Data processing agreement

If you place personal data on your Daylit hosting, for example of customers, members or visitors to your site, we process that data on your behalf. The GDPR requires us to make arrangements about this (Article 28). They are set out below and apply automatically to every customer who processes personal data through our service, as part of our terms and conditions.

This is a translation of the Dutch verwerkersovereenkomst. If the two versions differ, the Dutch version prevails.

1. Parties and roles

1.1 You are the controller: you decide why and how personal data is processed on your hosting.

1.2 BBJL B.V., trading as Daylit, Graafschap 5, 5431 DE Cuijk, is the processor: we process the data only to provide the hosting service to you.

2. Subject matter and duration

2.1 Subject matter: storing, making available, backing up and technically managing data that you place or collect on your hosting.

2.2 Types of data: determined by you. Usually contact details, account details, orders, messages and technical data such as IP addresses.

2.3 Data subjects: determined by you. Usually visitors, customers, members and staff of your organisation.

2.4 Duration: these arrangements apply as long as we process data for you, so as long as the hosting agreement runs and until the data is deleted under article 9.

3. Only on your instructions

3.1 We process the data only to provide the service and in accordance with your written instructions. Using the service as you set it up counts as an instruction.

3.2 We never use the data for our own purposes, never sell it and do not look at the content, unless needed for technical management, resolving an outage, assessing an abuse report, or because the law requires it.

3.3 If we believe an instruction breaches the GDPR, we tell you immediately.

3.4 If the law requires us to disclose data, we inform you in advance, unless the law forbids that.

4. Confidentiality

Everyone with access to the data on behalf of Daylit is bound by confidentiality.

5. Security

We take appropriate technical and organisational measures to protect the data, including:

• servers in the Netherlands, in a shielded network;
• separation between customers: each site runs in its own isolated container;
• encrypted connections (TLS) for websites and management;
• access to systems only for those who need it, with strong authentication;
• automatic security updates of the operating system;
• daily backups;
• logging and monitoring to detect abuse and outages.

You are responsible for the security of what you manage yourself, such as your themes, plugins, own code and passwords.

6. Sub-processors

6.1 At present we do not engage sub-processors for storing and processing your hosting data: the service runs on our own equipment.

6.2 If we want to engage a sub-processor, for example for an additional backup at another location, we tell you at least 30 days in advance. You may object. If we cannot resolve it, you may cancel the agreement free of charge.

6.3 We impose the same obligations on a sub-processor as set out in this agreement.

6.4 We do not transfer data to countries outside the European Economic Area without your prior consent and without the safeguards required by the GDPR.

7. Data breaches

7.1 If we discover a security breach affecting your data, we tell you without undue delay and no later than 48 hours after discovery.

7.2 We give you the information you need to assess whether you must notify the Dutch Data Protection Authority or data subjects: what happened, which data and roughly how many data subjects are likely affected, the possible consequences and the measures we have taken.

7.3 Notifying the supervisory authority and data subjects is your responsibility; we help you with it.

8. Assistance with data subject rights

8.1 You can usually handle requests from data subjects, such as access or deletion, yourself in your site. If that is not possible, we help you within reasonable limits.

8.2 If we receive such a request about your data ourselves, we forward it to you.

8.3 We also help you, within reasonable limits, with a data protection impact assessment (DPIA) or consultation with the supervisory authority.

9. End of processing

When the hosting agreement ends, you can download your data yourself until the end date. 30 days after the end date we permanently delete the data; after that it disappears from our backups in the normal cycle. This does not apply where the law requires us to keep data longer.

10. Audits

10.1 On request we give you the information needed to demonstrate that we comply with these arrangements.

10.2 If you have a well-founded reason for doubt, you may have an audit carried out once a year by an independent expert bound by confidentiality. You announce it at least 30 days in advance. The audit may not endanger the service or the data of other customers. The costs are yours, unless it turns out that we materially failed to comply with these arrangements.

11. Other arrangements

11.1 Liability is governed by the terms and conditions. Each of us remains responsible for fines imposed on it by the supervisory authority.

11.2 If these arrangements and the terms and conditions conflict on personal data, these arrangements prevail.

11.3 This agreement is governed by Dutch law.