GDPR Compliance

Our Approach to Data Protection

Twerple Ltd is a UK company, and the UK General Data Protection Regulation and the Data Protection Act 2018 apply to everything we do with personal data. Many of our customers also serve people in the European Union, so we meet the requirements of the EU GDPR as well. We treat data protection as part of running a good hosting company rather than a box to tick: the fewer places personal data lives, the fewer people can see it and the quicker it is deleted when no longer needed, the safer everyone is.

This page does two things. It explains how we handle personal data in general, and it sets out the data processing terms that apply whenever you store personal data about other people on our services. Those terms form part of our Terms of Service, so you do not need to sign anything separately, although we will provide a signed copy if you ask (section 11). How we handle your own personal data as our customer is covered in our Privacy Policy.

When We Are the Controller and When We Are Your Processor

The GDPR distinguishes between the organization that decides why and how personal data is used (the controller) and one that handles it on that organization’s behalf (the processor). We are both, depending on whose data it is.

Data Processing Terms: Scope

These terms apply to all personal data that you, or your own customers, store or process using our services (“Customer Data”). They are written to meet Article 28 of the UK GDPR and the EU GDPR, which requires the following details to be set down between a controller and a processor:

What We Commit To as Your Processor

When we process Customer Data on your behalf, we will:

• Act only on your instructions. Your instructions are the services you order, the settings you choose in your control panel and client area, and any written request you send to support. We will tell you if we believe an instruction breaks data protection law.
• Keep it confidential. Only staff who need access to provide or support the service can reach Customer Data, and every member of our team is bound by confidentiality obligations.
• Protect it. We maintain the technical and organizational security measures described in section 7 and keep them up to date as threats and technology change.
• Use only approved sub-processors. As described in section 5, under written contracts that impose the same obligations we accept here.
• Help you meet your own duties. We assist, as far as we reasonably can, with requests from individuals, with security and breach obligations, and with data protection impact assessments or consultations with the Information Commissioner’s Office.
• Delete or return the data at the end. As described in section 10.
• Show you that we comply. We make the information needed to demonstrate compliance available to you, and allow audits on the terms in section 10.

Sub-processors

We use a small number of other companies to help provide the infrastructure your data sits on. Each is bound by a written contract that holds it to the same standards as this page, and each is listed here. You authorize us to use them by ordering our services.

If we intend to add or replace a sub-processor that will handle Customer Data, we will update this page and email account holders at least 30 days beforehand. If you have a reasonable objection, tell us within that period and we will work with you to find a solution; if none is possible, you may cancel the affected service and receive a pro-rata refund of any prepaid period.

Where Your Data Is Stored

Customer Data is stored in the data centre location of the service you order: the United Kingdom, Germany, France or the United States. It stays there. We do not move data between regions, replicate it to another country or allow access from another country except on your instruction or when required by law. If you need your data to stay inside the UK or the EU, choose a UK, German or French location and it will.

The UK Government has found the EU to provide adequate protection for personal data, and the EU has found the same for the UK, so data may move between those two freely. For services in the United States, you are choosing to store data there, and we rely on the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, for the transfer. Our support staff who may access systems in the course of their work are based in the United Kingdom.

Security Measures

Article 32 of the GDPR requires security appropriate to the risk. These are the measures we maintain on our platform:

On VPS and dedicated servers you control the operating system, so the measures inside the server, such as updates, firewall rules, encryption of stored data and backups, are yours to set up; we secure the network and the hardware around it.

Security Breaches and Requests From Individuals

Your Responsibilities as the Controller

Good hosting takes care of the infrastructure, but the GDPR places most duties on the controller, which is you for the data on your websites. In particular, you are responsible for:

• having a lawful basis for the personal data you collect, and a privacy notice on your website that tells people what you do with it;
• obtaining consent for cookies and tracking on your own site where the law requires it;
• answering requests from your users to access, correct or delete their data within the legal time limits;
• keeping your passwords, API keys and control panel access secure, and removing access for people who leave your organization;
• keeping the software you run up to date, including content management systems, plugins and themes, which are the most common way websites are compromised;
• taking and testing your own backups of anything you cannot afford to lose, in addition to ours;
• not storing data that needs a specific regulatory regime without the controls it requires. In particular, full payment card numbers must never be stored on shared hosting; use a payment provider that keeps them for you.

If you resell our services, these responsibilities also apply to your customers, and you must pass equivalent terms on to them.

End of Service, Deletion and Audits

• Taking your data with you: you can download your files, databases and email at any time from your control panel, in standard formats, so moving to another provider never depends on us.
• Deletion: when a service ends, its data is kept for 14 days so that you can retrieve anything you have forgotten, and is then permanently deleted from the live servers. Backups that still contain it expire on their normal schedule and are not restored after that point. We keep only the account and billing records we are required to keep by law.
• Information and audits: we will answer reasonable written questions about how we protect your data, and provide this page, our security description and summaries of any relevant third-party reports. If you need more than that, you may audit our compliance once in any 12-month period, on at least 30 days’ notice, during business hours, without disrupting the service to other customers, and at your own cost. Where an independent report covers the point, we may provide it instead of an on-site visit.
• Records: we keep the records of processing required by Article 30 of the GDPR and make the relevant entries available to you on request.

Signed Agreement and Contact

These terms apply automatically to every customer and need no signature. If your own compliance records, your auditors or your customers require a signed data processing agreement, email us and we will send you a copy of these terms as a document for both parties to sign. We do not negotiate individual changes to the terms for standard services, because every customer on a shared platform must be protected in the same way.

Our liability under these terms is as set out in our Terms of Service. These terms are governed by the law of England and Wales. We review this page at least once a year and whenever our sub-processors, locations or security measures change; the date at the top shows the last update.