Data Processing Agreement

1. Introduction

This Data Processing Agreement (“DPA”) forms part of and is incorporated into the Terms of Service between lbreeze Limited (“Processor”) and the customer (“Controller”). It is effective upon the creation of a customer account with lbreeze Limited.

This DPA sets out the terms under which lbreeze Limited processes personal data on behalf of its customers in connection with the provision of web hosting and related services. It is intended to satisfy the requirements of Article 28 of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

In the event of any conflict between this DPA and the Terms of Service, this DPA shall take precedence in matters relating to the processing of personal data.

2. Definitions

The following definitions apply throughout this DPA, consistent with the UK GDPR Article 4:

• “Controller” means the natural or legal person who determines the purposes and means of processing personal data — in this context, the customer.
• “Processor” means the natural or legal person who processes personal data on behalf of the Controller — in this context, lbreeze Limited.
• “Personal Data” means any information relating to an identified or identifiable natural person (“data subject”).
• “Processing” means any operation performed on personal data, including storage, retrieval, use, disclosure, or erasure.
• “Data Subject” means the individual to whom the personal data relates.
• “Sub-processor” means any third party appointed by the Processor to carry out processing activities on behalf of the Controller.

3. Roles of the Parties

As the Data Controller, you are responsible for ensuring that you have a lawful basis for processing personal data and that your own privacy notices accurately describe how data is processed on your infrastructure.

4. What Data We Process as Processor

In our capacity as Data Processor, lbreeze Limited may process the following categories of personal data on your behalf, depending on the nature of your hosted services:

• Any personal data contained within files, databases, or content stored on your hosting account
• Email content, headers, and metadata stored or transmitted through our email hosting services
• Application data stored in databases managed via your hosting account
• Server access and error logs generated by visitor activity on your hosted websites

We do not access, read, or use your hosted data for any purpose other than providing the contracted services, except where required by law or in response to a lawful authority request.

5. Purpose & Legal Basis

We process personal data as Processor solely for the purpose of providing the hosting services you have contracted with us. The legal basis for our processing is the performance of a contract between you (the Controller) and lbreeze Limited (the Processor), as documented in the Terms of Service.

We will not process personal data for our own independent purposes, sell it to third parties, or use it for marketing or profiling without your explicit written instruction.

6. Data Subject Rights Assistance

Where a data subject makes a request to exercise their rights under the UK GDPR (such as access, erasure, or portability) in relation to data hosted on our infrastructure, we will assist you as Controller in fulfilling that request.

• We will notify you of any data subject requests we receive that appear to relate to your hosted data within 72 hours of receipt
• We will provide reasonable technical assistance to help you respond to data subject requests, such as facilitating data exports or deletions
• We will not respond to data subject requests directly on your behalf without your written instruction

7. Security Measures

lbreeze Limited implements appropriate technical and organisational measures to protect personal data processed on our infrastructure against accidental loss, unauthorised disclosure, alteration, or destruction. These measures include:

• Encrypted storage for hosting account data and backups
• Strict access controls limiting staff access to customer data on a need-to-know basis
• Regular security audits and vulnerability assessments of our infrastructure
• DDoS mitigation and network intrusion detection systems
• Security practices aligned with ISO 27001 principles
• Regular automated backups with secure off-site retention

8. Sub-processors

We may engage sub-processors to assist in delivering our hosting services. By entering into this DPA, you provide general authorisation for the engagement of sub-processors, subject to the conditions below.

Our primary sub-processor for hosting infrastructure is:

• Enhance (enhance.com) — next-generation server management and control panel platform operating under its own data processing terms

We will inform you of any intended changes to our sub-processor arrangements (additions or replacements) with reasonable notice, giving you the opportunity to object. All sub-processors are contractually bound to equivalent data protection standards as set out in this DPA. A full list of sub-processors is available on request at hello@lbreeze.com.

9. Data Retention & Deletion

We will retain your hosted data for the duration of your service agreement. Upon termination or cancellation of your account:

• Your hosting account and all associated data will remain accessible for a 30-day grace period to allow you to retrieve your data
• After the grace period, all data will be securely and permanently deleted from our active systems
• Backup copies may persist for up to an additional 30 days before being overwritten or deleted in line with our backup rotation schedule

We recommend you take regular backups of your data independently of our platform backup service.

10. Data Breach Notification

In the event that lbreeze Limited becomes aware of a personal data breach affecting data we process on your behalf, we will:

• Notify you without undue delay and in any event within 72 hours of becoming aware of the breach
• Provide all available information about the nature of the breach, the categories and approximate number of data subjects affected, and the likely consequences
• Cooperate fully with any investigation and take all reasonable steps to mitigate the impact of the breach

As the Data Controller, you remain responsible for notifying the ICO and affected data subjects where required by the UK GDPR.

11. Customer Obligations

As the Data Controller, you agree to:

• Ensure you have a valid lawful basis for all personal data processed on our infrastructure
• Maintain accurate and up-to-date records of your processing activities as required by UK GDPR Article 30
• Respond directly to data subjects exercising their rights in relation to your hosted data
• Keep your own privacy notices and cookie policies accurate and up to date
• Comply with all applicable data protection laws in your jurisdiction
• Not instruct us to process personal data in a manner that would violate applicable law

12. Governing Law

This DPA is governed by and shall be construed in accordance with the laws of England and Wales, and the parties submit to the exclusive jurisdiction of the courts of England and Wales for the resolution of any disputes arising under this DPA.

13. Contact

For any queries relating to this Data Processing Agreement or our data protection practices, please contact us: