Regulation (GDPR).
2. What we process
| Nature of processing | Storing, hosting, backing up, transmitting and restoring data, and making it available to you and your users. |
|---|---|
| Purpose | Providing hosting and domain services to you. |
| Types of data | Whatever you and your users place on our services, such as names, email addresses, contact details, account details, order data and messages. We do not ask for special categories of data, and you must tell us before you store them. |
| Data subjects | Your customers, visitors, staff and other contacts. |
| Duration | For as long as the agreement lasts, plus the period in section 11. |
3. Your instructions
We process personal data only on your documented instructions, which are this agreement, the agreement for the services and the requests you send us. We tell you if we think an instruction breaks the law. We do not use the data for our own purposes.
4. Confidentiality
Everyone who works for us and has access to the data is bound to confidentiality. Access is limited to what the work needs.
5. Security
We take technical and organisational measures that fit the risk, taking into account the state of the art and the cost. They include encrypted connections, access control, separation between customers, timely security updates, monitoring and regular backups. We review them from time to time, and a summary is available on request. You are responsible for the security of the applications and passwords that you control.
6. Sub-processors
You give us general permission to engage sub-processors, such as suppliers of data centres, backup storage, email services and domain registration. They process data within the European Economic Area; our servers are in Germany. A current list of our sub-processors is available on request.
We bind every sub-processor to obligations equal to those in this agreement. We tell you at least 30 days before we add or replace one. You may object on reasonable grounds within that period. If we cannot settle it, you may end the affected service.
7. Requests from data subjects
If someone asks us to see, correct or delete their data, or uses another right under the GDPR, we send the request to you and do not answer it ourselves, unless you ask us to. We help you answer such requests, as far as we can and for a reasonable fee if the work is large.
8. Data breaches
If we find a personal data breach that affects your data, we tell you without undue delay and in any case within 48 hours. We tell you what happened, what data is involved, what the likely consequences are and what we have done. You decide whether to report to the Dutch Data Protection Authority and to the people affected, and we help with that.
9. Audits
We give you the information you need to check that we meet this agreement. Once a year, you may carry out an audit, or have one carried out by an independent expert who is bound to confidentiality. You give us at least 30 days' notice, and the audit must not disrupt other customers. You pay for the audit and for our time spent on it.
10. Transfers outside the EEA
We process personal data inside the European Economic Area. We transfer data outside it only if you instruct us to, or if the law requires it, and then only with a valid transfer basis such as an adequacy decision or standard contractual clauses.
11. Return and deletion
When the services end, we give you your data on request for 30 days. After that, we delete it from our systems. Copies in backups disappear when the backups are rotated, within 60 days. We keep data only where the law requires it.
12. Term and liability
This agreement starts with the services and ends when we stop processing your data. The liability limits in our terms and conditions apply to this agreement. Dutch law applies.