Data Processing Terms
Version 1.0 – Published 3 November 2026. Applies to orders placed from that date, and to existing customers from 3 December 2026.
These Data Processing Terms ("DPA") apply when your Content includes personal data that SNG Hosting ("SNG", "we") processes on your behalf while providing the Services. They form part of the Terms of Service. For questions of data protection, this DPA prevails over the Terms of Service if the two conflict. Words defined in the Terms of Service have the same meaning here.
1. Roles
1.1For personal data contained in your Content, you are the controller and SNG is your processor. Where you act as a processor for your own customers, SNG is your sub-processor.
1.2For data we collect about you as our customer (account, billing, support), SNG is the controller, and the Privacy Policy applies instead of this DPA.
1.3You confirm that you have a lawful basis for the personal data in your Content, that you have given the information required by law to the people concerned, and that your instructions comply with applicable data protection law.
2. Description of the processing
2.1Subject matter and purpose: hosting, storing, transmitting, backing up and protecting your Content so that we can provide the Services you ordered, and giving the support you request.
2.2Nature of the processing: storage, transmission, network filtering, backup and restoration, technical maintenance and, where you ask for it, access by our staff for support.
2.3Categories of data subjects: decided by you; typically your website visitors, users, customers, employees, players and email correspondents.
2.4Types of personal data: decided by you; typically contact details, account data, messages, IP addresses, logs and any other data you store on the Services. You must not store special categories of personal data unless the Service is suitable for it and you apply appropriate safeguards.
2.5Duration: for as long as we provide the Service, and afterwards until deletion under section 9.
3. Instructions
3.1We process the personal data in your Content only on your documented instructions. Your instructions are the Terms of Service, this DPA, the configuration of your Service and your requests through the client area or support tickets.
3.2We may also process it where the law requires us to. In that case we inform you before processing, unless the law forbids it.
3.3If we believe an instruction breaches data protection law, we tell you, and we may suspend that instruction until you confirm or change it.
3.4We do not access, use, sell or disclose your Content for our own purposes.
4. Confidentiality
Everyone at SNG who can access your Content is bound by confidentiality and receives access only as far as needed for their tasks.
5. Security
5.1We maintain technical and organisational measures appropriate to the risk. Depending on the system concerned, they include measures such as:
- encryption of data in transit to our websites, client area and APIs;
- access control by role and least privilege, and strong authentication for staff access to our systems;
- logging and monitoring of our infrastructure;
- network protection, including DDoS filtering and firewalls;
- data centres with physical access control, operated by our infrastructure providers;
- regular security updates of the platform we manage;
- backups of our own systems for disaster recovery, as described in the Terms of Service.
5.2We may update these measures as long as the overall level of protection is not reduced.
5.3You are responsible for the security of everything you manage yourself, including the operating system, applications, passwords, user accounts and configuration inside your Service, and for your own backups.
6. Sub-processors
6.1You give us general authorisation to engage sub-processors. The categories we use are: data-centre and server providers, network, CDN and DDoS-protection providers, backup and storage providers, and email delivery providers.
6.2We impose on each sub-processor data protection obligations that are no less protective than this DPA, and we remain responsible to you for their performance.
6.3The current list of sub-processors is available on request to [email protected].
6.4We announce a new sub-processor by email or on this page at least 30 days before it starts processing your Content. If you object on reasonable data protection grounds, we will try to find a solution. If we cannot, you may terminate the affected Service before the change takes effect and receive a refund of the unused prepaid part.
7. International transfers
Your Content is stored in the data-centre location of your Service as shown when you order it. Where personal data is transferred to a country without an adequate level of protection, we use appropriate safeguards required by law, such as the standard contractual clauses of the European Commission.
8. Assistance
8.1Requests from data subjects: most data in your Content can be accessed, corrected, exported and deleted by you directly. If a data subject contacts us about your Content, we forward the request to you and do not answer it ourselves, unless the law requires us to.
8.2Other assistance: taking into account the nature of the processing and the information available to us, we give reasonable assistance with your obligations on security, data protection impact assessments and consultation of supervisory authorities. We may charge for assistance that requires substantial work.
8.3Personal data breaches: if we become aware of a personal data breach affecting your Content, we notify you without undue delay and, where possible, within 48 hours, by email to your account address. We give you the information we have about the breach and update it as we learn more, and we take reasonable steps to contain it.
9. Return and deletion
9.1You can export your Content at any time while the Service is active. Please export it before the Service ends.
9.2After the Service ends, we delete your Content as set out in the Terms of Service (after 14 days). Copies in our disaster-recovery backups are deleted when those backups are overwritten in the normal cycle.
9.3We keep data longer only where the law requires us to.
10. Audits and information
10.1On request, we give you the information reasonably necessary to demonstrate compliance with this DPA, such as descriptions of our security measures.
10.2If that information is not sufficient, or a supervisory authority requires it, you may audit our compliance once a year, at your own cost, with at least 30 days' written notice, during business hours, without disrupting our operations or other customers, and under confidentiality. The audit may be carried out by an independent auditor bound by confidentiality. Audits of our sub-processors' data centres are made through the information and reports they provide.
11. Liability
Each party's liability under this DPA is subject to the limitations in the Terms of Service, to the extent permitted by law.
12. Term
This DPA applies for as long as we process personal data on your behalf, and ends automatically when that processing ends.