Data processing agreement

• When this agreement applies
• How it is agreed
• The clauses
• Annex: description of the processing
• Annex: security measures
• Sub-processors
• Transfers outside the European Economic Area

This agreement applies when Domgate stores or processes personal data on behalf of a business customer, as its processor: the content of hosting accounts, of e-mail accounts and of DNS zones (Regulation (EU) 2016/679, the GDPR, Art. 28).

It does not cover registration data, which Domgate processes as a controller; see our privacy policy.

For registration data, Domgate and its resellers each act as separate controllers.

The agreement is made in writing, which may be in electronic form (GDPR, Art. 28(9)).

The customer accepts this agreement when it places an order for a hosting, e-mail or DNS service.

Nothing in the Registration Agreement, including its "Limitation of Liability" section, limits Domgate's obligations under this agreement or its liability under Article 82 of the GDPR.

The clauses are the standard contractual clauses between controllers and processors adopted by the European Commission (Implementing Decision (EU) 2021/915), incorporated by reference without any change, with the annexes below. Together they cover every point that Article 28(3) of the GDPR requires:

• the subject-matter and duration of the processing, its nature and purpose, the types of personal data and the categories of data subjects;
• the obligations and rights of the customer as controller;
• processing only on documented instructions, including on transfers outside the European Economic Area;
• the confidentiality of the persons authorised to process the data;
• the security measures of Article 32;
• the use of sub-processors only under Article 28(2) and (4);
• help with requests from data subjects;
• help with the obligations of Articles 32 to 36;
• the deletion or return of the data at the end of the service;
• the information needed to show compliance, and audits;
• a warning when an instruction would infringe the GDPR or other Union or Member State data protection law.

• Categories of data: the content the customer stores in its hosting accounts, mailboxes and DNS zones, which may include any personal data the customer chooses to store there, such as names, contact details, messages and website content.
• Data subjects: the customer's own users, contacts, correspondents and website visitors.
• Purpose: providing the hosting, e-mail and DNS services the customer ordered.
• Duration: the term of the service. The data are deleted one year after the expiry of the customer's last service.

• Two-factor authentication for access to the accounts and systems that hold customer data.
• Encryption of data in transit.
• Confidentiality commitments for every person authorised to process the data.

The hosting and e-mail services that Domgate sells are provided through specialised providers, which act as Domgate's sub-processors.

Domgate informs customers before it adds or replaces a sub-processor, and customers may object to the change (GDPR, Art. 28(2)).

Domgate gives this notice at least 30 days before a new sub-processor is used.

Where a sub-processor outside the European Economic Area is used, the transfer relies, in this order, on:

1. an adequacy decision of the European Commission (GDPR, Art. 45); for a provider in the United States, only if it appears on the Data Privacy Framework List (Implementing Decision (EU) 2023/1795);
2. otherwise, the standard contractual clauses of Implementing Decision (EU) 2021/914, Module 3 (processor to processor), where the importer's processing is not subject to the GDPR;
3. as a last resort, the derogations of Article 49 of the GDPR, which are exceptions to be read restrictively; those based on a contract or on legal claims (Art. 49(1)(b), (c) and (e)) cover only occasional transfers.

Version 1 of 12 October 2026.

Last updated: 12 October 2026.

Legal position checked on 4 October 2026.