Clear commitments for processing customer data.

Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between APN CLOUD LTD, trading as APNCloud ("APNCloud", "Processor", "we", "us" or "our"), and the customer that purchases or uses an APNCloud service and determines the purposes and means of processing Personal Data through that service ("Customer" or "Controller"). This DPA applies only to the extent APNCloud processes Personal Data on behalf of the Customer as a processor. It does not govern processing for which APNCloud acts as an independent controller, such as certain account administration, billing, fraud prevention, legal compliance, security, or business records processing described in APNCloud's Privacy Policy.

This DPA is incorporated into and subject to APNCloud's Terms of Service, applicable order, service description, or other agreement governing the Customer's use of the Services (the "Main Agreement"). If there is a conflict between this DPA and the Main Agreement concerning the processing of Personal Data on behalf of the Customer, this DPA will prevail to the extent of that conflict. If a mandatory provision of Applicable Data Protection Law conflicts with this DPA, that mandatory provision will prevail.

1. Definitions and Interpretation

1.1 "Applicable Data Protection Law" means the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018, those provisions of the Data (Use and Access) Act 2025 that amend or supplement UK data protection law and are in force from time to time, and any other data protection or privacy law that applies to the processing covered by this DPA. Where the EU General Data Protection Regulation (EU) 2016/679 ("EU GDPR") applies to a particular processing activity, Applicable Data Protection Law also includes the EU GDPR and relevant national implementing laws.

1.2 "Controller", "Processor", "Data Subject", "Personal Data", "Personal Data Breach", "Processing" and "Supervisory Authority" have the meanings given to them under Applicable Data Protection Law. "Process" and "Processed" are interpreted accordingly.

1.3 "Customer Data" means Personal Data submitted to, stored on, transmitted through, or otherwise Processed by the Services on behalf of the Customer. Customer Data may include data relating to the Customer's employees, contractors, website visitors, users, customers, subscribers, correspondents, or other individuals.

1.4 "Services" means the hosting, reseller hosting, virtual server, managed server, dedicated server, email, domain-related, backup, migration, support, security, software, or related services supplied by APNCloud under the Main Agreement, to the extent those Services involve Processing Customer Data on the Customer's behalf.

1.5 "Sub-processor" means a third party appointed by or on behalf of APNCloud to Process Customer Data on behalf of the Customer. A provider that processes Personal Data for its own independent purposes is not a Sub-processor merely because the Customer or APNCloud interacts with it.

1.6 Headings are for convenience only. References to a law include amendments, replacements, re-enactments, subordinate legislation, and legally binding regulatory requirements applicable to the relevant Processing.

2. Roles of the Parties and Scope

2.1 The Customer is the Controller of Customer Data, or a Processor acting on behalf of another Controller. APNCloud is the Processor of Customer Data where it Processes that data solely to provide the Services in accordance with the Customer's documented instructions.

2.2 The Customer determines what Personal Data is placed into the Services, the purposes for which it is used, who is permitted to access it, how long it is retained, and the lawful basis for the Processing. APNCloud does not determine the Customer's business purposes for Customer Data.

2.3 If the Customer acts as a Processor for another Controller, the Customer confirms that it is authorized to appoint APNCloud as a further processor and to issue the instructions contained in the Main Agreement, this DPA, service configuration, support requests, and other documented communications.

2.4 Annex 1 describes the subject matter, duration, nature and purpose of the Processing, the types of Personal Data, and the categories of Data Subjects. The Customer may provide further documented instructions through supported configuration settings, the Client Area, APIs, or support channels, provided those instructions are consistent with the Main Agreement and Applicable Data Protection Law.

2.5 APNCloud may Process Personal Data as an independent Controller where necessary for its own legitimate business and legal purposes, including customer account administration, invoicing, payment records, tax and accounting records, fraud and abuse prevention, network and service security, legal claims, regulatory compliance, and enforcement of the Main Agreement. Such Processing is outside the scope of this DPA and is governed by APNCloud's Privacy Policy and Applicable Data Protection Law.

3. Customer Instructions and Responsibilities

3.1 APNCloud will Process Customer Data only on the Customer's documented instructions, including instructions concerning transfers of Personal Data, unless APNCloud is required to Process the data by applicable law. Where legally permitted, APNCloud will inform the Customer before Processing required by law.

3.2 The Main Agreement, this DPA, the Customer's selected service configuration, and written instructions submitted through APNCloud's supported channels constitute documented instructions. APNCloud is not required to follow an instruction that would violate Applicable Data Protection Law or require a material change to the Services that has not been agreed.

3.3 If APNCloud reasonably believes an instruction infringes Applicable Data Protection Law, it may suspend the affected instruction and inform the Customer. The parties will cooperate in good faith to resolve the issue. APNCloud does not provide legal advice and the Customer remains responsible for determining whether its intended Processing is lawful.

3.4 The Customer is responsible for: (a) providing all legally required privacy notices; (b) establishing a lawful basis for the Processing; (c) obtaining valid consent where consent is relied upon; (d) responding to Data Subjects and Supervisory Authorities as Controller; (e) configuring the Services appropriately; (f) implementing reasonable security for Customer-controlled accounts, applications, passwords, code, and devices; and (g) ensuring its instructions comply with law.

3.5 The Customer must not instruct APNCloud to Process Personal Data that the Customer is not legally entitled to collect, use, disclose, or transfer. The Customer should not use ordinary hosting services for highly regulated or unusually sensitive data unless it has assessed the legal and security requirements and APNCloud has expressly agreed to any additional requirements that exceed the standard Services.

4. Confidentiality and Personnel

4.1 APNCloud will ensure that persons authorized to Process Customer Data are subject to an appropriate duty of confidentiality, whether by contract, policy, professional duty, or law.

4.2 Access to Customer Data will be limited to personnel and authorized service providers who need access for the provision, maintenance, security, troubleshooting, support, backup, migration, or lawful administration of the Services.

4.3 APNCloud will take reasonable steps to ensure that personnel with access to Customer Data are informed of relevant data protection and security obligations. Administrative access will be controlled according to role and operational need.

4.4 Nothing in this DPA requires APNCloud to disclose information that would compromise the security of other customers, reveal another customer's confidential information, expose credentials or security secrets, or violate a legal obligation.

5. Security of Processing

5.1 Taking into account the state of the art, implementation costs, the nature, scope, context and purposes of Processing, and the risks to individuals, APNCloud will implement and maintain appropriate technical and organizational measures designed to provide a level of security appropriate to the risk. The categories of measures normally relevant to the Services are summarized in Annex 2.

5.2 Depending on the Service and risk, security measures may include access controls, authentication controls, secure administrative channels, network protections, logging, patching and vulnerability management, backup and recovery controls, physical protections at infrastructure facilities, incident response procedures, and measures designed to preserve confidentiality, integrity and availability.

5.3 Security responsibilities are shared. The Customer is responsible for Customer-managed applications, scripts, plugins, operating systems where unmanaged, passwords, access keys, account permissions, website code, database credentials, endpoint devices, and other elements within the Customer's control. A security incident caused by Customer configuration does not by itself establish a breach by APNCloud.

5.4 APNCloud may change technical and organizational measures over time to address evolving technology, threats, Services, and legal requirements, provided the overall level of protection is not materially reduced in a manner inconsistent with Applicable Data Protection Law.

6. Sub-processors

6.1 The Customer gives APNCloud general written authorization to engage Sub-processors where reasonably necessary to provide the Services. Sub-processors may include infrastructure and data-center providers, network providers, backup providers, email or support systems, software and licensing platforms, security providers, and other service providers that Process Customer Data on APNCloud's behalf.

6.2 APNCloud will enter into a written agreement with each Sub-processor that imposes data protection obligations materially equivalent to those required of a processor under Applicable Data Protection Law, insofar as those obligations are relevant to the Sub-processor's Processing.

6.3 APNCloud remains responsible for the performance of its Sub-processors to the extent required by Applicable Data Protection Law and subject to the allocation of liability in the Main Agreement.

6.4 APNCloud may maintain a current list or description of material Sub-processors through its website, policy pages, customer communications, or another reasonable channel. Where Applicable Data Protection Law requires notice of new or replacement Sub-processors, APNCloud will provide reasonable advance notice.

6.5 If the Customer reasonably objects to a new Sub-processor on substantiated data protection grounds, the Customer must notify APNCloud promptly and, where possible, within ten business days after receiving notice. The parties will discuss commercially reasonable alternatives. If no reasonable alternative is available, APNCloud may allow the Customer to discontinue the affected Service in accordance with the Main Agreement. An objection may not be used solely to avoid agreed commercial obligations.

7. International Data Transfers

7.1 APNCloud may Process or permit access to Customer Data from locations outside the United Kingdom or the European Economic Area where this is necessary to provide, support, secure, or maintain the Services. Any restricted transfer will be made in accordance with Applicable Data Protection Law.

7.2 Where a transfer from the United Kingdom requires an appropriate safeguard and no applicable adequacy regulation or other lawful exemption applies, the parties will rely on an approved transfer mechanism such as the UK International Data Transfer Agreement (IDTA), the UK International Data Transfer Addendum to the European Commission Standard Contractual Clauses, or another legally recognized safeguard, as applicable.

7.3 Where the EU GDPR applies to a restricted transfer from the EEA, the parties may rely on the European Commission Standard Contractual Clauses in the module appropriate to the parties' roles, together with any supplementary measures required by law.

7.4 APNCloud will take reasonable steps to assess transfer requirements applicable to its Processing and to implement supplementary contractual, technical, or organizational measures where required. The Customer will provide information reasonably necessary to assess a transfer concerning Customer Data.

8. Data Subject Requests

8.1 Taking into account the nature of the Processing, APNCloud will provide reasonable assistance to the Customer, through appropriate technical and organizational measures where feasible, to enable the Customer to respond to requests from Data Subjects exercising rights under Applicable Data Protection Law.

8.2 If APNCloud receives a request directly from a Data Subject that clearly concerns Customer Data for which the Customer is Controller, APNCloud will, where appropriate and legally permitted, direct the individual to the Customer or notify the Customer. APNCloud will not independently determine the merits of the request on the Customer's behalf unless legally required.

8.3 Where the Services provide self-service functionality enabling the Customer to access, correct, export, restrict, or delete Customer Data, the Customer should use those tools in the first instance.

9. Personal Data Breaches and Incident Cooperation

9.1 APNCloud will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Data for which APNCloud acts as Processor, unless Applicable Data Protection Law does not require notification to the Customer.

9.2 To the extent information is available, the notification will include information reasonably necessary for the Customer to understand the nature of the incident, categories of affected data or individuals where known, likely consequences where known, measures taken or proposed, and a contact point for follow-up. Information may be provided in phases as the investigation develops.

9.3 APNCloud will take reasonable steps to contain, investigate, mitigate, and remediate a Personal Data Breach within its area of responsibility. APNCloud will reasonably cooperate with the Customer in meeting applicable breach notification or documentation obligations.

9.4 Notification of an incident is not an admission of fault, liability, or legal non-compliance. The Customer remains responsible for determining whether notification to a Supervisory Authority, Data Subjects, customers, or other third parties is required in its role as Controller.

9.5 The Customer must promptly notify APNCloud of any suspected compromise involving APNCloud credentials, administrative accounts, APIs, servers, or other security elements that may affect the Services. The Customer will reasonably cooperate with APNCloud's containment and remediation instructions.

10. Assistance with Compliance

10.1 Taking into account the nature of Processing and information available to APNCloud, APNCloud will provide reasonable assistance to the Customer with obligations relating to security of processing, Personal Data Breaches, data protection impact assessments, and prior consultation with a Supervisory Authority where those obligations concern Processing carried out by APNCloud on the Customer's behalf.

10.2 Assistance may consist of documentation, security information, responses to reasonable questionnaires, service specifications, incident information, audit materials, or other information appropriate to the Services and risk.

10.3 The Customer is responsible for preparing its own data protection impact assessment and determining whether prior consultation is legally required. APNCloud is not required to provide legal advice, disclose another customer's information, expose sensitive security information, or create bespoke documentation unrelated to the Services.

11. Records, Information, Audits and Inspections

11.1 APNCloud will make available information reasonably necessary to demonstrate compliance with the processor obligations applicable to the Processing under this DPA and Applicable Data Protection Law.

11.2 Where reasonable, APNCloud may satisfy information requests by providing relevant policies, security summaries, third-party assurance reports, audit materials, certifications, penetration-test summaries, or other appropriate documentation, if and when such materials are maintained and may lawfully be disclosed.

11.3 Subject to the conditions below, APNCloud will allow for and contribute to audits or inspections by the Customer or an independent auditor appointed by the Customer where required by Applicable Data Protection Law. Unless a Supervisory Authority requires otherwise, audits should be limited to once in any twelve-month period, conducted on reasonable prior written notice during normal business hours, and designed to minimize disruption and security risk.

11.4 The Customer and any auditor must protect APNCloud's confidential information, comply with reasonable security and site-access requirements, and avoid access to information concerning other customers. APNCloud may require an auditor to sign an appropriate confidentiality agreement and may propose a remote or document-based audit where it reasonably provides sufficient assurance.

12. Return, Deletion and Retention

12.1 During the term of the Services, the Customer may use available tools to retrieve, export, or delete Customer Data, subject to service capabilities.

12.2 Upon termination or expiry of the relevant Service, and at the Customer's choice where Applicable Data Protection Law requires such choice to be offered, APNCloud will delete or return Customer Data and delete remaining copies, unless applicable law requires continued retention.

12.3 The Customer is responsible for exporting data it wishes to retain before service termination. After termination, Customer Data may remain temporarily in backups, disaster-recovery media, system logs, or residual copies until overwritten or deleted in the ordinary retention cycle, provided it remains protected and is not restored for active use except where necessary for recovery, security, legal compliance, or continuity.

12.4 APNCloud may retain limited records as an independent Controller where required for billing, taxation, fraud prevention, security, dispute resolution, legal claims, or regulatory compliance. Such records are not retained on the Customer's behalf and are outside the return-and-deletion obligation in this clause.

13. Special Categories, Criminal Data and Regulated Workloads

13.1 The Services are general-purpose hosting and infrastructure services unless a product description expressly states otherwise. APNCloud does not determine whether the Customer's workload is subject to sector-specific regulation.

13.2 If the Customer chooses to Process special category data, criminal offence data, health data, financial data, children's data, authentication secrets, or other high-risk information, the Customer is responsible for confirming that it has an appropriate legal basis, has completed any required risk assessment, and has selected a Service and configuration with security measures appropriate to that risk.

14. Liability, Priority and Term

14.1 Each party remains responsible for its own compliance with Applicable Data Protection Law. Nothing in this DPA limits rights or remedies that cannot lawfully be limited.

14.2 Except to the extent prohibited by law, liability arising from or in connection with this DPA is subject to the exclusions, limitations, caps, and procedures set out in the Main Agreement. This DPA does not create a separate unlimited liability regime.

14.3 This DPA begins when the Main Agreement begins or when APNCloud first Processes Customer Data on behalf of the Customer, whichever is earlier, and continues for as long as APNCloud Processes Customer Data on the Customer's behalf.

14.4 The governing law and dispute-resolution provisions of the Main Agreement apply to this DPA, except where mandatory Applicable Data Protection Law requires otherwise.

Annex 1 - Details of Processing

Annex 2 - Technical and Organizational Measures

APNCloud will maintain security measures appropriate to the nature of the Services and the risks of the Processing. Measures are applied according to service type, infrastructure, risk, and technical feasibility and may be updated over time. They include, as applicable:

Governance and access management: Administrative access is limited according to role and operational need. Access rights may be reviewed, changed, or withdrawn when duties change or access is no longer required.

Authentication: Administrative systems use controlled authentication methods appropriate to the system. Customers are responsible for protecting their own credentials and enabling available security features.

Transmission security: Customer-facing and administrative web interfaces use secure transport protocols where supported and appropriate. Sensitive administrative access is designed to use protected channels rather than plain-text access methods.

Network and infrastructure protections: Network controls, firewalls, routing controls, abuse controls, segmentation or equivalent mechanisms are used as appropriate to the service architecture and risk.

System maintenance: APNCloud applies reasonable maintenance, patching, vulnerability remediation, and software lifecycle practices to infrastructure under its control. Customer-managed software remains the Customer's responsibility unless management is included in the purchased Service.

Logging and monitoring: Operational, security, and service logs may be maintained to detect incidents, investigate abuse, troubleshoot problems, and support service reliability. Log scope and retention vary by system.

Backup and recovery: Where backups are included in a Service, APNCloud maintains backup and recovery procedures appropriate to that Service. Customers remain responsible for independent copies of critical data unless a separate agreement states otherwise.

Incident response: APNCloud maintains procedures for identifying, assessing, containing, investigating, and responding to security incidents, including escalation and customer notification where required.

Availability and resilience: Reasonable measures are used to support availability and recovery of systems, taking account of the purchased Service, infrastructure architecture, backup arrangements, maintenance, and dependencies.

Personnel confidentiality: Personnel authorized to access Personal Data are subject to appropriate confidentiality obligations and are expected to follow security and privacy requirements.

Supplier management: Sub-processors are selected with regard to the nature of the Processing and are bound by appropriate contractual data protection obligations.

Secure disposal: Data is deleted or rendered inaccessible through normal deletion, account termination, storage reuse, or backup expiry processes, subject to legal retention requirements and technical limitations.

Physical security: Physical security for hosted infrastructure is provided through APNCloud facilities or relevant data-center/infrastructure providers using controls appropriate to the facility and service.

Annex 3 - Sub-processors and Transfer Framework

APNCloud may use Sub-processors in the following functional categories. The exact provider depends on the Service, location, and configuration selected by the Customer. APNCloud may publish or otherwise provide a current material Sub-processor list and notices of changes as described in clause 6.

Infrastructure and data centers: Server hosting, colocation, cloud infrastructure, storage, network connectivity, physical facilities, and related operational services.

Backup and continuity providers: Backup storage, replication, recovery, and continuity services where included in the purchased Service.

Support and communications systems: Support ticketing, customer communications, incident communications, and operational collaboration where these systems process Customer Data on APNCloud's behalf.

Security and abuse-prevention providers: Security monitoring, anti-abuse, malware detection, network protection, and related security functions where used.

Software and service platforms: Control panels, licensing systems, email infrastructure, monitoring tools, migration tools, and other platforms necessary to deliver specific Services.

Specialist service providers: Providers engaged for a particular customer-requested service where Processing of Customer Data is necessary and appropriately contracted.

Where a Sub-processor or APNCloud location results in a restricted international transfer, APNCloud will use an applicable lawful transfer mechanism, which may include adequacy regulations, the UK IDTA, the UK Addendum to the EU Standard Contractual Clauses, the EU Standard Contractual Clauses where the EU GDPR applies, or another safeguard recognized by Applicable Data Protection Law. Any required transfer risk assessment and supplementary measures will be addressed according to the circumstances of the transfer.

Optional Execution Page

This DPA may apply through incorporation into the Main Agreement. If a signed copy is required, the parties may complete the signature blocks below.