At a glance
- HostingDon is registered in Germany. EU/UK customers are covered by GDPR by default — no opt-in required.
- Our standard Data Processing Agreement (DPA) is incorporated into our Terms automatically. Need a signed copy? Email dpa@hostingdon.com.
- You can choose EU-only data residency at signup or in your account dashboard.
- For non-EU transfers (e.g., to our US sub-processors), we use the European Commission's Standard Contractual Clauses (SCCs) with supplementary measures.
- Our Data Protection Officer can be reached at dpo@hostingdon.com.
1. Roles under GDPR
HostingDon plays one of two roles depending on the type of data:
1.1 We are the data controller for:
- Your account, billing, and contact information;
- Communications you send us (support tickets, sales inquiries);
- Server-side logs we collect to operate, secure, and bill the Services.
For this data, our Privacy Policy applies.
1.2 We are a data processor for:
- All Customer Content you upload to or store on the Services — including any personal data of your end users (visitors, registered users, customers) processed through your hosted application.
For this data, you are the controller and we are your processor. Our DPA governs how we process this data on your behalf.
2. Data Processing Agreement (DPA)
HostingDon's standard DPA is incorporated by reference into our Terms of Service. By accepting our Terms, you and HostingDon are bound by it automatically — no signature required, though we'll happily send you a counter-signed PDF if your compliance team needs one.
The standard DPA includes:
- The processor obligations under GDPR Article 28;
- EU Standard Contractual Clauses (Module Two — Controller to Processor) for transfers outside the EEA;
- UK International Data Transfer Addendum, where applicable;
- Technical and organizational measures (TOMs) — encryption, access controls, audit logging, employee training, incident response;
- Audit rights, sub-processor change notifications, and assistance with DPIAs.
To request a counter-signed DPA: email dpa@hostingdon.com with your account ID and registered company name. We respond within 3 business days.
3. Lawful basis for processing
Where we are the controller, we rely on the following lawful bases under Article 6 of the GDPR:
| Processing purpose | Lawful basis |
|---|---|
| Providing the Services you ordered | Contract (Art. 6(1)(b)) |
| Network security, fraud prevention | Legitimate interest (Art. 6(1)(f)) |
| Tax & accounting records | Legal obligation (Art. 6(1)(c)) |
| Marketing emails (where opted in) | Consent (Art. 6(1)(a)) |
| Operating analytics on hostingdon.com | Legitimate interest (Art. 6(1)(f)) — we use cookieless analytics |
4. Your GDPR rights
As a data subject in the EU, UK, or EEA, you have the rights listed in Articles 15–22 of the GDPR:
- Right of access (Art. 15) — receive a copy of your data and information about how it's processed.
- Right to rectification (Art. 16) — correct inaccurate or incomplete data.
- Right to erasure (Art. 17, "right to be forgotten") — request deletion of your data.
- Right to restriction (Art. 18) — limit how we process your data while a dispute is resolved.
- Right to data portability (Art. 20) — receive your data in a structured, commonly used, machine-readable format.
- Right to object (Art. 21) — object to processing based on legitimate interests.
- Rights regarding automated decision-making (Art. 22) — we don't use automated decision-making with legal or significant effects, but you have the right to opt out if we ever do.
To exercise any right: email privacy@hostingdon.com. We respond within 30 days. There is no charge for a reasonable, non-repetitive request.
5. Sub-processors
We use a small set of sub-processors to provide the Services. Each is bound by a written contract with terms at least as protective as our DPA. The current list:
| Sub-processor | Service | Location |
|---|---|---|
| Equinix | EU datacenter colocation | Frankfurt, Amsterdam, London |
| Hivelocity | US datacenter colocation | Tampa, Dallas, NYC |
| Stripe Payments Europe Ltd. | Payment processing (EU customers) | Ireland (EU) |
| Stripe Inc. | Payment processing (non-EU) | USA (SCCs in place) |
| Postmark | Transactional email delivery | USA (SCCs in place) |
| Sentry | Application error monitoring | USA (SCCs in place) |
| Plausible Insights | Cookieless website analytics | Estonia (EU) |
| Cloudflare | DDoS mitigation, edge CDN | Global (SCCs in place) |
We notify customers of sub-processor changes by email at least 30 days before they take effect. You have the right to object to a new sub-processor; if we cannot accommodate your objection, you may terminate the affected Services with a prorated refund.
6. International data transfers
Where we transfer personal data outside the EEA or UK to a country without an adequacy decision (such as the USA), we rely on the European Commission's Standard Contractual Clauses (Module Two) with the supplementary measures we have determined to be appropriate following the Schrems II ruling. These supplementary measures include:
- End-to-end encryption of personal data in transit (TLS 1.3) and at rest (AES-256);
- Access controls limiting transferred data to specific named personnel under confidentiality obligations;
- Transparency reporting on government data requests received and how we responded;
- Contractual commitments to challenge unlawful access requests in the courts of competent jurisdiction.
For UK customers, our DPA includes the UK International Data Transfer Addendum issued by the ICO.
7. EU data residency
Customers can choose to have their hosted infrastructure provisioned exclusively in EU datacenters. When you select an EU region (Frankfurt, Amsterdam, or London) at signup or in your account dashboard:
- Customer Content (your sites, files, databases, and backups) is stored only in EU datacenters;
- Active processing of Customer Content happens only in the EU;
- Account and billing data is stored on EU-based servers managed by our German entity;
- Support staff handling EU accounts are located in the EU during business hours, with limited US/Singapore coverage for 24/7 emergencies (covered by SCCs).
8. Personal data breach notification
If we become aware of a personal data breach affecting Customer Content (where we are processor), we will notify the affected customer-controller without undue delay and within 72 hours of becoming aware, as required by Article 33 GDPR. Notification will include:
- Description of the nature of the breach (categories and approximate number of data subjects and records affected);
- Likely consequences of the breach;
- Measures taken or proposed to address the breach and mitigate effects;
- Contact point for further information.
For breaches affecting personal data we control (account data), we notify both the affected individuals (where required) and the relevant supervisory authority within 72 hours.
9. Data Protection Officer
HostingDon has appointed a Data Protection Officer, as required under Article 37 GDPR for organizations engaged in large-scale processing of personal data. The DPO is independent and reports directly to the board.
Contact: dpo@hostingdon.com
Postal: Data Protection Officer, HostingDon Inc., Friedrichstraße 68, 10117 Berlin, Germany
10. Filing a complaint with a supervisory authority
If you believe HostingDon has violated your rights under GDPR, we ask that you contact our DPO first so we can address the issue. You also have the right to lodge a complaint with your local data protection authority. As HostingDon is established in Germany, our lead supervisory authority is:
Berliner Beauftragte für Datenschutz und Informationsfreiheit
Friedrichstraße 219, 10969 Berlin
datenschutz-berlin.de
For UK residents, the relevant authority is the Information Commissioner's Office (ico.org.uk).
11. Contact
- DPO: dpo@hostingdon.com
- DPA requests: dpa@hostingdon.com
- Subject access requests: privacy@hostingdon.com
- Mail: HostingDon Inc., Attention: Privacy Team, Friedrichstraße 68, 10117 Berlin, Germany