Data Processing Agreement
Last updated: October 28, 2026
The short version: if you are a business and the files, databases or software on your services hold personal data about other people, you decide what happens to that data and we only store and run it for you. We keep it secure, use it for nothing else, tell you quickly if something goes wrong, delete it when your service ends, and protect it while it is held in the United States. This agreement applies automatically: there is nothing to sign.
1. When this agreement applies
This Data Processing Agreement ("DPA") is part of our Terms of Service (the "Terms") between Erupted Hosting LLC ("we", "us") and a customer who uses our Services for a business, trade or profession ("you"). It applies when Your Content, as defined in section 7 of the Terms, includes personal data protected by the EU General Data Protection Regulation ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, or a US state privacy law (together, "Data Protection Laws"). You accept it by accepting the Terms. Words such as "controller", "processor", "personal data", "processing" and "personal data breach" have the meanings given in the GDPR.
This DPA covers personal data that is part of Your Content. Personal data we collect about you as our customer, such as your account and billing details, is covered by our Privacy Policy instead, and for that data we are the controller.
2. Who does what
For personal data in Your Content, you are the controller (or a processor acting for your own client), and we are your processor (or subprocessor). You decide what personal data you put on your Services, why, and for how long. You are responsible for having a lawful basis for it, for giving people any notices the law requires, and for the security of everything you control yourself, such as your server's operating system, software, passwords, keys and updates.
3. Details of the processing
- Subject matter: hosting Your Content on the Services you order: virtual private servers, game servers, Discord bot hosting and image hosting.
- Duration: for as long as you have the Service, and until its data is deleted as described in section 10.
- Nature and purpose: storing, running and transmitting Your Content, keeping backups where your plan includes them, and supporting and securing the Services. We do not look at, analyze or use Your Content for any other purpose.
- Types of personal data and data subjects: whatever you choose to put on your Services, for example data about your own customers, users, players, employees or website visitors.
- Sensitive data: the Services are not designed for special categories of personal data, criminal records data, health information or payment card data. If you store any, you are responsible for any extra protection the law requires.
4. Our obligations
We will:
- process personal data in Your Content only on your documented instructions. Those are the Terms, this DPA, and what you do with the Services yourself, for example uploading, changing or deleting data. We do otherwise only where the law requires us to, and then we tell you first unless the law forbids that. If we think an instruction breaks Data Protection Laws, we tell you;
- make sure everyone we allow to process it is bound to keep it confidential;
- keep the security measures in section 6;
- use subprocessors only as section 5 describes; and
- never sell it, use it for advertising, or combine it with other data for our own purposes.
5. Subprocessors
You give us general authorization to use subprocessors. We bind each one to data protection terms that protect Your Content at least as well as this DPA, and we remain responsible to you for what they do. The subprocessors that may process Your Content today are:
| Subprocessor | What it does | Where |
|---|---|---|
| OVH US LLC (OVHcloud) | Owns and runs the data center, hardware and network our servers run on. | United States (the location you choose at checkout) |
We will tell you about a new subprocessor at least 30 days before it starts processing Your Content, by updating this page and emailing the billing email on your account. If you object on reasonable data protection grounds, tell us within those 30 days. We will try to resolve it, and if we can't, you may cancel the affected Services and we will refund the part of the month you have not used.
6. Security measures
We protect the Services with technical and organizational measures suited to the risk, including:
- each virtual private server runs in its own virtual machine, and each bot or game server in its own container with restricted privileges, so one customer cannot reach another's data;
- firewalls stop customer services from reaching our private networks and management systems;
- encrypted connections (HTTPS) to our website, our Portal and the management interfaces of our servers;
- access to our systems limited by role to the staff who need it, with two-factor login required for every staff account and a log of sensitive staff actions;
- security updates installed automatically on the servers we manage;
- monitoring of our servers, with alerts to our team when one stops answering; and
- physical security of the data centers, provided by OVHcloud.
We review these measures regularly and may change them, but never in a way that lowers the overall protection of Your Content.
7. Personal data breaches
If we become aware of a personal data breach affecting Your Content, we will tell you without undue delay, and no later than 48 hours after we become aware of it, by email to the billing email on your account. We will tell you what we know: what happened, the data and people likely to be affected, the likely consequences, and what we are doing about it. We will add details as we learn them, and take reasonable steps to contain the breach and limit the harm. Telling you about a breach is not an admission of fault.
8. Helping you meet your obligations
You can handle most requests from the people whose data you hold, such as access, correction or deletion requests, yourself, because you control Your Content. Where you can't, we will give you reasonable help. If such a request reaches us directly, we will pass it to you and not answer it ourselves unless you ask us to. We will also give you the information you reasonably need for a data protection impact assessment, or for a consultation with a supervisory authority, about the Services.
9. International transfers
Our servers are in the United States, so personal data in Your Content is held there. Where the GDPR applies to a transfer to us, the Standard Contractual Clauses adopted by the European Commission in Implementing Decision (EU) 2021/914 (the "SCCs") are part of this DPA, with you as data exporter and us as data importer, as follows:
- Module Two (controller to processor) applies where you are a controller, and Module Three (processor to processor) where you are a processor;
- Clause 7 (docking clause) does not apply;
- in Clause 9, Option 2 (general written authorization) applies, with the 30 days' notice in section 5 of this DPA;
- the optional wording in Clause 11 does not apply;
- in Clause 13, the competent supervisory authority is the one the SCCs' rules point to for you;
- in Clauses 17 and 18, the SCCs are governed by the law of Ireland and disputes go to the courts of Ireland; and
- Annexes I and II are completed by sections 1, 3, 5 and 6 of this DPA.
Where the UK GDPR applies, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner (version B1.0) is part of this DPA, completed with the information above, and either party may end it as its Section 19 allows. Where the Swiss Federal Act on Data Protection applies, the SCCs apply with references to the GDPR read as references to that Act, and the Swiss Federal Data Protection and Information Commissioner as the competent authority. If the SCCs conflict with the rest of this DPA, the SCCs win.
10. Deletion at the end of a service
When a Service is canceled or terminated, its data is deleted as described in the Terms, and any copies in backups are removed within 30 days after that. We keep no copy unless the law requires it. Deletion is automatic and final, so please download anything you want to keep before your Service ends.
11. Information and audits
On request we will give you the information reasonably needed to show that we meet this DPA, such as a description of our security measures and a list of our subprocessors. If that is not enough, or a supervisory authority requires it, you or an independent auditor bound by confidentiality may audit our compliance once a year, on at least 30 days' written notice, during business hours and without disrupting our services or other customers, at your cost. The audit does not extend to our subprocessors' own facilities. For those, we will share the reports or certifications they provide where we can.
12. US state privacy laws
Where a US state privacy law, such as the California Consumer Privacy Act, applies to personal data in Your Content, we act as your "service provider" or "processor" and will: process it only for the business purpose of providing the Services; not sell or share it, or use it for cross-context behavioral advertising; not keep, use or disclose it outside our direct business relationship with you, or combine it with other personal data except as that law allows; give it the protection that law requires, and tell you if we can no longer do so; and let you take reasonable steps to stop unauthorized use of it.
13. Liability, precedence and changes
Each party's liability under this DPA is subject to the limits in the Terms, except where Data Protection Laws or the SCCs do not allow that. If this DPA conflicts with the Terms on the processing of personal data, this DPA wins. We may update this DPA to reflect changes in the law or in our Services. We will give you at least 30 days' notice of a material change, and no change will lower the protection of Your Content unless the law requires it.
14. Contact
Send questions about this DPA, or a notice under it, to [email protected], or by post to Erupted Hosting LLC, 6545 Market Ave. North, Ste 100, Canton, OH 44721, United States. If you need a countersigned copy of this DPA for your records, ask us and we will send one.