This Data Processing Addendum (“DPA”) supplements the Terms of Service and Privacy Policy when VeyoHost processes personal data on behalf of a customer in connection with the services.
VeyoHost
1111B S Governors Ave STE 23840
Dover, Delaware, USA
support@veyohost.com
1. Roles
- Customer acts as controller (or processor instructing VeyoHost) for personal data stored in hosting accounts, websites, databases, email mailboxes under the account, and support materials the customer submits.
- VeyoHost acts as processor (or sub-processor) for that customer personal data when providing hosting, backups, security tooling, migrations, and support.
For VeyoHost’s own account, billing, and website visitor data, VeyoHost acts as an independent controller as described in the Privacy Policy.
2. Subject matter and duration
VeyoHost processes customer personal data only to provide the services, for the duration of the customer agreement and any short retention period needed for deletion, backup expiry, legal holds, or dispute handling.
3. Nature and purpose of processing
Processing includes hosting, storage, transmission, backup, restore, malware scanning, caching, logging, support access when requested or required for security, and deletion upon termination according to operational schedules.
4. Types of data and data subjects
Depending on what the customer stores or transmits, data may include names, contact details, account credentials hashes, customer records, order data, content of websites and email, IP logs, and other personal data the customer chooses to process through the services.
Data subjects may include the customer’s end users, employees, clients, and website visitors.
VeyoHost does not control the categories of data the customer uploads.
5. Customer responsibilities
The customer warrants that it has a lawful basis to process and instruct VeyoHost to process the personal data, has provided required notices, and will not instruct VeyoHost to process data in violation of law. The customer is responsible for configuring applications securely and for the content it places on the services.
6. VeyoHost obligations
VeyoHost will:
- Process customer personal data only on documented instructions from the customer (including configuration of the services and support requests), unless required by law
- Ensure persons authorized to process the data are bound by confidentiality
- Implement appropriate technical and organizational security measures
- Engage sub-processors under written terms offering material protections no less protective than this DPA, and remain responsible for their performance as required by applicable law
- Assist the customer, where reasonably possible, with data subject requests, DPIAs, and breach notifications related to customer personal data, taking into account the nature of processing
- Delete or return customer personal data after end of services, subject to backup cycles and legal retention
- Make available information reasonably necessary to demonstrate compliance and allow audits as agreed in writing (remote questionnaires preferred; on-site audits limited to what is proportionate)
7. Sub-processors
Customer authorizes VeyoHost to use sub-processors as listed on our Subprocessors page. We will post updates to that list. Continued use of the services after an update constitutes acceptance for existing customers, unless mandatory law requires a different objection process. If you object to a new sub-processor on reasonable data-protection grounds, contact us promptly to discuss alternatives or cancellation options.
8. International transfers
Customer personal data may be processed in the United States and other countries where VeyoHost or its sub-processors operate. Where required, transfers are supported by appropriate safeguards (such as Standard Contractual Clauses or equivalent mechanisms).
9. Security incidents
If VeyoHost becomes aware of a personal data breach affecting customer personal data, we will notify the customer without undue delay and provide information reasonably available to help the customer meet its own notification duties.
10. Order of precedence
If there is a conflict between this DPA and the Terms regarding processing of customer personal data, this DPA controls. A separately signed DPA or enterprise agreement may supersede this page for that customer.
11. Contact
Data protection inquiries: support@veyohost.com
VeyoHost, 1111B S Governors Ave STE 23840, Dover, Delaware, USA