This Data Processing Agreement ("DPA") forms part of the Terms of Service between the customer ("Controller") and 127box ("Processor") and reflects the parties' agreement regarding the processing of personal data in accordance with Article 28 GDPR.
1. Subject matter & duration
The Processor processes personal data on behalf of the Controller solely for the purpose of providing the Services for the duration of the contract.
2. Nature & purpose of processing
Hosting of compute, storage and network resources; domain registration; DNS management; TLS issuance; email delivery; backups and disaster recovery.
3. Categories of data subjects & data
- End users of the Controller's applications hosted on Processor infrastructure.
- Categories of data are determined by the Controller and may include identifiers, contact data, and any content uploaded.
4. Sub-processors
The Controller authorises engagement of the sub-processors listed in our Privacy Policy. The Processor will notify the Controller of changes at least 30 days in advance and the Controller may object on reasonable grounds.
5. Technical & organisational measures
Encryption in transit (TLS 1.2+) and at rest, access control with MFA, audit logging, backup with 7-day retention, vulnerability scanning, and documented incident response.
6. Data subject rights & breach notification
The Processor will assist the Controller in responding to data-subject requests and will notify the Controller without undue delay (and at most within 72 hours) of any personal data breach affecting Controller data.
7. Audit rights
The Controller may, no more than once per year and with reasonable notice, request audit information; on-site audits require mutual scheduling and may be conducted by an independent third-party under NDA.
8. Return or deletion
On termination of the Services, the Processor will, at the Controller's choice, return or delete all personal data within 30 days, save for copies required by law.
How to obtain a signed copy
Email dpo@127box.com with your company details to receive a counter-signed DPA.