Data Processing Agreement

Last updated: 7 October 2026  ·  Version: 1.0  ·  Forms part of our hosting terms

1. How the chain of responsibility works

This trips most people up, so here it is plainly. Each link in the chain is a controller of some data and a processor of other data — the label depends on whose data you are talking about, not on where you sit in the chain.

Data	Controller	Processor	Sub-processor
Personal data on your website, database or mailbox — e.g. your own customers and enquiries	You	BizeeInternet (Kangconoweb)	IONOS Cloud Limited, and the suppliers in section 7
Your account and billing details, held by us	BizeeInternet (Kangconoweb)	Our suppliers — payment provider, infrastructure provider	Their own suppliers
BizeeInternet's own account details held by IONOS	BizeeInternet	IONOS Cloud Limited	Their own suppliers

So: you are the controller for the data you choose to host with us, and we are your processor. Where we engage someone else to help us process that data, they are your sub-processor — and we remain fully responsible to you for what they do. Meanwhile, for our own business records about you, we are the controller in our own right, and that is covered by our Privacy Policy instead.

If you host a site for one of your clients, the same pattern repeats: your client is the controller, you are their processor, and we are their sub-processor.

2. Parties and roles

This Agreement is made between:

• The Customer — the person or organisation named on the hosting account ("you"), acting as Controller; and
• BizeeInternet, a sole trader established in the United Kingdom, trading as Kangconoweb ("we", "us"), acting as Processor.

BizeeInternet (trading as Kangconoweb)
3 Parkfield Way
Bromley
Kent BR2 8AE
United Kingdom
Data protection contact: datacontroller@kangconoweb.com

It is entered into under Article 28(3) of the UK GDPR and applies to all personal data we process on your behalf in providing our services. In this Agreement, "UK GDPR", "controller", "processor", "personal data", "processing", "data subject" and "personal data breach" have the meanings given in the UK GDPR and the Data Protection Act 2018.

3. Subject matter, duration, nature and purpose

Item	Detail
Subject matter	The provision of shared web hosting, email, databases, domain and related services to you.
Duration	For as long as we provide services to you, plus the short wind-down period in section 13.
Nature of processing	Storage and hosting; transmission; backup and restoration; security scanning and filtering; logging; and technical administration necessary to keep the service working. We do not analyse the content of your data.
Purpose	Solely to provide and support the services you have bought from us, and to keep them secure and available.
Types of personal data	Whatever you choose to store or transmit. See Annex A.
Categories of data subject	Whoever your data relates to. See Annex A.

4. Processing only on your instructions

We will process personal data only on your documented instructions, including with regard to transfers outside the UK, unless we are required to do otherwise by law. Your instructions consist of this Agreement, our hosting terms, and the normal use of the service by you and your authorised users.

We will not:

• process your personal data for our own purposes;
• sell, rent or share it with anyone other than the sub-processors listed in section 7;
• use it to train machine learning or artificial intelligence systems; or
• access the content of your files, databases or mailboxes except where it is necessary to provide support you have asked for, to resolve a fault, to respond to a security incident, or where the law requires it.

If we are legally required to process your data in a way that goes beyond your instructions, we will tell you before doing so unless the law prohibits that notification. If we believe one of your instructions would breach data protection law, we will tell you promptly and may suspend that instruction until the point is resolved.

5. Confidentiality

Access to your personal data is restricted to those who need it to deliver the service. In practice that means the business owner. Anyone we authorise is bound by a duty of confidentiality that survives the end of their engagement, and is given access only to what their task requires.

6. Security measures

We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as required by Article 32 of the UK GDPR. The measures in place are listed in Annex B. We keep them under review and may improve or replace them, provided the overall level of protection is not reduced.

7. Sub-processors

You give us general written authorisation to engage sub-processors. We will impose on each of them, by written contract, data protection obligations no less protective than those in this Agreement — and if a sub-processor fails to meet them, we remain fully liable to you.

Our current sub-processors are:

Sub-processor	Purpose	Location of processing
IONOS Cloud Limited	Server infrastructure and data centre hosting	United Kingdom, or another contracting state of the European Economic Area, unless a transfer to a third country becomes necessary to provide the service. ISO 27001 certified.
CloudLinux Software Inc.	Server security, malware scanning and website performance optimisation (Imunify360, AccelerateWP)	EEA / United States, under appropriate transfer safeguards

We will give you at least 30 days' notice by email before adding or replacing a sub-processor. If you reasonably object on data protection grounds, tell us within that period and we will work with you to find an alternative; if we cannot, you may terminate the affected service without penalty and receive a pro-rata refund of fees paid in advance.

Note that a payment provider used to collect your fees is not a sub-processor under this Agreement, because for your billing data we are the controller rather than your processor. That is covered in our Privacy Policy.

8. International transfers

Your hosted data is stored on servers in London, United Kingdom.

We will not transfer your personal data outside the United Kingdom unless one of the following applies: the destination is covered by UK adequacy regulations; an International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses is in place, supported by a transfer risk assessment; or another lawful transfer mechanism under Chapter V of the UK GDPR applies.

Our infrastructure provider has confirmed to us in writing that processing takes place in the United Kingdom or in another contracting state of the European Economic Area, unless the transfer of data to third countries becomes necessary in order to provide the service.

9. Helping you answer data subject requests

You are responsible for responding to requests from your data subjects. Because we do not interpret your data, we cannot identify whose it is — so we will not respond to such a request ourselves. If one reaches us, we will forward it to you promptly and tell the person to contact you.

We will give you reasonable assistance in meeting your obligations under Articles 12–23 of the UK GDPR, including by helping you locate, export, correct or delete data within your account. Where that help goes beyond the tools already available to you in your control panel and takes significant time, we may charge at our standard support rate, agreed with you in advance.

10. Personal data breaches

We will notify you without undue delay, and in any event within 24 hours, after becoming aware of a personal data breach affecting personal data we process for you. Our notification will include, as far as we are able:

• the nature of the breach, and the categories and approximate number of data subjects and records affected;
• the likely consequences;
• the measures we have taken or propose to take to address it and limit any adverse effects; and
• a contact point for further information.

Where we cannot provide everything at once, we will provide information in phases as it becomes available. We will assist you in meeting your own obligations to notify the Information Commissioner's Office under Article 33 and, where required, affected individuals under Article 34. Deciding whether to notify is your decision as controller, not ours.

We will not make any public statement about a breach that identifies you without consulting you first, unless required to do so by law.

11. DPIAs and prior consultation

On request, we will provide reasonable assistance with any data protection impact assessment, and with any prior consultation with the ICO, relating to your use of our services — limited to the information about our processing that is within our knowledge.

12. Information and audit rights

We will make available to you all information reasonably necessary to demonstrate our compliance with Article 28, and will allow for and contribute to audits and inspections.

In the first instance we will answer a written security questionnaire and provide any certifications or reports held by us or our sub-processors. If that is genuinely insufficient, you may audit us — or appoint an independent auditor who is not a competitor of ours — on reasonable written notice of at least 30 days, no more than once a year, during business hours, and without disrupting the service or compromising the confidentiality of other customers' data. Each party bears its own costs, unless the audit finds a material breach by us, in which case we bear ours.

An additional audit may be carried out, without waiting for the annual cycle, following a notifiable personal data breach affecting your data, or if we cease to hold a relevant security certification.

13. Deletion and return at the end

On termination or expiry of the services, and at your choice, we will delete or return the personal data we process for you.

• You may download your own data at any time while the account is active. We recommend you do so before the account closes.
• We retain live data for 14 days after termination so that an account closed in error, or for non-payment, can be reinstated. Tell us during that window if you want it deleted sooner, or want a copy supplied.
• After that window we delete the live data.
• Data in rolling backups is overwritten on the normal backup cycle, usually within 30 days. It is not accessed or used for any other purpose in the meantime.
• If you ask us to compile and supply an export after the account has closed, we may charge a reasonable fee for the work involved.

We may retain personal data to the extent, and for as long as, UK law requires — for example billing records kept for tax purposes, where we are the controller in any event. Anything so retained stays protected by this Agreement.

On written request we will confirm in writing that deletion has taken place.

14. Your obligations as controller

You confirm and agree that:

• you have a lawful basis for the personal data you store or transmit using our services, and you have given the required privacy information to your own data subjects;
• your instructions to us comply with data protection law;
• you are responsible for the security of your own application — keeping WordPress, themes, plugins and other software updated, using strong and unique passwords, and controlling who you grant access to;
• you are responsible for the accuracy, quality and legality of the data you provide;
• you will not use our shared hosting to process special category data under Article 9 (such as health, racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic, biometric, sex life or sexual orientation data), or criminal offence data under Article 10, or payment card data in scope of PCI DSS, without first agreeing it with us in writing — these may need measures beyond what a shared platform provides; and
• you will keep your own backups of anything you cannot afford to lose. Ours exist to recover the platform, and are not a substitute for yours.

15. Liability, precedence and governing law

This Agreement forms part of our hosting terms. Where there is a conflict between this Agreement and any other part of those terms on the subject of personal data, this Agreement prevails. Where there is a conflict between this Agreement and the UK GDPR, the UK GDPR prevails.

Each party's liability under this Agreement is subject to the limitations and exclusions of liability in our hosting terms, except that nothing in those terms limits either party's liability where the law does not allow it to be limited.

This Agreement is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

If any provision is found to be unenforceable, the rest continues in force.

Annex A — Details of the processing

A1. Categories of data subject

Determined by you. Typically this includes your customers, prospective customers and enquirers; your employees, contractors or volunteers; your website visitors and newsletter subscribers; your members, patients, pupils or service users; and your suppliers' staff.

A2. Types of personal data

Determined by you. Typically this includes names and contact details; postal and email addresses; telephone numbers; usernames and password hashes; order, enquiry, booking and correspondence records; the content of emails stored in mailboxes; IP addresses and web server log entries; uploaded files, documents and images; and anything else you choose to store in your websites, databases, mailboxes or file space.

A3. Special category and criminal offence data

Not processed, unless specifically agreed with us in writing in advance under section 14.

A4. Processing operations

Storage; hosting and making available over the internet; transmission, including sending and receiving email; backup and restoration; anti-virus, anti-spam and malware scanning; web application firewall filtering; logging and monitoring; caching and performance optimisation; deletion; and technical support at your request.

A5. Frequency and duration

Continuous, for the duration of the service, plus the wind-down period in section 13.

Annex B — Technical and organisational measures

The measures below are in place at the date of this Agreement.

Area	Measures
Tenant isolation	Each hosting account runs in its own virtualised file system (CageFS), so one account cannot read another account's files, processes or configuration. Per-account resource limits prevent one site from degrading others.
Encryption in transit	TLS certificates provided and renewed automatically for hosted sites. Encrypted protocols available for email (IMAPS, POP3S, SMTPS), file transfer (SFTP) and control panel access. Administrative access by SSH only.
Encryption at rest	Backups are stored on separate storage. Account passwords are stored only as salted hashes, never in plain text.
Access control	Administrative access limited to the business owner, using key-based authentication rather than passwords. Customer access limited to their own account. Access is logged.
Network security	Host-based firewall with default-deny inbound policy; automated brute-force detection and IP blocking; reputation-based blocklists; port-scan protection.
Malware and application security	Server-level malware scanning and a web application firewall, with automatic quarantine of detected threats and notification to the account holder.
Email security	Inbound spam and virus filtering; support for SPF, DKIM and DMARC; outbound rate limiting to contain a compromised account.
Patching	Operating system, control panel and PHP security updates applied promptly; kernel updates applied without reboot where supported.
Availability and resilience	Enterprise data centre infrastructure with redundant power and network; monitoring of service availability; regular automated backups held separately from the live server, with restore capability.
Logging and monitoring	Access, error, mail and security logs retained for the periods stated in our Privacy Policy, for incident investigation.
Secure disposal	Data deleted in accordance with section 13; storage media handled and decommissioned by the data centre operator under its own certified processes.
Organisational	Confidentiality obligations on anyone with access; written agreements with all sub-processors; a documented breach notification process; data protection by design when changing the platform.
Sub-processor assurance	Our infrastructure provider holds ISO 27001 certification and conducts regular checks on its own sub-processors.

How this is agreed

By ordering or continuing to use our services, you agree to this Data Processing Agreement, and it takes effect as a binding agreement between you as controller and us as processor. No signature is required.

If your organisation needs a signed copy, or needs this Agreement executed on your own paper, email datacontroller@kangconoweb.com and we will arrange it.