Data Processing Addendum

Last Updated: 31.10.2026

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between you and VirtuaHost Ltd, trading as VirtuaHost, a company registered in England and Wales (company number 17553293), registered office 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ (“VirtuaHost”, “we”, “us”). It meets the requirements of Article 28 of the UK General Data Protection Regulation (UK GDPR).

1. When This DPA Applies

This DPA applies automatically, with no need to sign anything, when you are a business customer and you store or process personal data on a VirtuaHost service (for example your own customers' or users' details held on your VPS). For that data, you are the controller and we are your processor.

It does not cover the personal data we collect about you as our customer (such as your account and billing details). For that data we are the controller, and our Privacy Policy applies.

If this DPA and the Terms of Service conflict on a data protection matter, this DPA takes priority.

2. What We Do With Your Data

Our services are unmanaged infrastructure. We provide the server, storage and network that your data runs on; you decide what data is stored and how it is used. The details of the processing are set out in the Annex below.

We will:

• process your personal data only on your documented instructions, which are these Terms, this DPA and the way you configure and use your service, unless the law requires otherwise (in which case we will tell you first, unless the law forbids it);
• tell you if we believe an instruction breaks data protection law;
• not look at, use, sell or disclose your data for our own purposes;
• only access the contents of your server where you ask us to (for example for console or rescue access, or a backup restore), or where we must investigate a suspected breach of our Acceptable Use Policy or the law, limited to what is necessary.

3. Confidentiality

Everyone at VirtuaHost who can access customer services is bound by a duty of confidentiality and only has the access their role needs.

4. Security

We take appropriate technical and organisational measures to protect the infrastructure your data runs on, as required by Article 32 UK GDPR. These are listed in the Annex.

Because you control your server, you are responsible for securing what runs on it, including its operating system, software, firewall, passwords and keys, and for keeping your own backups.

5. Sub-processors

You give us general permission to use sub-processors, such as the data centre that hosts our servers and the storage provider used for backups. We have written contracts with them that give your data the same level of protection as this DPA, and we remain responsible to you for them.

A current list of our sub-processors is available on request by emailing info@virtuahost.uk. If we add or replace a sub-processor that processes your data, we will email you at least 30 days beforehand. If you object on reasonable data protection grounds and we cannot resolve it, you may cancel the affected service before the change takes effect and receive a pro-rata refund for any unused pre-paid period.

6. International Transfers

Our servers are located in Germany. We will only transfer your personal data outside the UK in line with Chapter V of UK GDPR, using a UK adequacy regulation or, where there is none, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

7. Helping You Meet Your Obligations

Taking into account that our services are unmanaged and we do not see your data, we will give you reasonable help with:

• requests from people exercising their data protection rights (most of which you can handle directly, as you control your server);
• your security obligations, data protection impact assessments and consultations with the ICO.

If someone contacts us directly about data you control, we will pass the request to you and will not respond to it ourselves unless the law requires us to.

8. Personal Data Breaches

If we become aware of a personal data breach affecting the infrastructure your data runs on, we will tell you without undue delay, and where possible within 48 hours, with the information we have about what happened, its likely effects and what we are doing about it. We will keep you updated as we learn more.

9. End of the Service

When a service ends, its server and data are deleted as set out in section 10 of our Terms of Service. Before then, you can copy your data off your server at any time. Backups of a deleted service (if you had the Daily Backup Pack) are deleted within 30 days. We do not keep copies of your data after that, unless the law requires us to.

10. Information and Audits

On request, we will give you the information reasonably needed to show that we meet this DPA. If that information is not enough and an audit is required by law or by the ICO, you may carry one out (or appoint an independent auditor bound by confidentiality) with at least 30 days' notice, during business hours, at your own cost and no more than once a year, unless a breach makes an earlier audit necessary. Audits must not put other customers' data or our security at risk.

11. Liability and Duration

Liability under this DPA is governed by section 11 of our Terms of Service, except where the law does not allow it to be limited. This DPA lasts for as long as we process personal data on your behalf.

Annex: Details of the Processing

• Subject matter: hosting of your virtual private server(s) and any add-ons.
• Duration: while your service is active, then until deletion as described in section 9.
• Nature and purpose: storing data on, running and connecting your server to the internet, and taking backups if you have the Daily Backup Pack.
• Types of personal data and data subjects: decided by you. We do not know what personal data you store or about whom.
• Security measures:
  • Each server is a separate KVM virtual machine, isolated from other customers' servers
  • Servers in a professional data centre with physical access controls
  • Firewalls and network-level DDoS filtering on our infrastructure
  • Staff access limited to those who need it, with key-only SSH logins, two-factor authentication on our admin panel and IP-restricted access to our server management panel
  • Regular security updates on our infrastructure
  • Backups (Daily Backup Pack) encrypted and stored on separate storage
  • Encrypted connections (HTTPS) to our website and control panel
  • Monitoring for abuse and unusual network activity

Contact

For questions about this DPA, or to request our list of sub-processors, contact:
info@virtuahost.uk
VirtuaHost Ltd (company number 17553293)
71-75 Shelton Street, Covent Garden, London, WC2H 9JQ
United Kingdom