Data Processing Addendum

1. Roles of the parties

For personal data your end users provide to services you operate on our infrastructure, you are the controller and SineBoot is the processor. SineBoot processes such personal data only on your documented instructions, including as set out in this DPA and the Terms of Service, unless required otherwise by law.

2. Details of processing

• Subject matter — provision of hosting, domain and related services.
• Duration — for the term of your account and any legally required retention period.
• Nature and purpose — storage, hosting, transmission and backup as necessary to deliver the Services.
• Types of data — as determined by you; typically account, contact and usage data of your end users.
• Categories of data subjects — your customers, users and contacts.

3. Processor obligations

• Process personal data only on your documented instructions.
• Ensure personnel authorised to process the data are bound by confidentiality.
• Implement appropriate technical and organisational security measures (section 5).
• Assist you, where reasonably possible, with data-subject requests and your obligations under Articles 32–36 of the GDPR.

4. Sub-processors

You provide general authorisation for SineBoot to engage sub-processors to support the Services. We impose data-protection obligations on each sub-processor that are no less protective than those in this DPA, and we remain responsible for their performance. We engage sub-processors in the following categories:

• Cloud and dedicated-server infrastructure providers (to provision and run your services);
• Hosting control-panel providers;
• Domain registrars (to register and manage domains);
• DNS, CDN and DDoS-protection providers;
• Payment gateways (to process payments);
• Transactional email-delivery providers (to send account, billing and support email); and
• Currency exchange-rate data providers.

The list of the specific named sub-processors within these categories is available on request, and we will give reasonable notice of intended changes so you may object on legitimate grounds.

5. Security measures

SineBoot maintains technical and organisational measures appropriate to the risk, including encryption in transit and at rest, access controls and least-privilege, network protection and DDoS mitigation, secrets management, activity logging and regular backups. These measures are described in more detail in our Security overview.

6. Data-subject requests

Taking into account the nature of the processing, SineBoot will assist you by appropriate technical and organisational measures, insofar as possible, to respond to requests from data subjects to exercise their GDPR rights. If we receive such a request directly relating to your data, we will refer the data subject to you unless legally required to act.

7. Personal data breach

SineBoot will notify you without undue delay after becoming aware of a personal data breach affecting your data, and will provide the information reasonably available to help you meet your own notification obligations to authorities and data subjects.

8. International transfers

Where processing involves transferring personal data outside the EEA or the UK, the parties rely on the Standard Contractual Clauses (and the UK International Data Transfer Addendum) together with supplementary safeguards. Those clauses are incorporated into this DPA by reference and prevail in the event of conflict on transfer matters.

9. Audit

SineBoot will make available information reasonably necessary to demonstrate compliance with this DPA and, on reasonable prior notice and subject to confidentiality, allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate, no more than once per year unless required by a supervisory authority.

10. Return and deletion

On termination of the Services, and at your choice, SineBoot will delete or return your personal data and delete existing copies, unless retention is required by law. Standard account deletion is available from your control panel.

11. Requesting a signed copy

If your organisation requires a countersigned DPA, contact us using the details below and we will arrange one.