GDPR Data Processing Agreement (DPA)
DEFINITIONS
This Data Processing Agreement (“DPA”) is an addendum to the Terms & Conditions between OkeyHost Ltd (“OkeyHost”) and you (“Customer”). This DPA is effective as of 1 May 2025 and supersedes all previously applicable data processing and security terms, continuing for as long as OkeyHost provides services as set out in the OkeyHost Terms & Conditions.
Definitions
- Customer Data: Data provided by or on behalf of the Customer or Customer’s End Users via the Services under the account.
- Data Controller: Entity that determines the purposes and means of the processing of Personal Data.
- Data Processor: Entity that processes Personal Data on behalf of the Data Controller.
- Data Protection Laws: All applicable data protection and privacy laws and regulations, including the GDPR.
- Data Subject: The individual to whom Personal Data relates.
- EEA: European Economic Area.
- GDPR: EU General Data Protection Regulation 2016/679.
- Personal Data: Any Customer Data relating to an identified or identifiable natural person protected as personal data under GDPR.
- Processing: As defined in the GDPR; “process”, “processes” and “processed” interpreted accordingly.
- Sub-Processor: Any third party authorized to have logical access to and process Customer Data in support of the Services.
- Services: Any product or service provided to Customer as described in OkeyHost Ltd. Terms & Conditions.
Data Processing
OkeyHost will only process Customer Data in accordance with documented instructions from the Customer (“Instruction”), unless required by law. The default Instruction is that OkeyHost may process Customer Data solely to deliver Services as per its Terms & Conditions and related agreements. Customers may issue additional written instructions, which must be consistent with this Agreement; Customers are responsible for ensuring only authorized individuals issue such instructions.
OkeyHost will promptly inform the Customer of any instruction believed to violate the GDPR and will pause processing until resolved.
When Customer Data is processed by OkeyHost, both parties acknowledge:
- OkeyHost is the Data Processor of Customer Data under the GDPR.
- Customer is the Data Controller of Customer Data under the GDPR.
Confidentiality
OkeyHost shall treat all Customer Data as confidential. Customer Data will not be copied, transferred or otherwise processed contrary to Customer instruction unless required by law. All OkeyHost employees processing Customer Data are subject to confidentiality obligations and instructed to handle such data with strict confidentiality.
Sub-Processing
Customer authorizes OkeyHost to engage third parties (“Sub-Processors”) to process Customer Data without further written authorization. OkeyHost restricts Sub-Processor access to only that which is necessary to provide Services and ensures all Sub-Processors are contractually bound to equivalent data protection obligations.
OkeyHost remains fully responsible for Sub-Processors’ actions and will notify the Customer of any new Sub-Processor engagement at least 30 days prior via the account email or control panel. It is the Customer’s responsibility to keep this contact information accurate and up to date.
Customers may object to a Sub-Processor by terminating the Addendum and Services as set forth in OkeyHost Terms & Conditions. A list of current Sub-Processors is maintained below (see Annex 1).
Security
OkeyHost implements and maintains appropriate technical and organizational measures to protect Customer Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access, as detailed in Annex 2 and in accordance with GDPR Article 32. Security measures may be updated as technology advances, provided such changes do not degrade overall protection. OkeyHost also offers customer-accessible controls for additional data security inside the control panel.
Data Breach Notifications
If OkeyHost becomes aware of a breach leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Data under its management, OkeyHost will notify the Customer without undue delay via the registered account email. Customers are responsible for keeping these contact details current in the control panel.
OkeyHost will investigate the cause and act to prevent recurrence. Data breach notifications will not cover unsuccessful login attempts, pings, port scans, denial-of-service attacks, or other unsuccessful security events that do not compromise Customer Data.
Data Subject Rights
If OkeyHost receives a request directly from a Data Subject regarding their Customer Data, OkeyHost will forward the request to the Customer, and Customer is responsible for timely response as required by the GDPR. OkeyHost will assist the Customer by providing available tools and controls.
Data Transfers
OkeyHost stores and processes Customer Data in secure data centers located within the EEA. Data may be transferred and processed outside the EEA where Sub-Processors operate; such transfers comply with all relevant Data Protection Laws. Customer agrees to such transfer, storage, or processing outside the EEA. OkeyHost will take all reasonable steps to protect Customer Data accordingly.
Compliance and Audit Rights
OkeyHost maintains clear records of security standards. Upon written request, OkeyHost will make available reasonable, relevant information to demonstrate DPA compliance. Any audit requires at least 30 days’ written notice, may not occur more than once per 12 months, and will be coordinated for minimal business disruption. If OkeyHost declines an audit request, Customer may terminate this Addendum and Services.
Return or Deletion of Data
OkeyHost only retains Customer Data as long as required to deliver Services. Upon Addendum or Service termination, all Customer Data will be deleted unless retention is required by law. For archived backups, OkeyHost will securely isolate data from further processing.
Limitation of Liability
Each party’s total liability under this Addendum is subject to the limitation of liability outlined in OkeyHost Terms & Conditions. OkeyHost is not responsible for losses or damages resulting from Customer’s violation of the Terms & Conditions, regardless of account suspension or termination due to such violations.
Annex 1 – Sub-Processors
| Company | Service Provided |
|---|---|
| Gala Star Media | Subscription Management, Service Provisioning |
| 20i Limited | Servers & Data Center |
| Stripe | Credit/Debit Card Payments |
| Tawk.to | Support & Communications |
Annex 2 – Security Measures
Details available upon request.
