Last Revised: 2026-08-18 08:41

DATA PROCESSING AGREEMENT - DPA

PREAMBLE & CONTRACTING PARTIES

This Data Processing Agreement (hereinafter the "DPA" or "Agreement") is entered into between:

The sole proprietorship under the trade name "Prootzos Online", having its registered address at 46 Karkavitsa Str., PC 27131, Pyrgos, Ilia, Greece, Tax ID (VAT) EL 047648274 (Tax Office of Pyrgos), Tel: +30 2621 121 373, Email: contact@prootzos.com, legally represented by Nikolaos Prountzos (hereinafter the "Provider" or "Data Processor"), operating strictly under a Remote-First operational model; and
The natural or legal person contracting with the Provider for hosting or infrastructure management services, identified via their account in the Client Area (hereinafter the "Client" or "Data Controller").

The Data Processor and the Data Controller are hereinafter collectively referred to as the "Parties" and individually as a "Party".

ARTICLE 1: SUBJECT MATTER, PURPOSE & DOCUMENT HIERARCHY

1.1. Subject Matter: This DPA governs the terms under which the Data Processor processes Personal Data on behalf of the Data Controller during the provision of Core Managed hosting and infrastructure services, in full compliance with Article 28 of the General Data Protection Regulation (Regulation EU 2016/679 - hereinafter "GDPR") and Greek Law 4624/2019.

1.2. Incorporation & Baseline Relationship: This DPA forms an integral part of the General Terms of Service (DOC-001). All capitalized terms used herein are strictly defined by the Common Definitions Registry (DOC-002).

1.3. Document Hierarchy: In the event of any conflict between the provisions of this DPA and any other document in the documentation library, this DPA shall prevail exclusively regarding third-party personal data processing matters. Commercial, pricing, and operational matters remain governed by the General Terms of Service (DOC-001) and the Billing Policy (DOC-011).

1.4. Processing of Subscriber Data (B2B/Account Data): The processing of personal data relating to the Client as a contracting party (such as account identification, billing records, and access logs) is governed exclusively by the Privacy Policy (DOC-005), under which the Provider acts as an independent Data Controller.

ARTICLE 2: DESCRIPTION & PARAMETERS OF PROCESSING

2.1. Nature and Purpose of Processing: Processing consists exclusively of providing technical infrastructure, data storage, execution of web/database/mail server daemons, and systems management via the Controller and underlying technologies (Proxmox, Debian Linux).

2.2. Types of Personal Data & Categories of Data Subjects:

Types of Data: Any data stored, uploaded, or transmitted by the Client and its end users within the allocated hosting resources (website files, MySQL/MariaDB/PostgreSQL databases, Postfix/Dovecot emails, web server access logs).
Categories of Data Subjects: End users, website visitors, subscribers, customers, or employees of the Data Controller.

2.3. No Content Monitoring: The Provider acts purely as a neutral technical conduit and infrastructure hosting provider. The Provider does not review, assess, classify, or modify data content stored within the Client's space, unless required by law or performed under an explicit instruction within the scope of Professional Services (DOC-009).

ARTICLE 3: OBLIGATIONS AND RIGHTS OF THE DATA CONTROLLER

3.1. Lawfulness of Processing: The Data Controller warrants that it possesses a valid legal basis (Articles 6 and/or 9 GDPR) for collecting and processing data hosted on the Provider’s infrastructure and has provided all required statutory notices to data subjects.

3.2. Technical Compliance of Applications & ePrivacy: The Client bears full and exclusive responsibility for the compliance of its web applications with the ePrivacy Directive and GDPR, and is obligated to implement a strict Prior Consent mechanism (Prior Consent / Strict Opt-in) without pre-checked boxes and with immediate revocation capabilities prior to triggering non-essential cookies or trackers. The Cookie Policy (DOC-006) and Google Consent Mode v2 apply strictly to the Provider's primary website and platforms.

3.3. Responsibility for vHost Options Directives: In Managed VM and Managed Dedicated Server environments where the vHost Options tab of the Controller is enabled, the Client bears exclusive responsibility for custom configuration directives (Apache, Nginx, PHP directives/php.ini). Any web server crash or security vulnerability resulting from syntax errors in custom directives is the sole liability of the Client and technical remediation is performed exclusively as a Billable Professional Service (DOC-009).

3.4. Acceptable Use Policy Compliance: The Client must ensure that all stored data and operational activities strictly comply with the Acceptable Use Policy (DOC-003).

ARTICLE 4: OBLIGATIONS OF THE DATA PROCESSOR

The Data Processor undertakes the following obligations:

4.1. Processing on Documented Instructions: The Data Processor processes Personal Data solely upon documented instructions from the Data Controller, as formulated in service orders, settings applied via the Controller, and support tickets submitted via the Client Area, unless required to do so by Union or Member State law. The Data Processor shall immediately inform the Data Controller if, in its opinion, an instruction infringes the GDPR or other Union or national data protection provisions.

4.2. Confidentiality Commitments: The Data Processor ensures that all personnel authorized to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

4.3. Implementation of Security Measures: The Data Processor implements and maintains appropriate technical and organizational security measures as detailed in Article 5 and DOC-012.

4.4. Assistance & DPIA Boundaries: The Data Processor assists the Data Controller via the built-in self-service capabilities of the Controller (log access, database export). Provider assistance regarding Data Protection Impact Assessments (DPIA - Articles 35/36 GDPR) is strictly limited to providing the standard technical security dossier (DOC-012). Bespoke risk assessments, analysis, or documentation drafting are provided exclusively as Billable Professional Services under an approved Statement of Work pursuant to DOC-009.

4.5. Deletion or Return of Data: Upon termination of services, the Data Processor deletes or returns all personal data to the Data Controller in accordance with Article 10 and the Backup Policy (DOC-010).

ARTICLE 5: TECHNICAL AND ORGANIZATIONAL MEASURES (TOMs)

The Data Processor implements a layered security architecture in compliance with DOC-012, encompassing at minimum:

+-----------------------------------------------------------------------+
|             TECHNICAL & ORGANIZATIONAL MEASURES LAYERS                |
+-----------------------------------------------------------------------+
| L1: Datacenter Level   -> Physical security, DDoS mitigation, ISO 27001|
| L2: Hypervisor Level   -> Proxmox VE isolation, Resource Sandboxing   |
| L3: OS / Service Level -> cgroups v2, ufw, fail2ban, Rspamd, TLS      |
| L4: Storage & Backup   -> Chrooted/Jailed Access, Offsite Snapshots   |
+-----------------------------------------------------------------------+

5.1. Resource Isolation & Multi-Tenancy:

Enforcement of cgroups v2 at the Linux kernel level across all Shared Hosting environments to isolate computing resources (CPU, RAM, Disk I/O, Nproc) and eliminate the Noisy Neighbor effect.
File system isolation via chrooted FTP and jailed sFTP environments (/var/www/clients/clientX/webY). Full root access and execution of unauthorized system-level binaries or cron scripts are strictly prohibited.

5.2. Network Security & Perimeter Defense:

Multi-layer Firewall: L1 (Datacenter Edge), L2 (Proxmox Firewall), L3 (Fail2ban dynamic blocking), and L4 (Host ufw).
Email filtering via Rspamd (anti-spam, anti-virus, SPF/DKIM validation, Greylisting) with policy management per domain/mailbox strictly through predefined Controller UI selections.

5.3. Encryption & In-Transit Security:

Automated SSL/TLS issuance (Let's Encrypt) via the Controller. This relies on successful HTTP-01 ACME validation and requires prior correct DNS A/AAAA record routing to the server IP. Validation failures resulting from external DNS misconfigurations do not constitute an infrastructure fault.
Encrypted access across all management interfaces (HTTPS for Client Area and Controller) and data protocols (FTPS, sFTP, IMAPS, POP3S, SMTPS).

5.4. Database Security:

Relational databases (MariaDB/PostgreSQL) run with strict non-privileged user accounts (no SUPER or GRANT OPTION privileges). Direct external remote DB access is prohibited without an encrypted tunnel (SSL/SSH).

5.5. Monitoring & Log Minimization:

Centralized logging and system monitoring via Monit and Graylog.
System and access logs (Web/Mail/Firewall logs) are subject to automated Log Rotation and are retained for the minimum duration required for security baseline verification and fault diagnosis under DOC-012.

ARTICLE 6: SUB-PROCESSORS

6.1. General Authorization: The Data Controller grants general written authorization to the Data Processor to engage third-party sub-processors to carry out specific processing activities.

6.2. Categories of Authorized Sub-processors:

Data Center Infrastructure Providers: Facility hosting, physical security, power redundancy, hardware provisioning, and network connectivity (within the European Economic Area - EEA).
Domain Name Registries & Registrars: DNS record management and domain lifecycle processing (e.g., Openprovider, EETT, ICANN) under DOC-008.
Commercial SSL Certificate Authorities: Issuance and validation of commercial SSL/TLS certificates.

6.3. Contractual Sub-processor Obligations: The Data Processor imposes the same data protection obligations on its sub-processors as set out in this DPA via legally binding contracts.

6.4. Notification of Changes, Emergency Replacements & Commercial Terms:

The Data Processor maintains an updated registry of sub-processors in the Client Area and provides notice of planned additions or replacements via announcements or changelogs at least fourteen (14) days in advance.
In emergency situations (e.g., sudden datacenter outage or critical security compromise), replacements are executed immediately to maintain business continuity, with notice provided post-event within forty-eight (48) hours.
The Data Controller may object in writing on substantiated data protection grounds. If unresolved, the Client may terminate the affected service, with any prepaid recurring amounts credited exclusively as Account Credits under DOC-011. One-time Setup Fees for Managed VPS and Dedicated Servers are strictly non-refundable and non-creditable.

6.5. Cross-Border Data Transfers: All primary hosting and storage nodes are located strictly within the EEA. No transfers outside the EEA shall occur without prior explicit approval from the Client and the implementation of appropriate safeguards (Articles 44–49 GDPR).

ARTICLE 7: DATA SUBJECT RIGHTS, QUOTAS & PRORATED BILLING

7.1. Handling Data Subject Requests: The Data Controller is solely responsible for responding to requests from data subjects exercising their statutory rights (access, rectification, erasure, portability, objection).

7.2. Technical Facilitation, Quotas & Prorated Billing:

The Data Processor provides self-service capabilities via the Controller (phpMyAdmin, sFTP, database management, mailboxes, and user backup generation). User-generated backups consume disk space from the allocated hosting package Storage Quota.
If storage or computing requirements exceed the allocated tier limits, package Upgrades must be initiated via the Client Area, calculated on a Prorated Billing basis for the remainder of the current billing cycle pursuant to DOC-011.
Restorations from central Disaster Recovery storage are governed strictly by DOC-010 and do not constitute a self-service function.

7.3. Direct Inquiries to the Processor: If a data subject contacts the Data Processor directly, the Data Processor shall refer the subject to the Data Controller without altering or disclosing data.

7.4. Specialized Technical Assistance (Billable): Bespoke backend data extraction, analysis, or structural database purging requested by the Client is executed exclusively as a Billable Professional Service (DOC-009).

ARTICLE 8: SECURITY INCIDENT MANAGEMENT, NIS2 & SUSPENSION PROTOCOLS

8.1. Significant Incident Notification Timelines (NIS2 Baseline): The following timeline applies strictly to Significant Security Incidents affecting the availability, confidentiality, or integrity of the Provider's core infrastructure, virtualization layers, or network backbones:

Milestone	Operational Stage	Notification Content
$T_0$	Incident Detection	Anomaly logged via Firewalls L1-L4, Graylog alerts, Monit triggers, or verified abuse reports.
$T_0 + 24\text{ hours}$	Early Warning	Initial notification to the Client via Ticket/Email detailing event nature and potential impact.
$T_0 + 72\text{ hours}$	Incident Notification	Detailed assessment, estimated impact, affected scopes, and applied mitigation measures.
$T_0 + 1\text{ month}$	Final RCA Report	Comprehensive Root Cause Analysis (RCA) report and permanent corrective measures.

Isolated CMS or application compromises within a customer's sandboxed user space (chrooted/cgroups) are handled via standard Ticket support and the immediate isolation protocol (DOC-003).

8.2. Distinction of Suspension Mechanisms:

(a) Technical Abuse Quarantine (Abuse Quarantine / Suspension): Executed immediately at the network/system layer (Firewall L1-L4, Null-route, Controller lock) without prior notice in cases of Outbound DDoS, bulk spamming, phishing, or malware distribution (DOC-003, DOC-012). Restoration occurs only after full threat removal by the Client or via commissioned Professional Services (DOC-009).
(b) Commercial Suspension (Billing Suspension): Executed automatically via the Client Area API solely due to overdue invoices following the expiration of designated grace periods (DOC-011).

ARTICLE 9: COMPLIANCE REVIEWS AND AUDITS

9.1. Provision of Compliance Evidence: The provision of standard compliance certificates (ISO/IEC 27001) and the Infrastructure Security Baseline (DOC-012) is made available to the Client free of charge.

9.2. Dedicated Audit Procedure:

The Client must provide at least thirty (30) calendar days prior written notice.
Audits must take place during normal business hours, conducted by an independent certified auditor under a strict Non-Disclosure Agreement (NDA).
Multi-Tenant Protection: Audits must strictly avoid compromising or accessing data belonging to other hosted clients.
Engineering Costs: Where an on-site audit or bespoke technical accompaniment by Provider engineers is required, dedicated engineering hours are billed as Professional Services (DOC-009).

ARTICLE 10: DURATION, DELETION AND DATA PURGING

10.1. Term: This DPA remains in full force for the duration of the Master Agreement (DOC-001) and until all hosted data has been permanently deleted.

10.2. Automated Purging & Retention Policies:

Upon contract termination and expiration of grace periods (DOC-010), hosting data is permanently deleted from the Controller.
Account records, ticket histories, and system logs in the Client Area are subject to automated data retention and anonymization workflows (Client Area Data Retention Automation), excluding statutory tax records.
Any Client request for extended data retention beyond standard limits (Legal Hold / Audit Retention) requires prior subscription to a billable storage retention add-on pursuant to DOC-010.

10.3. Data Export Responsibility: The Client is strictly responsible for exporting all required data via the Controller before the final service expiration date.

ARTICLE 11: LIABILITY AND ANTI-SCOPE CREEP BOUNDARIES

11.1. Scope of Processor Liability: The Data Processor is liable solely for direct damages arising from proven breaches of GDPR provisions specifically addressed to data processors. Aggregate liability is capped strictly pursuant to DOC-001.

11.2. Limitation of Liability for Client Actions: The Data Processor bears no liability for breaches resulting from:

Application-level vulnerabilities, outdated CMS installations, or compromised third-party plugins.
Compromise or mishandling of access credentials (FTP, SSH, Controller, Email) by the Client.
External DNS misconfigurations or ACME validation failures outside the Provider's network.
Syntax errors or misconfigurations within the vHost Options tab by the Client.

11.3. Professional Services Demarcation: Forensics investigation, malware removal, or web server crash recovery following directive syntax errors are outside Core Managed Services and are performed strictly as Billable Professional Services (DOC-009).

ARTICLE 12: FINAL PROVISIONS, GOVERNING LAW & JURISDICTION

12.1. Amendments: Material amendments to this DPA are communicated with thirty (30) days prior notice via the Client Area pursuant to DOC-001.

12.2. Severability: If any provision of this DPA is held invalid, the validity of the remaining provisions shall not be affected.

12.3. Governing Law & Jurisdiction: This DPA is governed by Greek Law and the GDPR. The courts of Pyrgos, Ilia, Greece have exclusive jurisdiction.

12.4. Electronic Execution: Acceptance of service terms during registration or ordering within the Client Area constitutes valid, binding electronic execution of this DPA.

ANNEX A: DESCRIPTION OF PROCESSING

Duration: For the duration of service delivery plus backup retention periods under DOC-010.
Purpose: Website hosting, database storage, email routing/storage, and infrastructure management.
Categories of Data Subjects: Visitors/users of Client applications, email account owners, Client personnel.
Data Types: Identity records, contact details, email message bodies/headers, IP addresses, connection logs, application transaction records.
Special Categories of Data (Art. 9 GDPR): The Provider does not intentionally process sensitive data. Storing sensitive data remains the sole responsibility of the Client, who must apply application-level encryption.

ANNEX B: CATEGORIES OF AUTHORIZED SUB-PROCESSORS

Sub-processor Category	Processing Scope	Location	Legal Safeguards
Data Center Infrastructure Providers	Physical hosting, power redundancy, hardware, network connectivity, DDoS mitigation.	Within EEA (Germany / Finland / Greece)	Art. 28 GDPR DPA, ISO/IEC 27001
Domain Name Registries & Registrars	Domain lifecycle processing (DNS routing, WHOIS compliance).	Within EEA / ICANN / EETT Accredited	EETT Regulations, ICANN Data Protection Clauses
Commercial SSL Certificate Authorities	Issuance and validation of commercial SSL/TLS security certificates.	Within EEA / Global CA Roots	CA/B Forum Baseline Requirements, DPA