Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between FAASTIC BV, a Belgian company with VAT number BE0805008443 and its registered office at Begoniastraat 28, 9920 Lievegem, Belgium (“FAASTIC”), and the customer that uses FAASTIC’s services (“you”). It sets out how FAASTIC processes personal data on your behalf, as Article 28 of the General Data Protection Regulation (“GDPR”) requires. It applies from the moment you accept the Terms of Service and for as long as FAASTIC processes personal data for you.

1. Roles and scope

a. You are the controller of the personal data you store or process with FAASTIC’s services: the contents of your servers, websites, mailboxes, databases, storage buckets and DNS records. FAASTIC processes that data as your processor.

b. This DPA does not cover the personal data FAASTIC processes as a controller for its own purposes, such as your account, billing and support data. The Privacy Policy covers that data.

2. Subject matter, nature, purpose and duration

a. Subject matter: hosting and storing your data, and making it available through the services you order, including cloud servers, web hosting and mail, managed databases, object storage, load balancers, private networks, domain names and DNS.

b. Nature: storage, hosting, transmission, backup, restore and deletion, to the extent the services you use require it.

c. Purpose: providing the services under the Terms of Service. FAASTIC does not process the data for any other purpose.

d. Duration: as long as you use the services, followed by deletion as described in section 10.

e. Data subjects and categories of personal data: you decide what personal data you store with FAASTIC and whose data it is, for example your customers, users, employees or contacts. You are responsible for having a lawful basis for that processing, including for any special categories of personal data you choose to store.

3. Instructions

a. FAASTIC processes personal data only on your documented instructions. The Terms of Service, this DPA, and the way you configure and use the services through the client area and the API are your instructions.

b. If European Union or Belgian law requires FAASTIC to process personal data otherwise, FAASTIC informs you of that legal requirement before processing, unless the law prohibits it.

c. FAASTIC tells you if, in its opinion, an instruction infringes the GDPR or other data protection law.

d. FAASTIC does not look at the contents of your services, except where that is needed to provide the services, to handle a support request you make, to prevent or resolve a security incident, or where the law requires it.

4. Confidentiality

FAASTIC ensures that everyone it authorises to process personal data under this DPA has committed to confidentiality or is under an appropriate statutory obligation of confidentiality.

5. Security

a. FAASTIC takes appropriate technical and organisational measures to protect the personal data, as Article 32 of the GDPR requires. The annex to this DPA describes them.

b. You remain responsible for the security of what you control: your applications and software, your accounts and access credentials, the access you grant to others, your configuration and your own backups, as the Terms of Service and the Privacy Policy set out.

6. Sub-processors

a. You give FAASTIC general written authorisation to engage sub-processors, such as providers of datacenter and network services and domain name registries and registrars, where they are needed to provide the services.

b. FAASTIC imposes on each sub-processor, by contract, the same data protection obligations as this DPA sets out, and remains liable to you for the performance of its sub-processors’ obligations.

c. FAASTIC keeps a list of its current sub-processors and provides it on request through a support ticket in the client area. FAASTIC informs you of any intended addition or replacement of a sub-processor, by email or in the client area, so you can object. If you object on reasonable grounds and FAASTIC cannot offer a reasonable alternative, you may terminate the services concerned.

7. Transfers outside the European Economic Area

FAASTIC stores and processes the personal data covered by this DPA in the European Economic Area. A transfer outside the European Economic Area only happens on your instruction, for example when you register a domain name with a registry located outside it, or with appropriate safeguards under Chapter V of the GDPR.

8. Assistance

a. Data subject requests: you can access, export, correct and delete most of your data yourself through the client area and the API. Where that is not enough, FAASTIC assists you on request, taking into account the nature of the processing. If FAASTIC receives a request from a data subject about your data, it forwards the request to you and does not respond to it unless you instruct it to.

b. FAASTIC assists you, taking into account the nature of the processing and the information available to it, with your obligations regarding security, personal data breaches, data protection impact assessments and prior consultation of the supervisory authority (Articles 32 to 36 of the GDPR).

9. Personal data breaches

a. FAASTIC notifies you without undue delay after becoming aware of a personal data breach affecting the personal data it processes for you. The notification includes, as far as the information is available, the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences and the measures taken or proposed. FAASTIC provides further information as it becomes available.

b. As the controller, you decide whether to notify the supervisory authority and the data subjects, and you do so.

10. Deletion and return

a. As long as you use the services, you can export your data through the client area and the API. Before the services end, FAASTIC assists you on request with returning your data.

b. When the services end, FAASTIC deletes the personal data it processed for you, including copies. Backups are deleted when their retention period ends. This does not apply where European Union or Belgian law requires FAASTIC to keep the data.

c. You are responsible for exporting your data before the services end, as the Terms of Service set out.

11. Information and audits

a. FAASTIC makes available to you all information necessary to demonstrate compliance with Article 28 of the GDPR, and allows for and contributes to audits, including inspections, conducted by you or by an auditor you mandate who is bound to confidentiality.

b. You request an audit in writing with reasonable notice. Audits take place during business hours, at your own cost, without disrupting the services and without access to other customers’ data. FAASTIC may first answer with documentation, where that is enough to demonstrate compliance.

12. Liability and precedence

a. Liability under this DPA follows the limitations in the Terms of Service, except where the GDPR provides otherwise.

b. If this DPA and the Terms of Service conflict on the protection of personal data, this DPA prevails.

13. Applicable law and jurisdiction

This DPA is governed by Belgian law. The courts of Belgium have jurisdiction over any dispute about it, as the Terms of Service set out.

Annex: technical and organisational measures

Access to the client area and the API

• Two-factor authentication is mandatory for every account: an authenticator app or a passkey.
• Creating an API token asks for the account password or an authenticator code.
• API tokens are read-only or read & write, can be limited to areas, projects or single services, and can be given an expiry. No token can manage team members or other tokens.
• Team members have roles that limit what they can do, for example who can order and pay.

Logging

• An activity log records changes and who made them, including the API token used for changes made by scripts.

Isolation

• Virtual servers are separate KVM virtual machines.
• Each managed database and object storage instance runs on its own virtual machine.
• On web hosting, each account runs under its own system user, and its PHP processes are confined to that account.
• A private network only carries traffic between the customer’s own services.

Network and encryption

• Managed databases and object storage are closed to the internet by default. When a customer opens them, only the addresses the customer lists can connect.
• Customers can apply firewall rules and reusable firewall templates to their servers.
• The client area and the API are only reachable over encrypted connections. Managed PostgreSQL, managed MySQL and object storage accept encrypted (TLS) connections only.

Backups

• Web hosting accounts are backed up daily.
• Managed databases are backed up daily, at an hour the customer chooses, and can be restored in place or into a new instance.

Location

• Servers are housed in a datacenter in Ghent, Belgium.