This Data Processing Addendum ("DPA") forms part of the Terms of Service ("Agreement") between PebbleHost ("PebbleHost", "Provider", "we", "us") and the customer identified in the applicable service order ("Customer", "you").
PebbleHost operates from Unit 41-N, Embley Business Units, 41 Warwick Road, Solihull, B92 7HS, United Kingdom.
This DPA applies automatically to services governed by the Agreement where PebbleHost processes personal data on behalf of the Customer.
It is intended to satisfy the applicable requirements of Article 28 of the UK General Data Protection Regulation ("UK GDPR") and, where applicable, the EU General Data Protection Regulation ("EU GDPR").
1.1. This DPA applies to the processing of personal data stored, transmitted or otherwise processed through PebbleHost's hosting services on behalf of the Customer ("Customer Personal Data").
1.2. Services covered include, where applicable:
1.3. The Customer acts as the Data Controller, or as a Data Processor acting on behalf of another controller, and PebbleHost acts as the Data Processor or Subprocessor, as applicable.
1.4. The Customer determines the purposes and essential means of processing Customer Personal Data and remains responsible for complying with applicable data protection laws, including establishing a lawful basis for processing.
1.5. Where the Customer acts as a processor for another controller, the Customer confirms that it has the necessary authority to appoint PebbleHost as a subprocessor and provide the instructions contemplated by this DPA.
1.6. PebbleHost acts as an independent Data Controller for personal data it processes for its own purposes, including account administration, billing, fraud prevention, security, legal compliance and customer relationship management. Such processing is governed by PebbleHost's Privacy Policy rather than this DPA.
1.7. The processing activities, categories of data and data subjects covered by this DPA are described in Schedule A.
2.1. PebbleHost shall process Customer Personal Data only on documented instructions from the Customer, unless otherwise required by applicable law.
2.2. The Agreement, this DPA, the Customer's service configuration and instructions submitted through authorised management interfaces or support channels constitute documented instructions.
2.3. Instructions include activities reasonably necessary to:
2.4. PebbleHost shall not use Customer Personal Data for unrelated purposes or independently determine the purposes of processing, except where it is acting as a controller under applicable law.
2.5. Where PebbleHost is required by law to process Customer Personal Data outside the Customer's instructions, PebbleHost shall inform the Customer before doing so, unless legally prohibited.
2.6. PebbleHost shall inform the Customer without undue delay if, in its opinion, a processing instruction infringes applicable data protection law.
2.7. PebbleHost may decline to carry out instructions that would breach applicable law or require processing outside the scope of the contracted services.
3.1. PebbleHost shall ensure that persons authorised to process Customer Personal Data are bound by appropriate confidentiality obligations or an applicable statutory duty of confidentiality.
3.2. PebbleHost shall implement appropriate technical and organisational security measures in accordance with Article 32 of the applicable GDPR.
3.3. Such measures shall take account of the nature, scope, context and purposes of processing, available technology, implementation costs and risks to individuals.
3.4. The measures described in Schedule B form part of this DPA and may be updated as technology and security requirements evolve, provided the overall level of protection remains appropriate.
3.5. The Customer acknowledges that hosting services provide infrastructure on which the Customer may install, configure and operate its own software and applications.
3.6. The Customer remains responsible for security measures within its control, including:
3.7. Nothing in this section reduces PebbleHost's own obligations under Article 32 or its responsibility for security measures within its control.
4.1. Taking into account the nature of the processing, PebbleHost shall provide appropriate technical and organisational assistance to enable the Customer to respond to requests from individuals exercising their rights under applicable data protection law.
4.2. Where possible, the Customer shall use available control panels, management interfaces and service functionality to access, retrieve, modify or delete Customer Personal Data.
4.3. Where additional assistance is required, the Customer may submit a request through PebbleHost's support channels.
4.4. Taking into account the nature of processing and information available to PebbleHost, PebbleHost shall reasonably assist the Customer with its obligations relating to:
4.5. Where PebbleHost receives a data subject request concerning Customer Personal Data for which the Customer is responsible, PebbleHost shall, where appropriate and legally permitted, refer the request to the Customer.
4.6. Requests requiring assistance beyond standard service functionality may be subject to reasonable, documented charges where legally permissible and agreed in advance. Such charges shall not prevent compliance with mandatory legal obligations.
5.1. PebbleHost shall notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data processed by PebbleHost.
5.2. Notification shall include information reasonably available to PebbleHost concerning:
5.3. Where complete information is not immediately available, PebbleHost may provide additional details as its investigation progresses.
5.4. PebbleHost shall take appropriate measures to contain, investigate and remediate personal data breaches affecting systems within its responsibility.
5.5. The Customer remains responsible for determining whether a breach requires notification to a supervisory authority or affected individuals, except where PebbleHost has an independent legal reporting obligation.
6.1. The Customer grants PebbleHost general written authorisation to engage subprocessors for the provision, maintenance and support of the Services.
6.2. Notifications may be provided through the Customer's registered email address or another agreed electronic notification method.
6.3. Objections must relate to reasonable data protection concerns and should be submitted through PebbleHost's designated support channels.
6.4. PebbleHost shall consider reasonable objections in good faith. Where an objection cannot reasonably be resolved, either party may terminate the affected service in accordance with the Agreement and applicable law.
6.5. PebbleHost shall remain liable to the Customer for the performance of its subprocessors' data protection obligations, as required by applicable law.
7.1. Customer Personal Data may be processed in locations associated with the Customer's selected hosting services and by authorised personnel or subprocessors where permitted under applicable data protection law.
7.2. PebbleHost shall process Customer Personal Data, including any international transfer, only in accordance with documented instructions and applicable legal requirements.
7.3. Where a restricted international transfer requires additional safeguards, PebbleHost shall ensure that an appropriate lawful transfer mechanism is in place.
7.4. Such mechanisms may include, as applicable:
7.5. Where additional transfer documentation is legally required, the relevant parties shall put the necessary arrangements in place before the restricted transfer takes place.
7.6. This DPA does not, by itself, constitute an International Data Transfer Agreement or Standard Contractual Clauses.
8.1. Customer Personal Data shall ordinarily be processed for the duration of the relevant hosting service, subject to documented instructions and applicable legal requirements.
8.2. Upon termination or expiry of the relevant service, PebbleHost shall delete Customer Personal Data, unless applicable law requires continued storage.
8.3. Customers may ordinarily retrieve their hosted data using the facilities provided with their services before termination. Where a separate return process is required, the parties shall arrange a reasonable method consistent with applicable law.
8.4. Following service cancellation, copies of Customer Personal Data may remain in backup systems for a maximum period of six (6) months from the cancellation date, where immediate deletion is not technically practicable and the retention is appropriate and justified.
8.5. Data retained in such backups shall be subject to appropriate access restrictions and security safeguards. It shall be placed beyond routine operational use pending deletion, except where processing is required by applicable law or is otherwise permitted under the Customer's documented instructions.
8.6. Any retained backup copies shall be deleted no later than six (6) months following service cancellation, unless continued retention is required by applicable law.
8.7. Where an earlier deletion request is received, PebbleHost shall implement deletion in accordance with Article 28(3)(g), taking account of the technical characteristics of backup systems and applicable legal requirements.
8.8. PebbleHost shall not retain Customer Personal Data indefinitely following service termination.
8.9. These provisions do not govern personal data independently processed by PebbleHost as a Data Controller, including legally required financial records, fraud prevention records and business administration information. Such information is subject to PebbleHost's Privacy Policy and applicable retention requirements.
9.1. PebbleHost shall make available to the Customer information necessary to demonstrate compliance with its obligations under Article 28.
9.2. PebbleHost shall allow for and contribute to audits and inspections conducted by the Customer or an appropriately appointed independent auditor, as required by applicable data protection law.
9.3. Where appropriate, PebbleHost may initially provide relevant policies, written responses, security documentation or other compliance evidence.
9.4. Audits shall be conducted subject to reasonable arrangements concerning advance notice, confidentiality, security, scope and operational disruption.
9.5. The Customer and its auditors shall not be entitled to access another customer's confidential information, systems or personal data.
9.6. Where an onsite or additional audit is reasonably necessary to meet Article 28 requirements, PebbleHost and the Customer shall coordinate an appropriate audit procedure that protects the security and confidentiality of PebbleHost's infrastructure and other customers.
9.7. Reasonable additional costs associated with extraordinary audit assistance may be recovered where legally permissible and agreed in advance, without restricting mandatory audit rights.
10.1. The Customer is responsible for ensuring that its collection and processing of personal data is lawful.
10.2. The Customer shall provide lawful and sufficiently clear processing instructions and shall not instruct PebbleHost to undertake unlawful processing.
10.3. The Customer is responsible for determining whether the selected hosting services and security features are suitable for the personal data it intends to process.
10.4. The Customer shall ensure that any personal data uploaded, stored or processed through the Services complies with applicable law and the Agreement.
10.5. Where the Customer processes sensitive or special category personal data, it remains responsible for identifying applicable legal requirements and ensuring suitable additional safeguards are in place.
10.6. PebbleHost is not responsible for determining the legality of individual customer applications, websites, databases, game servers or other Customer-controlled workloads, except to the extent required by applicable law.
11.1. This DPA supplements and forms part of the Agreement between the Customer and PebbleHost.
11.2. In the event of a conflict between this DPA and the Agreement concerning the processing of Customer Personal Data, this DPA shall prevail to the extent necessary to meet applicable data protection obligations.
11.3. Except where expressly modified by this DPA, the Agreement remains in full force and effect, including its provisions concerning service administration, acceptable use, suspension, termination, governing law and limitations of liability.
11.4. Nothing in this DPA excludes or limits liability where such exclusion or limitation is prohibited by applicable law.
11.5. Nothing in this DPA relieves either party of its direct statutory responsibilities under applicable data protection legislation.
11.6. This DPA does not require PebbleHost to accept individually negotiated amendments or provide services beyond those agreed under the applicable service contract.
11.7. This DPA shall remain applicable for as long as PebbleHost processes Customer Personal Data on behalf of the Customer, including any applicable post-termination processing.
Provision of hosting infrastructure and related management, storage, networking, technical support and backup services.
For the duration of the applicable hosting service and any lawful post-termination processing or deletion period.
Storage, transmission, retrieval, organisation, access, backup, restoration, deletion and other processing necessary to operate and maintain the Services.
Depending on the Customer's use of the Services, personal data may include:
Depending on the Customer's use of the Services:
The Customer retains responsibility for determining the purposes and lawful basis of processing and may issue lawful documented instructions, subject to the Agreement and applicable data protection legislation.
PebbleHost shall implement and maintain appropriate security measures according to the nature of the Services and associated risks.
These measures include, where relevant to the service:
The measures applicable to a particular service may vary according to its configuration and service model. This Schedule does not create a guarantee of uninterrupted availability or imply that every security feature is included with every hosting product.
PebbleHost
Unit 41-N, Embley Business Units
41 Warwick Road
Solihull, B92 7HS
United Kingdom
Email: support@pebblehost.com
Website: https://pebblehost.com