Effective Date: 11.11.2026
This Data Processing Agreement (“DPA”) forms part of the Terms and Conditions concluded between INTERKVM HOST SRL (hereinafter “ZetServers” or the “Processor”) and its client (the “Customer” or the “Controller”). It applies whenever ZetServers processes personal data on behalf of the Customer in the course of providing the services, and it sets out the terms required by Article 28(3) of Regulation (EU) 2016/679 (GDPR).
Terms such as “personal data”, “processing”, “controller”, “processor”, “sub-processor”, “data subject” and “personal data breach” have the meaning given to them in the GDPR. “Customer Data” means the personal data that the Customer, or its own users, uploads, stores, transmits or otherwise processes using the services. “Terms and Conditions” means the ZetServers Terms of Service.
2.1. The subject matter of the processing is the provision of the hosting and infrastructure services ordered by the Customer, as described in the Terms and Conditions.
2.2. The processing lasts for as long as the services are provided and, after that, until the Customer Data is deleted in accordance with section 10 of this DPA.
3.1. ZetServers stores and hosts Customer Data on its infrastructure and transmits it over its network, only to the extent necessary to provide the services ordered by the Customer.
3.2. ZetServers does not access, analyze or use the content of Customer Data, except where this is necessary to:
4.1. The types of personal data and the categories of data subjects are determined solely by the Customer, through what it chooses to store and process using the services. They may include, for example, identification and contact data, account data, the content of communications and technical data relating to the Customer’s own clients, employees, website visitors or other users.
4.2. ZetServers has no knowledge of the Customer Data it hosts. Where the Customer processes special categories of personal data (Article 9 GDPR) or data relating to criminal convictions and offences (Article 10 GDPR), the Customer is responsible for implementing the additional measures required, such as encryption.
The Customer, as Controller:
6.1. Instructions. ZetServers processes Customer Data only on the documented instructions of the Customer, including with regard to transfers to third countries, unless required to do so by Union or Member State law; in that case, ZetServers informs the Customer of that legal requirement before processing, unless the law prohibits such information. The Terms and Conditions, this DPA, and the Customer’s configuration and use of the services constitute the Customer’s documented instructions. ZetServers immediately informs the Customer if, in its opinion, an instruction infringes the GDPR or other data protection provisions.
6.2. Confidentiality. ZetServers ensures that persons authorized to process Customer Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
6.3. Security. ZetServers implements the technical and organizational measures required by Article 32 GDPR, described in section 13 of this DPA.
6.4. Data subject requests. Taking into account the nature of the processing, ZetServers assists the Customer, by appropriate technical and organizational measures and insofar as this is possible, in responding to requests from data subjects to exercise their rights. As the Customer has direct access to Customer Data through the services, it is generally able to respond to such requests itself. If ZetServers receives a request directly from a data subject concerning Customer Data, it forwards the request to the Customer without undue delay and does not respond to it itself.
6.5. Other assistance. ZetServers assists the Customer in ensuring compliance with Articles 32 to 36 GDPR (security of processing, notification of personal data breaches, data protection impact assessments and prior consultation), taking into account the nature of the processing and the information available to ZetServers.
6.6. Records. ZetServers keeps a record of the categories of processing activities carried out on behalf of its customers, in accordance with Article 30(2) GDPR.
7.1. The Customer gives ZetServers a general written authorization to engage sub-processors, such as data center operators and network and infrastructure providers, where this is necessary to provide the services. The current list of sub-processors is available on request at [email protected].
7.2. ZetServers informs the Customer of any intended addition or replacement of a sub-processor at least 15 days in advance, by e-mail or by a notice on the Website. The Customer may object to the change, on reasonable grounds relating to data protection, within that period. If the parties cannot resolve the objection, the Customer may terminate the affected service before the change takes effect.
7.3. ZetServers imposes on each sub-processor, by contract, the same data protection obligations as those set out in this DPA, in particular sufficient guarantees to implement appropriate technical and organizational measures. ZetServers remains fully liable to the Customer for the performance of each sub-processor’s obligations.
8.1. Customer Data is stored in the data center location chosen by the Customer when ordering the service. ZetServers does not move Customer Data to another location without the Customer’s instruction.
8.2. Where the Customer chooses a location outside the European Economic Area (EEA), or where a transfer is otherwise necessary to provide the services, ZetServers ensures that the transfer complies with Chapter V GDPR, for example on the basis of an adequacy decision of the European Commission or of the Standard Contractual Clauses adopted by the European Commission.
9.1. ZetServers notifies the Customer without undue delay, and where feasible within 48 hours, after becoming aware of a personal data breach affecting Customer Data on the infrastructure under its control.
9.2. The notification describes, to the extent the information is available: the nature of the breach, including where possible the categories and approximate number of data subjects and records concerned; the likely consequences; and the measures taken or proposed to address the breach and mitigate its effects. Where not all information is available at once, it is provided in phases without undue further delay.
9.3. ZetServers is not responsible for breaches of operating systems, applications or accounts that the Customer manages itself, but assists the Customer as set out in 6.5.
10.1. The Customer can retrieve Customer Data at any time while the services are active. It is the Customer’s responsibility to retrieve the data before the services end, are cancelled or expire.
10.2. After the services end, ZetServers deletes the Customer Data in accordance with section 10 of the Terms and Conditions, unless Union or Member State law requires it to be stored. Storage media that held Customer Data are securely wiped before being assigned to another client, or physically destroyed.
11.1. ZetServers makes available to the Customer all information necessary to demonstrate compliance with Article 28 GDPR and this DPA.
11.2. ZetServers allows for and contributes to audits, including inspections, conducted by the Customer or by an independent auditor mandated by the Customer and bound by confidentiality, under the following conditions:
11.3. ZetServers may first answer the request by providing documentation; an on-site inspection takes place only if that documentation is not sufficient to demonstrate compliance.
12.1. The liability of each party under this DPA is governed by section 13 of the Terms and Conditions, without prejudice to Article 82 GDPR.
12.2. In the event of a conflict between this DPA and the Terms and Conditions regarding the protection of personal data, this DPA prevails.
12.3. This DPA is governed by Romanian law. It remains in force for as long as ZetServers processes Customer Data on behalf of the Customer, and it may be amended in accordance with section 5 of the Terms and Conditions.
ZetServers implements the following measures, as applicable to the service ordered:
For unmanaged services, the Customer remains responsible for securing its own operating systems and applications, for encrypting Customer Data where appropriate and for keeping its own backups.
Hosting since 2010 · operating entity