Legal & policies
Data Processing Agreement (DPA)
These terms refer to FIRST SERVER. The legal entity, registered address and contact details are published in our Legal Notice. You can contact us through the Contact Us page.
1. Parties, roles and application
This DPA is intended to be incorporated into an accepted service agreement where the customer acts as controller (or an authorised processor) and FIRST SERVER processes personal data on its behalf. Publication alone does not execute a processing agreement. Before processing starts, the parties must record the service-specific information in section 11 and agree the applicable security and subprocessor arrangements. If the customer is a processor, it confirms authority from its controller to appoint FIRST SERVER.
2. Documented instructions
Processing is limited to providing and securing the contracted infrastructure and carrying out documented lawful instructions, including instructions about transfers. The agreement, completed processing schedule and authorised service requests form those instructions. If law requires other processing, FIRST SERVER will inform the customer beforehand unless prohibited. FIRST SERVER will inform the customer immediately if it considers an instruction to infringe GDPR or other applicable EU or Member State data-protection law.
3. Confidentiality and security
Authorised personnel must be bound by confidentiality obligations. FIRST SERVER must implement appropriate technical and organisational measures under Article 32 GDPR, taking account of risk, scope, cost and state of the art. The agreed security schedule must address access control and least privilege, confidentiality, integrity and availability, tenant separation, incident handling, restoration, physical security and regular assessment. Specific encryption, backup frequency, recovery times or certifications apply only if documented and agreed; no unverified certification is claimed here.
The customer remains responsible for its lawful collection, instructions, application-level permissions and the security tasks allocated to it by the service agreement.
4. Subprocessors
FIRST SERVER may appoint subprocessors only with the customer's prior specific or general written authorisation. Under general authorisation, the current list must be supplied and proposed additions or replacements notified at least 30 days in advance, allowing a reasoned data-protection objection. The parties will seek a suitable resolution; if none is possible, the affected processing must not continue without a lawful agreed solution, which may include ending the affected service.
Subprocessors must be bound by data-protection obligations equivalent to those applicable to the delegated processing. FIRST SERVER remains responsible to the customer for the subprocessor's performance of those obligations. A website delivery provider is not automatically a subprocessor for every hosted customer workload.
5. Assistance and personal data breaches
Taking account of the nature of processing, FIRST SERVER must assist the customer with data-subject requests and with Articles 32–36 GDPR, including breach response, impact assessments and prior consultation. Requests received directly will be forwarded promptly unless law requires another response.
FIRST SERVER must notify the customer without undue delay after becoming aware of a personal data breach affecting customer personal data. Available details will include the nature, affected categories and approximate numbers where known, likely consequences, contact point and mitigation measures. Information may be supplied in phases without undue further delay. The customer's own statutory notification deadlines remain its responsibility.
6. International transfers
Processing locations and transfers must be documented in the service schedule. Transfers outside the EEA require lawful instructions and a valid Chapter V GDPR mechanism, such as an applicable adequacy decision or appropriate standard contractual clauses, with necessary supplementary measures. This DPA is not itself a substitute for international-transfer clauses.
7. Demonstrating compliance and audits
FIRST SERVER must make available information necessary to demonstrate compliance with Article 28 and allow and contribute to audits, including inspections by the customer or an authorised auditor. Reasonable arrangements may protect confidentiality, other customers and security, but must not defeat the audit right or regulator access. The parties should coordinate scope and timing except where urgency requires otherwise.
8. End of processing
At the customer's choice, FIRST SERVER must return or delete customer personal data after the service ends and delete existing copies unless EU or Member State law requires retention. The parties will document the export format and deletion schedule, including backup expiry. Retained copies must remain protected, be isolated from ordinary use where appropriate and be deleted when the retention requirement ends.
9. Liability and precedence
The DPA prevails over conflicting general terms for personal-data processing. Contractual limits apply between the parties only to the extent lawful and cannot restrict data subjects' rights under Article 82 GDPR, obligations to supervisory authorities or other mandatory liability. FIRST SERVER's processing of its own billing and business-contact records as controller is described separately in the Privacy Policy.
10. Contacts
The customer must designate an operational privacy and incident contact in the service schedule. FIRST SERVER's contact details are on the Contact Us page. Contact details must remain current for time-sensitive notifications.
11. Required service-specific processing schedule
The following must be completed and agreed for each applicable service before this DPA is relied on as the full processing arrangement:
- Customer/controller identity and authorised contacts; the accepted order and DPA effective date.
- Subject matter, duration, nature and purposes: for example, storing, transmitting, securing and deleting data in the specified hosting environment for the service term and agreed closure period.
- Categories of data subjects and personal data actually involved, including any special-category or criminal-offence data and agreed restrictions.
- Processing locations, authorised subprocessors, delegated tasks and international-transfer safeguards.
- Concrete technical and organisational measures, responsibility allocation and any agreed restoration or backup arrangements.
- Return, deletion and backup-expiry arrangements, and documented additional instructions.
This page establishes the contractual framework; it does not assert that an unknown customer's schedule or subprocessor list has already been agreed.