This Addendum describes how Zevonix, LLC processes personal data contained in the websites we host for you. It forms part of your Website Hosting & Management Service Agreement.
You are the controller. We are the processor. The personal data inside your website, meaning your customers, your enquiries and your orders, is yours. We process it only to host and maintain the site, on your instructions. What we hold about you as our customer is covered by the Privacy Policy instead.
On this page
1. Scope and roles
This Addendum applies where we process personal data on your behalf in the course of hosting and managing your website. You determine why and how that data is processed; we act on your instructions. Using the service is your instruction to host, back up, secure, monitor and maintain the site.
2. Subject matter, duration and categories
| Subject matter | Hosting and management of the websites covered by your plan |
|---|---|
| Duration | For as long as the service is provided, plus the deletion period in section 9 |
| Nature and purpose | Storage, backup, transmission, security filtering, monitoring and maintenance. Where a staging environment is in use, this also includes duplicating the website and its database into that environment, and copying changes back when you publish. |
| Categories of data subject | Whoever your site collects data about, typically your customers, enquirers and site users |
| Categories of personal data | Whatever your site stores. Commonly names, email addresses, phone numbers, postal addresses, order records and IP addresses in server logs. |
| Special category data | Not permitted without a prior written agreement. Tell us before the site starts collecting regulated or unusually sensitive information. |
3. Our obligations
- Process personal data only on your documented instructions, unless the law requires otherwise, in which case we will tell you, if we are permitted to.
- Ensure people authorised to process the data are bound by confidentiality.
- Apply the technical and organisational measures in section 6.
- Not sell the data, and not use it for our own purposes.
4. Sub-processors
We use the following providers to deliver the service. You authorise their use by accepting this Addendum. We remain responsible for their performance.
| Provider | What it does | Where |
|---|---|---|
| Contabo GmbH | Virtual server infrastructure: the machines your site runs on | United States / EU |
| Cloudflare, Inc. | DNS, edge delivery, TLS certificates, bot and abuse filtering | Global edge network |
| IDrive Inc. (e2) | Encrypted off-server backup storage | United States |
| Zoho Corporation | Our own business correspondence and the enquiry form on zevonix.cloud. Not mail sent by your website. | United States |
| SuperOps Inc. | Our support desk and client records: support correspondence, and the names and email addresses of your named contacts. Not data held by your website. | United States |
Mail sent by your website has no sub-processor. Your managed server delivers it directly to the recipient, signed as your own domain with a key held on that server alone. Form notifications, order confirmations and password resets your site generates are not relayed through us or through anyone else, and are not co-mingled with another customer's mail.
We will give reasonable notice before adding or replacing a sub-processor that handles website personal data, so you can object on reasonable grounds.
5. International transfers
Where personal data is transferred outside the jurisdiction it was collected in, we rely on the transfer mechanisms our providers make available, including Standard Contractual Clauses where applicable. Server region is shown for each of your servers in My Cloud Manager.
6. Security measures
Each customer's sites run in an isolated virtual server environment rather than a shared pool. Backups are encrypted before leaving the server and stored separately from it. Administrative access requires two-factor authentication. Management traffic uses key-based SSH with host-key pinning. Fuller detail is in the Security Overview.
No set of measures removes all risk. We do not warrant that personal data can never be compromised.
7. Incident notification
If we become aware of a personal data breach affecting data we process for you, we will notify you without undue delay, with the detail we have at the time, and will update you as the picture becomes clearer. Because you are the controller, notifying regulators and data subjects is your responsibility; we will give you the information you reasonably need to do it.
8. Assisting you
Taking into account the nature of the processing, we will provide reasonable assistance with data subject requests, data protection impact assessments and regulator consultations. If a data subject contacts us directly about your site, we will refer them to you rather than answer for you.
9. Copies created by staging
A staging environment is a complete copy of the website and its database. While one exists, the personal data in your live site also exists in that copy, on the same server, in the same country, under the same access controls and the same encryption at rest as the live site. It is served on its own hostname with search engines instructed not to index it, and it is reachable by anyone who knows that address.
Publishing from staging creates short-lived additional copies so the change can be undone: a copy of the previous files, a dump of the previous database, and anywhere a publish set files aside rather than deleting them. We keep these for the three most recent publishes per website and then delete them.
Two consequences worth stating. A staging environment persists until it is removed, so if you have finished with one, ask us to remove it and the copy goes with it. And if you act on a data-subject erasure request against your live site while a staging copy exists, the copy is not updated by that action. Tell us, and we will refresh or remove it.
10. Return and deletion
On termination you may request a reasonable export of the covered website files and database. Unless a longer period is required by law or agreed in writing, we may permanently delete website data, staging environments, publish recovery points and managed backups 30 days after termination, so request an export before the termination date.
11. Audits
On reasonable written request, and no more than once a year unless a regulator or an incident requires otherwise, we will make available the information reasonably necessary to demonstrate compliance with this Addendum. We may satisfy this by providing documentation rather than granting access to infrastructure shared with other customers.
Contact
Data protection questions: Zevonix, LLC: [email protected] · contact form