Data Processing Agreement

Introduction

This Data Processing Agreement ("DPA") forms part of the Terms of Service between SUZKO, LLC ("Processor," "we," "us," or "our") and the customer ("Controller," "you," or "your") and governs the processing of personal data by us on your behalf.

This Data Processing Agreement is incorporated into and forms part of our Terms of Service, and your use of SUZKO services is governed by both. Where this document addresses a specific subject, it controls over the Terms of Service to the extent of any conflict on that subject.

This DPA applies where we process personal data on behalf of our customers in connection with the provision of our hosting services and is designed to meet the requirements of the EU General Data Protection Regulation (GDPR), UK GDPR, and other applicable data protection laws.

1. Definitions

• "Personal Data" means any information relating to an identified or identifiable natural person.
• "Processing" means any operation performed on personal data, including collection, storage, modification, transmission, and deletion.
• "Data Subject" means the individual to whom the personal data relates.
• "Sub-processor" means any third party engaged by us to process personal data on your behalf.
• "Data Protection Laws" means all applicable laws relating to data protection and privacy, including GDPR, UK GDPR, CCPA, and other relevant regulations.

2. Scope and Purpose of Processing

2.1 Subject Matter

We will process personal data only as necessary to provide the hosting services you have purchased, including:

• Web hosting and server infrastructure
• Data storage and backup services
• Email hosting and delivery
• Database hosting
• Technical support services

2.2 Duration

Processing will continue for the duration of your service agreement with us, plus any retention period required by law or as specified in our Privacy Policy.

2.3 Types of Personal Data

The types of personal data processed depend on your use of our services and may include:

• Names and contact information
• Account credentials
• Email addresses and communications
• IP addresses and access logs
• Any personal data you or your end users store on our servers

2.4 Categories of Data Subjects

Data subjects may include:

• Your customers and end users
• Your employees and contractors
• Visitors to your websites
• Any individuals whose data you process using our services

3. Obligations of the Processor

3.1 Processing Instructions

We will:

• Process personal data only on your documented instructions, unless required by law
• Inform you if we believe an instruction infringes data protection laws
• Not process personal data for any purpose other than providing the services

3.2 Confidentiality

We will:

• Ensure that persons authorized to process personal data have committed to confidentiality
• Limit access to personal data to personnel who need access to perform the services

3.3 Security Measures

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
• Regular security assessments and penetration testing
• Access controls and authentication mechanisms
• DDoS protection and network security
• Physical security of data centers
• Employee security training
• Incident response procedures

3.4 Sub-processors

You authorize us to engage sub-processors to assist in providing the services. We will:

• Maintain a list of sub-processors at suzko.com/legal/subprocessors
• Notify you of any intended changes to sub-processors, giving you an opportunity to object
• Ensure sub-processors are bound by data protection obligations no less protective than this DPA
• Remain liable for the acts and omissions of our sub-processors

3.5 Data Subject Rights

We will assist you in responding to data subject requests, including:

• Access to personal data
• Rectification of inaccurate data
• Erasure ("right to be forgotten")
• Restriction of processing
• Data portability
• Objection to processing

3.6 Data Breach Notification

In the event of a personal data breach, we will notify you without undue delay (and in any event within 72 hours) after becoming aware of the breach. The notification will include:

• Description of the nature of the breach
• Categories and approximate number of data subjects affected
• Likely consequences of the breach
• Measures taken or proposed to address the breach

3.7 Data Protection Impact Assessments

We will assist you with data protection impact assessments and prior consultations with supervisory authorities, where required.

3.8 Deletion and Return of Data

Upon termination of services or upon your request, we will, at your choice:

• Return all personal data to you in a commonly used format
• Delete all personal data (unless retention is required by law)

Deletion will be completed within 30 days of termination or request, except for data in backup systems which will be deleted in accordance with our backup retention schedule.

4. Obligations of the Controller

You represent and warrant that:

• You have a lawful basis for collecting and processing personal data
• You have provided appropriate notices to data subjects regarding our processing
• Your processing instructions comply with data protection laws
• You will obtain any necessary consents from data subjects where required

5. International Data Transfers

Personal data may be transferred to and processed in the United States. For transfers from the European Economic Area, United Kingdom, or Switzerland, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Supplementary measures where necessary

The Standard Contractual Clauses are incorporated into this DPA by reference and are available upon request.

6. Audits and Compliance

We will:

• Make available all information necessary to demonstrate compliance with this DPA
• Allow for and contribute to audits, including inspections, by you or an auditor mandated by you (with reasonable notice and during normal business hours)
• Provide attestations of compliance upon request

7. Liability

Each party's liability under this DPA is subject to the limitations set forth in the Terms of Service, except that limitations shall not apply to breaches of data protection obligations to the extent prohibited by law.

8. Term and Termination

This DPA shall remain in effect for the duration of your service agreement with us. The provisions regarding confidentiality, data deletion, and liability shall survive termination.

9. Amendments

We may update this DPA to reflect changes in data protection laws or our practices. Material changes will be communicated to you with at least 30 days' notice.

10. CCPA Service Provider

To the extent we process personal information subject to the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), on your behalf, we act as a "service provider" as that term is defined under the CCPA/CPRA, and you are the business. With respect to such personal information, we will:

• Not sell or share personal information within the meaning of the CCPA/CPRA;
• Not retain, use, or disclose personal information for any purpose other than the specific business purpose of performing the services under our agreement, or as otherwise permitted by the CCPA/CPRA;
• Not retain, use, or disclose personal information outside the direct business relationship between you and us;
• Not combine personal information we receive from you with personal information we receive from, or on behalf of, another party, except as permitted by the CCPA/CPRA; and
• Notify you if we determine that we can no longer meet our obligations under the CCPA/CPRA.

We certify that we understand the restrictions set out in this section and will comply with them. You have the right to take reasonable and appropriate steps to help ensure that we use personal information in a manner consistent with your obligations under the CCPA/CPRA, and to remediate any unauthorized use.

11. Governing Law

This DPA is governed by and construed in accordance with the laws of the State of Indiana, United States, without regard to its conflict of law principles, except that where the GDPR, UK GDPR, or other applicable data protection law mandates the application of a particular law or forum for a given matter, that mandatory law will apply to that matter. Any disputes arising from this DPA are subject to the same jurisdiction and venue provisions as the Terms of Service, subject to those mandatory requirements.

12. Order of Precedence

This DPA supplements the Terms of Service. In the event of any conflict or inconsistency between this DPA and the Terms of Service on matters relating to data protection or the processing of personal data, this DPA prevails and controls to the extent of that conflict. On all other matters, the Terms of Service continue to govern. Where the Standard Contractual Clauses referenced in this DPA apply, those clauses prevail over both this DPA and the Terms of Service to the extent of any conflict.

Contact Information

For questions about this DPA or to exercise your rights, please contact our Data Protection Officer at:

Last updated: July 16, 2026