Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between you ("Customer", "Controller") and HostLuma ("Processor") wherever HostLuma processes personal data on your behalf as part of providing hosting services. It applies automatically — you don't need to countersign it separately for it to take effect, though we're happy to execute a signed copy on request for your own compliance records.

1. Roles

When you host a website, application, or database with HostLuma, you determine what personal data it holds and why (for example, your WordPress site's own visitor comments, customer records, or user accounts). You are the Controller of that data. HostLuma is the Processor.

This is distinct from data HostLuma collects about you as our customer (your Portal account, billing details), which is covered by our Privacy Policy instead, where HostLuma is the controller.

2. Subject matter, duration, and nature of processing

• Subject matter: provision of hosting infrastructure (storage, compute, database, backup, and content delivery) for Customer's website(s) and/or application(s).
• Duration: for as long as the Customer maintains an active HostLuma account, plus any period data is retained under Section 8 (Suspension and retention) or Section 9 (Deletion).
• Nature of processing: storage, hosting, backup, transmission, and content delivery of the data Customer's site or app holds. HostLuma does not read, analyse, or use the content of Customer's data for any purpose other than providing and securing the hosting service.
• Purpose: solely to deliver the hosting services described in the Terms of Service.

3. Categories of data and data subjects

The categories of personal data and data subjects are determined entirely by Customer's own use of the service — HostLuma has no visibility into what a Customer chooses to store. Typically, this may include Customer's own end users, site visitors, or customers, and data such as names, email addresses, and any other information Customer's site or app is configured to collect.

4. Processor obligations

HostLuma will:

• Process personal data only on Customer's documented instructions (which, for a standard hosting arrangement, are the instructions inherent in operating the service Customer has configured), unless required to do otherwise by UK law
• Ensure personnel with access to infrastructure are bound by confidentiality obligations
• Implement appropriate technical and organisational security measures (see Section 6)
• Not engage a sub-processor without authorisation as described in Section 7
• Assist Customer, insofar as reasonably possible given the nature of the service, in responding to data subject requests (access, deletion, etc.) received about data stored on HostLuma infrastructure — though in practice, most such requests should be directed to Customer first, as Customer controls the application layer and HostLuma does not
• Notify Customer without undue delay after becoming aware of a personal data breach affecting Customer's data, with the information reasonably available to enable Customer to meet its own breach-notification obligations
• Make available information reasonably necessary to demonstrate compliance with this DPA, and allow for audits as described in Section 10
• Delete or return personal data at the end of the service relationship, as described in Section 9

5. Customer obligations

Customer is responsible for:

• Having a lawful basis for the personal data it processes using HostLuma's services
• The security configuration of its own application layer (e.g. WordPress plugin choices, application code, access controls within the site/app)
• Providing any privacy notices and obtaining any consents required from its own end users
• Responding to data subject requests concerning its own site/app, using the tools HostLuma provides (e.g. database and file access) where HostLuma assistance under Section 4 isn't sufficient on its own

6. Security measures

HostLuma applies the following measures across its hosting infrastructure:

• Per-account isolation (CageFS) so one hosting account cannot access another's files or running processes
• Continuous server-level malware and intrusion detection (Imunify360)
• TLS encryption for data in transit, with certificates issued and automatically renewed via AutoSSL
• Automated backups (JetBackup), stored on HostLuma's own infrastructure, not with an external third party
• No storage of Portal account passwords — sign-in uses one-time email links, removing password-database compromise as a risk vector for account access
• Operational and security logs retained for 14 days on a rolling basis to support incident investigation

7. Sub-processors

Customer provides general authorisation for HostLuma to engage the sub-processors listed in our Subprocessor List, which is kept current and forms part of this DPA by reference. HostLuma will give reasonable advance notice of any new sub-processor via that page (reflected in its "last updated" date) or by direct notice to active customers on request. If Customer reasonably objects to a new sub-processor on data-protection grounds, the parties will work in good faith to resolve the objection; if it can't be resolved, Customer may terminate the affected service.

HostLuma remains liable for the acts and omissions of its sub-processors to the same extent it would be liable if performing their services directly.

8. International transfers

Where a sub-processor is located outside the UK, HostLuma relies on the UK's adequacy regulations, Standard Contractual Clauses, or the UK International Data Transfer Addendum, as applicable to that transfer.

9. Suspension and retention

Consistent with our Terms of Service, suspending an account (for non-payment or a policy breach) does not trigger deletion of Customer's data. Data remains stored, inaccessible to the public but not destroyed, until the account is either restored or formally closed.

10. Deletion or return of data

On termination of the service, or on Customer's written request, HostLuma will delete Customer's personal data from active systems within a reasonable period, and it will subsequently age out of the backup cycle in the ordinary course as older backups are rotated out. Customer may request an export of its data prior to closure. HostLuma may retain data beyond this where required by UK law (for example, billing records retained for tax purposes, which are HostLuma's own controller data under the Privacy Policy, not Customer's end-user data under this DPA).

11. Audits

HostLuma will provide Customer with information reasonably necessary to demonstrate compliance with this DPA on request. Given the shared-infrastructure nature of the service, on-site audits are not offered as standard; where a regulator or Customer's own compliance obligations genuinely require one, the parties will agree reasonable scope, notice, and cost allocation in good faith.

12. Liability

Liability under this DPA is subject to the limitations set out in Section 8 of the Terms of Service, except that nothing in this DPA limits either party's liability for a breach of UK GDPR that cannot lawfully be limited.

See also: Privacy PolicySubprocessor ListTerms of Service