Data Processing Agreement (DPA)

Last updated: 28 September 2026

This Data Processing Agreement (“DPA”) applies where a HostingBuY business customer acts as controller and CirculeForce GmbH processes personal data on the customer’s behalf as processor in connection with the hosting service.

1. Subject matter and duration

HostingBuY processes customer-hosted personal data only to provide, secure, maintain and support the contracted hosting service and for the duration of the relevant service, plus any limited retention required for backups, security, legal obligations or orderly deletion.

2. Customer instructions

HostingBuY processes personal data according to the service contract, documented customer instructions and applicable law. If an instruction appears unlawful or materially incompatible with the service, HostingBuY may request clarification or suspend the affected processing where necessary.

3. Types of data and data subjects

The categories depend on the customer’s use of the service and may include account, contact, website-user, employee, customer, subscriber, log, database, e-mail and other application data uploaded or generated by the customer.

4. Confidentiality

Persons authorized to process customer-hosted personal data are subject to confidentiality obligations or equivalent duties.

5. Security measures

HostingBuY maintains technical and organisational measures appropriate to the service, which may include access controls, authentication protections, encrypted transport, logging, network segmentation, firewalling, malware and abuse controls, vulnerability and patch management, backup mechanisms where contracted, and restricted administrative access.

6. Subprocessors

HostingBuY may use subprocessors such as data-center operators, network providers, security providers and service-platform vendors where necessary to provide the service. HostingBuY remains responsible for imposing appropriate data-protection obligations on subprocessors within the scope required by applicable law.

7. International processing

Customer-selected locations and supporting service providers may involve processing in multiple countries. Where cross-border transfer safeguards are legally required, HostingBuY will use an appropriate mechanism or equivalent protection.

8. Assistance

Taking account of the nature of the service and information available, HostingBuY will provide reasonable assistance for data-subject requests, security incidents and data-protection obligations that relate to processing performed on behalf of the customer. Additional work outside normal service scope may be chargeable where legally permissible.

9. Security incidents

HostingBuY will notify the customer without undue delay after becoming aware of a confirmed personal-data breach affecting customer-hosted data where notification is required by applicable law or the DPA. Notices will contain information reasonably available at the time and may be supplemented as the investigation develops.

10. Return and deletion

At termination, the customer is responsible for exporting required data. HostingBuY will delete or render inaccessible customer data according to the normal service-deletion process, subject to backup cycles, legal retention requirements and security obligations.

11. Audits and information

HostingBuY will make available information reasonably necessary to demonstrate compliance with applicable processor obligations. On-site audits require prior agreement, reasonable scope and protection of other customers, confidential information and infrastructure security.

12. Customer responsibilities

The customer is responsible for the lawfulness of the personal data it uploads or processes, providing required notices, establishing an appropriate legal basis, responding to data subjects as controller and configuring applications and access permissions securely.

13. Relationship with other terms

This DPA supplements the Terms and Conditions of Service. If a signed customer-specific DPA conflicts with this public DPA, the signed agreement controls for that customer to the extent of the conflict.