Data Processing Addendum
Last updated 15 October 2026
This Data Processing Addendum ("DPA") applies when you, our customer, store or process personal data on serverserv services, such as websites, databases, mailboxes, applications, AI agents and workflows. It meets Article 28 of the EU and UK GDPR and similar laws. It forms part of our Terms of Service and applies automatically to every customer; no signature is needed. Personal data we use to run your account, such as your billing details, is covered by our Privacy Policy instead.
1. Roles
For personal data you store on our services ("Customer Data"), you are the controller (or a processor acting for your own client) and serverserv is your processor (or sub-processor). serverserv here means serverserv, Toronto, Ontario, Canada. Words such as "personal data", "processing" and "personal data breach" have the meanings given in the GDPR.
2. Details of the processing
| Item | Details |
|---|---|
| Subject matter and purpose | Hosting, storing, transmitting and backing up (where a plan includes backups) Customer Data to provide the services you order, and giving support you request |
| Duration | The term of your services, plus the deletion period in section 10 |
| Nature of processing | Storage, transmission, network routing, and access by our staff only when needed for support, security or legal reasons |
| Data subjects | Decided by you; usually your users, customers, staff and contacts, and people whose email you send or receive |
| Categories of data | Decided by you; any personal data you store on the services. Do not store special-category data unless you have put suitable safeguards in place |
3. Your instructions
We process Customer Data only on your documented instructions. Your instructions are these Terms, this DPA, your use and configuration of the services, and support requests you send us. If the law requires us to process Customer Data in another way, we will tell you first unless the law forbids it. We will tell you if we believe an instruction breaks data protection law. You are responsible for having a lawful basis for the processing and for the instructions you give.
4. Confidentiality
Only staff who need access to provide the services can access Customer Data, and they are bound by confidentiality. If an authority asks us for Customer Data, we follow our Law Enforcement Guidelines: we require valid legal process, ask the authority to contact you directly where possible, and tell you unless the law forbids it.
5. Security
We protect the infrastructure we run with appropriate technical and organisational measures, including:
- physical security and access control at our data centres, provided by our North American data-centre providers;
- isolation between customers through KVM virtualisation on VPS products and account separation on shared hosting;
- encrypted connections to the client area and management systems, and two-factor authentication for client area accounts;
- staff access limited to people who need it, with individual accounts;
- security updates for the systems we manage;
- network protection, monitoring and logging;
- a process for handling incidents.
Security is shared. On unmanaged services (Linux KVM VPS, Windows RDP, OpenClaw and n8n servers), you control the operating system and software and are responsible for their security, access control, encryption and backups. On web hosting, business email and Managed VPS, we manage the platform and you remain responsible for your accounts, passwords, applications and content.
6. Sub-processors
- You authorise us to use the sub-processors listed on our sub-processors page.
- We bind each sub-processor by written contract to data protection duties at least as protective as this DPA, and remain responsible to you for its work.
- We give at least 30 days' notice before adding or replacing a sub-processor that processes Customer Data, by updating the sub-processors page and emailing customers who ask to be told.
- You can object on reasonable data protection grounds within that notice period. If we cannot address your objection, you can cancel the affected service and get a refund of prepaid fees for the time after cancellation.
7. Helping you
Taking into account the nature of the services, we help you to:
- answer requests from data subjects. Most Customer Data is under your direct control in the services; if we receive a request meant for you, we pass it to you and do not answer it ourselves;
- carry out data protection impact assessments and consult authorities, by giving you the information we reasonably can about the services;
- meet your security and breach notification duties.
8. Personal data breaches
If we become aware of a personal data breach affecting Customer Data, we will tell you without undue delay, and in any case within 72 hours. We will tell you what we know about the nature of the breach, the data and people likely affected, its likely consequences and the steps taken, and update you as we learn more. Telling you is not an admission of fault.
9. International transfers
Customer Data is stored in the data centre location of your service: North America. Where Customer Data from the EU or EEA is transferred to a country without an adequacy decision, the Standard Contractual Clauses adopted by the European Commission in Decision 2021/914 apply and are incorporated into this DPA by reference:
- Module 2 (controller to processor) where you are a controller, and Module 3 (processor to processor) where you are a processor;
- Clause 7 (docking) applies; under Clause 9, option 2 (general written authorisation) applies with the notice period in section 6; the optional wording in Clause 11 does not apply;
- Clauses 17 and 18: the law and courts of Ireland;
- Annexes I and II are completed by section 2 and section 5 of this DPA, and Annex III by the sub-processors page.
For data from the United Kingdom, the UK International Data Transfer Addendum to the Standard Contractual Clauses applies. For data from Switzerland, the Clauses apply with the changes the Swiss data protection authority requires. If the Clauses conflict with this DPA, the Clauses win.
10. Return and deletion
Before you cancel a service, download any Customer Data you want to keep; you can do this yourself at any time during the term. After a service ends, we delete its Customer Data within 14 days, unless the law requires us to keep it. Data in backups or logs, if any, is deleted as those are overwritten.
11. Audits and information
We make available the information reasonably needed to show that we meet this DPA, such as answers to security questionnaires. If that is not enough, or an authority requires it, you can audit our compliance once a year, at your own cost, with at least 30 days' written notice, during business hours, without access to other customers' data, and under a confidentiality agreement. Audits of our data-centre providers are carried out by relying on their own certifications and reports.
12. Liability and order of precedence
The limits of liability in our Terms of Service apply to this DPA, except where the law does not allow them. If this DPA conflicts with the Terms about personal data, this DPA wins. This DPA ends when we no longer process Customer Data for you.
Questions about this policy? Contact us or open a ticket in the client area.