Data Processing Agreement

AOIT Networks Ltd, trading as AOIT Cloud Hosting. Version 1.0, last updated 26 August 2026.

1. Introduction and definitions

1.1. Purpose. This Data Processing Agreement (“DPA”) forms part of the Terms and Conditions between the Customer and AOIT Networks Ltd, trading as AOIT Cloud Hosting (“AOIT”, “we”, “us”) (together, the “Agreement”), and sets out the terms on which AOIT processes personal data on behalf of the Customer in connection with the provision of web hosting, email, domain, VPS, managed cloud server and related services (the “Services”). It applies wherever the Customer stores or processes personal data using the Services and AOIT processes that data on the Customer’s behalf.

1.2. Definitions. In this DPA: “Data Protection Laws” means all applicable laws relating to the processing of personal data, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003, as amended or replaced from time to time; “Personal Data” means any personal data processed by AOIT on behalf of the Customer in connection with the Services; “Data Subject” means the individual to whom Personal Data relates, including the Customer’s employees, customers, website visitors and mailbox users; “Processing” has the meaning given in the UK GDPR; “Subprocessor” means any third party appointed by AOIT to process Personal Data on the Customer’s behalf in connection with the Services; “Security Incident” means any accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data.

1.3. Interpretation. Headings are for convenience only. If there is any conflict between this DPA and the Agreement, this DPA prevails with respect to the processing of Personal Data.

2. Scope and nature of processing

2.1. Roles. The Customer is the data controller (or, where the Customer is itself a processor for its own clients, a processor, in which case AOIT acts as its subprocessor) of Personal Data hosted on the Services. AOIT acts as a data processor on the Customer’s behalf and shall process Personal Data only on the Customer’s documented instructions, except where required to do so by applicable law, in which case AOIT shall inform the Customer of that legal requirement before processing unless prohibited by law from doing so.

2.2. Nature and purpose of processing. AOIT processes Personal Data for the purpose of providing the Services, including: storing website files, databases and mailboxes; transmitting data over networks, including caching content at content delivery network edge locations; taking and retaining automated backups; scanning for malware and other security threats; inspecting content submitted for migration onto the platform (limited to compliance and platform-safety checks); inspecting content where AOIT reasonably believes the Acceptable Use Policy or applicable law is being breached; accessing systems and data to deliver technical support, troubleshooting and incident response at the Customer’s request; and generating and retaining system, access and security logs.

2.3. Types of Personal Data. The Customer controls what data it stores on the Services. Personal Data may therefore include any category of personal data the Customer chooses to host, including identity and contact data, communications data (mailbox contents), technical data (visitor IP addresses and logs generated by the Customer’s own websites), transaction data, and any other personal data contained in the Customer’s websites, databases, mailboxes and backups. AOIT does not intentionally collect special category data; such data may be present incidentally within hosted content, and AOIT processes it solely as a processor and does not access, use or analyse it beyond service delivery.

2.4. Categories of Data Subjects. The Customer’s employees, workers and contractors; the Customer’s own customers, clients and users; visitors to the Customer’s websites; users of mailboxes on the Customer’s account; and any other individuals whose personal data is present within content hosted on the Services.

2.5. Duration. Personal Data is processed for the duration of the Agreement and thereafter only as necessary to fulfil AOIT’s obligations under this DPA, including deletion as set out in Section 10.

3. Customer’s instructions

3.1. The Customer’s instructions are set out in this DPA and the Agreement (including the configuration choices the Customer makes through the Services, such as server location, backup settings and retention choices), and may be supplemented by further documented instructions in writing.

3.2. AOIT shall inform the Customer immediately if, in AOIT’s opinion, an instruction infringes Data Protection Laws or if AOIT cannot comply with an instruction.

3.3. Where AOIT is required by law to process Personal Data beyond the Customer’s instructions, AOIT shall inform the Customer of that legal requirement before processing, unless prohibited by law on important grounds of public interest.

4. Security obligations

4.1. AOIT shall implement and maintain appropriate technical and organisational measures to protect Personal Data against Security Incidents and to ensure a level of security appropriate to the risk, including as appropriate: encryption of data in transit (TLS) and at rest where technically feasible; free SSL/TLS certificates for hosted websites; measures to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems, including redundant, load-balanced infrastructure designed to avoid single points of failure; the ability to restore availability and access to Personal Data in a timely manner, including automated daily backups with off-site storage; a web application firewall, DDoS protection, daily malware scanning and brute-force login protection operating at platform level; multi-factor authentication, role-based access controls and the principle of least privilege for AOIT personnel access; logging and monitoring of access; periodic review of the effectiveness of security measures; physical and environmental controls at the data centres used to provide the Services (our primary UK data centres are certified to ISO 27001, are PCI DSS compliant, and are staffed 24/7 with controlled access and CCTV); and regular security patching of platform systems.

4.2. AOIT shall maintain documentation of its security measures and make it available to the Customer on reasonable request, including through security questionnaires, certifications or audit summaries as appropriate.

4.3. AOIT Networks Ltd holds Cyber Essentials certification. The primary UK data centres used to provide the Services hold ISO 27001 certification. Current certification status is available on request.

4.4. AOIT shall ensure that all personnel with access to Personal Data are subject to appropriate confidentiality obligations and receive adequate data protection and information security training.

5. Subprocessing

5.1. The Customer provides general authorisation for AOIT to engage Subprocessors, subject to this Section 5. AOIT’s Subprocessors include the infrastructure and platform providers on which the Services run, domain registrars, and payment and billing providers.

5.2. AOIT’s current Subprocessors are listed in its subprocessor information document, available on the AOIT Cloud Hosting legal page or on request.

5.3. AOIT shall give the Customer at least 30 days’ prior written notice of the addition or replacement of any Subprocessor (or, where a change is imposed on AOIT by a supplier at shorter notice, as much notice as reasonably possible), by email and by updating the subprocessor list. The Customer may object on reasonable data protection grounds within 14 days of notice; the parties will then work together in good faith to address the concern, and if it cannot be resolved the Customer may terminate the affected Services on 30 days’ written notice without penalty.

5.4. AOIT shall appoint each Subprocessor under a written contract imposing data protection obligations substantially equivalent to those in this DPA, and remains fully liable to the Customer for each Subprocessor’s performance.

5.5. Subprocessors are granted access to Personal Data only to the extent necessary for their function.

6. Data Subject rights

6.1. Taking into account the nature of the processing, AOIT shall provide reasonable assistance to enable the Customer to respond to Data Subject requests under Data Protection Laws (access, rectification, erasure, restriction, portability, objection, and rights relating to automated decision-making). In practice, the Customer can service most requests directly, because the Customer has full control of its hosted content through the Services.

6.2. If AOIT receives a request directly from a Data Subject relating to Personal Data it processes for the Customer, AOIT shall promptly forward it to the Customer without responding, unless otherwise instructed or required by law.

6.3. AOIT shall provide assistance within 10 working days of a Customer request, or such other reasonable timeframe as the Customer specifies given the nature and complexity of the request.

7. Security Incidents and breach notification

7.1. AOIT shall notify the Customer without undue delay, and in any event within 72 hours, after becoming aware of a Security Incident affecting Personal Data processed under this DPA.

7.2. The notification shall include, so far as known: the nature of the incident, including where possible the categories and approximate number of Data Subjects and records concerned; a contact point; the likely consequences; and the measures taken or proposed to address the incident and mitigate its effects.

7.3. AOIT shall cooperate with the Customer and provide reasonable further information and assistance to enable the Customer to meet its own notification obligations, shall promptly investigate and remediate the incident, and shall keep the Customer updated at reasonable intervals. Notification is not an acknowledgement of fault or liability.

8. Impact assessments and consultations

8.1. AOIT shall provide reasonable cooperation and assistance, taking into account the nature of the processing and the information available to it, where the Customer is required to conduct a data protection impact assessment or to consult a supervisory authority.

9. Audit rights

9.1. The Customer may, on at least 30 days’ written notice and no more than once per calendar year (except following a Security Incident affecting the Customer’s data, a material breach of this DPA, a supervisory authority requirement, or a material change to processing), audit AOIT’s compliance with this DPA. Audits must be conducted during normal business hours, must not unreasonably interfere with AOIT’s operations or compromise the security or confidentiality of other customers, and auditors must be bound by confidentiality. Audit rights extend to AOIT’s own premises, records and systems; for infrastructure operated by Subprocessors, AOIT shall instead make available the Subprocessor’s certifications, audit reports and attestations, and shall exercise its own audit rights against the Subprocessor on the Customer’s reasonable request.

9.2. In place of an audit, the Customer may accept alternative evidence of compliance, including completed security questionnaires, third-party certifications and attestations, and documentation of AOIT’s policies and controls; AOIT may require the Customer to review such evidence before an on-site audit.

9.3. Each party bears its own audit costs, unless the audit reveals a material breach by AOIT, in which case AOIT shall reimburse the Customer’s reasonable audit costs. The Customer shall share audit findings with AOIT and allow a reasonable opportunity to remediate.

10. Data return and deletion

10.1. At the Customer’s choice, the Customer may have Personal Data returned by exporting it through the Services at any time before termination (including file access, database export and mailbox access), and AOIT shall provide reasonable assistance with export on request. Unless the Customer instructs otherwise before the deletion date, upon termination or expiry of the Services hosted data (websites, databases and mailboxes) is permanently deleted as described in the Agreement.

10.2. Backup copies are deleted in the normal course of the backup retention cycle applicable to the service.

10.3. Notwithstanding the above, AOIT may retain Personal Data to the extent required by applicable law, including financial and transaction records required for tax and accounting purposes (retained for 6 years), business contact information required for legal, billing or dispute resolution purposes, and logs required for legal compliance, audit or security purposes.

10.4. On written request, AOIT shall confirm in writing that Personal Data has been deleted in accordance with this Section 10, and shall confirm that deletion by Subprocessors occurs in accordance with their retention cycles, providing such supporting information as AOIT can reasonably obtain.

11. International transfers

11.1. For shared hosting Services, Personal Data is stored in data centres in the United Kingdom. For VPS Services, the Customer chooses the data centre location (currently the United Kingdom or the United States). For managed cloud server Services, the Customer chooses from the available global locations or regions at order time; the chosen location constitutes the Customer’s documented instruction as to where its data is stored.

11.2. The content delivery network caches public website content at edge locations worldwide to serve the Customer’s visitors; this is inherent to the CDN feature and constitutes the Customer’s instruction where the CDN is enabled.

11.3. Where AOIT (or a Subprocessor) transfers Personal Data outside the United Kingdom other than at the Customer’s instruction under 11.1 or 11.2, AOIT shall ensure appropriate safeguards are in place in accordance with Data Protection Laws, using one or more of: transfer to a country covered by UK adequacy regulations; the UK International Data Transfer Agreement or Addendum (or equivalent standard contractual clauses); or another lawful transfer mechanism. Information about international transfers is available on request.

12. General

12.1. Each party shall keep confidential all confidential information obtained from the other in connection with this DPA, except as required by law or with prior written consent.

12.2. The parties’ liability under this DPA is subject to the limitations and exclusions in the Agreement. Nothing in this DPA limits either party’s liability for fraud, or any liability which cannot lawfully be limited.

12.3. This DPA, together with the Agreement, is the entire agreement between the parties on the processing of Personal Data. It may be amended only in writing, except that AOIT may amend it as necessary to comply with changes in Data Protection Laws, provided the amendment does not materially reduce the Customer’s rights or increase its obligations. Material changes will be notified by email at least 30 days before taking effect; if the Customer does not agree, it may terminate the affected Services in accordance with the Agreement.

12.4. If any provision of this DPA is invalid or unenforceable, the remainder continues in force. No failure or delay in exercising any right is a waiver of it.

12.5. This DPA is governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction over disputes arising from it.

12.6. Provisions which by their nature should survive termination survive, including Sections 4, 7, 9, 10 and 12.

13. Acceptance

13.1. This DPA is incorporated into and forms part of the Terms and Conditions. By accepting the Terms and Conditions, the Customer agrees to this DPA, effective from the date AOIT first processes Personal Data on the Customer’s behalf.

---

Annex A: Details of processing activities

As required by Article 28(3) UK GDPR.

A.1 Subject matter: the provision of web hosting, email, domain, VPS and managed cloud server services.

A.2 Duration: the duration of the Agreement, plus the deletion period in Section 10.

A.3 Nature and purpose of processing:

A.4 Types of Personal Data: any personal data the Customer stores on the Services (see Section 2.3), including incidental special category data within hosted content.

A.5 Categories of Data Subjects: see Section 2.4.

A.6 Frequency: continuous for the duration of the Agreement; platform monitoring and security systems operate 24/7; backups run on the applicable schedule.

A.7 Transfers: see Section 11. Location is determined by the Customer’s product and region choices; CDN caching is worldwide where enabled.

A.8 Technical and organisational measures: as set out in Section 4.1, maintained and updated in line with industry practice.