We act as controller for our own account, billing, support, and security activities as described in the Privacy Policy. Where we process personal data in customer-hosted content on your behalf, you are the controller, or a processor authorised by the controller to appoint us. The following terms apply to that processing, together with any separately agreed data processing agreement:
- Scope and duration: Processing consists of storing, transmitting, retrieving, administering, and deleting content to deliver the ordered hosting or related service for its term and any agreed return or deletion period. You determine the data supplied, which may include identification, contact, account, communications, and application data concerning your users, customers, staff, or other people represented in your content. The order, service configuration, and any further written instructions describe the actual scope. Identify any special requirements, sensitive data, or location restrictions before supplying data that needs them.
- Your responsibilities and instructions: You are responsible for lawful collection, notices, a lawful basis, and authority to give instructions. We process only on documented instructions, including for international transfers, unless applicable UK law requires otherwise. Where law requires different processing, we inform you before it takes place unless that law prohibits notification. We immediately inform you if an instruction appears to infringe applicable data protection law. Instructions may be recorded in the agreement, service configuration, or written support correspondence.
- Confidentiality and security: We ensure authorised people are bound by confidentiality obligations and implement technical and organisational measures appropriate to the risks under Article 32 UK GDPR. You remain responsible for security of systems and applications you control. Security responsibilities and any additional requirements may be documented in the order or a separate processing agreement.
- Sub-processors: Before appointing another processor for your hosted personal data, we identify its role and obtain your prior specific or general written authorisation. Under a general authorisation, we give advance written notice of intended additions or replacements so you can object on reasonable data protection grounds before the change. We impose equivalent relevant data protection obligations in writing and remain responsible to you for the sub-processor's performance of those obligations. A list of payment or login providers in our Privacy Policy is not blanket authorisation for them to receive hosted content.
- Assistance: Taking account of the nature of processing and information available, we assist with data-subject requests, security obligations, breach notifications, impact assessments, and consultation with supervisory authorities. We notify you without undue delay of a personal data breach affecting data processed on your behalf and provide relevant information as it becomes available.
- Return or deletion: At the end of the service, we delete or return hosted personal data at your choice and delete remaining copies, unless applicable law requires retention. Tell us before the service ends if you require return, and arrange export while it remains accessible. In the absence of an instruction to return, our documented default is deletion under Section 15.3. Any necessary retention for our own lawful controller purpose, such as a specific legal claim, must have an independent lawful basis and the safeguards in the Privacy Policy; it is not permission to keep unrelated hosted content.
- Information and audits: We make available the information needed to demonstrate compliance with Article 28 and allow and contribute to audits and inspections by you or your appointed auditor. We may agree reasonable arrangements to protect other customers and system security; those arrangements must not defeat your statutory audit rights.
An expressly agreed data processing agreement governs any conflict about customer data processing, subject always to mandatory law. These terms do not authorise processing beyond your lawful instructions or replace any required international transfer mechanism.
Access, correction, erasure, restriction, objection, portability, and withdrawal of consent apply where their legal conditions are met. The Privacy Policy explains how to use these rights and complain. Contact legal@pdxnet.co.uk. Requests about content for which you are the controller are handled with your assistance and instructions, subject to applicable law.
Tax and accounting records are normally kept for 6 years from the end of the last company financial year they concern, or longer where legally required. Essential contract and account-history records may be kept for up to 6 years after the relationship ends where needed for legal claims. This does not impose a 6-year retention period on every credential, verification document, or hosted file. The category-specific periods and exceptions are in Privacy Policy Section 9.
We do not provide managed backups for VPS or other compute services. Keep your own independent backups. Temporary operational copies used for migrations, node maintenance, or hardware replacement are not a customer backup service and are deleted when the operation is complete, subject to a lawful evidence hold.
At effective termination, access ends and we initiate secure deletion of customer storage and configurations. We securely erase storage or otherwise make the data unrecoverable before reassignment to another customer. Methods and completion times depend on the storage platform; this does not promise immediate physical overwriting of an entire shared device. Retrieve data before termination, or arrange its return under Section 15.1.
Network traffic logs and abuse case records are retained for 6 months; other server and account-access logs are retained only as needed, for up to 12 months. Relevant billing and formal complaint records follow their specific legal requirements, including at least 12 months after closure for regulated communications complaints where required. Relevant evidence may be kept longer for a binding legal requirement, active investigation, or legal claim where necessary and lawful. Such holds are limited, access-controlled, reviewed, and ended when the lawful reason ceases; unrelated data follows the normal deletion process. An evidence hold is not a backup. These rules are read with Privacy Policy Section 9 and AUP Section 3.2.
For data processed on your behalf, we notify you without undue delay after becoming aware of a personal data breach and assist you with your duties. For processing where we are controller, we notify the ICO and affected individuals when required by the applicable risk thresholds and deadlines. Privacy Policy Section 11 explains these distinctions.