The new EU General Data Protection Regulation (GDPR) comes into force on 25th May 2018 and will impact every organisation which processes personal data of EU citizens. It introduces new responsibilities, empowers businesses to be accountable for their processing of personal data as well as enabling EU citizens to protect their privacy and control the way their data is processed. Even though the UK will be leaving the EU, the GDPR still applies and will replace the UK’s Data Protection Act 1998 when it comes into force.
Personal data is any information that relates to a living individual. It also includes any data that can be used with other sets of data to identify an individual. Typical examples of personal data are: name, identification number, location data, online identifier, email address, etc.
Processing relates to any operation carried out on personal data including collection, recording, organising, structuring, storing, using, etc. Processing also doesn’t have to be by automated means which means that processing includes paper-based, non-digital systems.
A Data Subject is the individual whose personal data is being processed
A Data Controller is the organisation which determines how personal data is processed
A Data Processor is an organisation which processes data on behalf of a Controller. This typically means a third party who is used by the Controller to process their data (e.g. a marketing company used to send out marketing materials)
For detailed information about the GDPR and data protection, visit the Information Commissioner’s Office website: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/
Your GDPR responsibilities
When you use our services to store or process your personal data (including customer’s or user’s data), you are the Data Controller and we are a Data Processor. This will be true for any personal data you place on our servers either directly, via a hosted website or by use of any of our other services.
The GDPR requires you, as a Data Controller, to ensure that any Data Processor services you use to process personal data are GDPR compliant. This means that when you use any of our services to process your personal data you need to carry out due diligence on our services and ensure certain contractual terms are in place.
This GDPR statement is our way of helping you meet these GDPR regulatory requirements and to offer you assurance that we take GDPR and the security of your personal data as part of the everyday running of our services.
Our GDPR commitment
As a UK company, EZPZ Hosting are committed to ensuring our business, services and internal processes are GDPR compliant. As such, this GDPR Statement provides our assurances to GDPR compliance.
By the GDPR implementation deadline, we will have put in place:
- Employee data protection training to ensure all staff understand their role in data protection compliance
- Updated internal policies relating to data protection and responsibilities within our businesses for ongoing GDPR compliance
- Check all our systems, processes and services to ensure they meet the requirements of GDPR, particularly around security of data and our use of any external third party services
- Processes to ensure ongoing compliance past the GDPR deadline
- Updated terms and conditions of services that meet the contractual requirements of GDPR in the Data Controller – Data Processor relationship
Our services are compliant because:
- We have fully assessed our own GDPR compliance both in terms of the services we offer to our customers and in terms of our own internal policies and procedures
- We have appropriate technical and personnel protocols in place to ensure the security of your data
- We carry out due diligence against any sub-processors or other third party processors we use to ensure their GDPR compliance (such as data centres)
- We only allow specific members of staff access to our servers and what access that is available, is limited to specific circumstances
- We do not transfer your data outside the EEA
- Our staff are trained in GDPR compliance and understand their responsibilities for managing the systems that process your personal data
Our role as a Data Processor
You are the owner of the data you submit to our services (whether they are hosted on your premises or on our servers).
When your data is placed on our servers, you are the Data Controller and EZPZ Hosting is the Data Processor. We do not access the data you store on our services and any processing (as a Data Processor) is only in terms of the hosting services we provide to you. We do not use your data for any processing of our own.
We do not share or provide access to any of your data with third parties unless required to do so by law. Where law enforcement or other authorised parties request access to our servers, we follow strict internal policies for dealing with such requests in line with existing UK law. Furthermore, the third parties are required to demonstrate they have a lawful reason to access the data and under what authority.
Where your website is hosted on our UK servers, it is stored on leased hardware that only we have access to. This hardware is located at the HostDime data centre in Maidenhead, UK, with backups stored in the OVH data centre in Roubaix, France. None of your data is stored or transferred outside the EEA.
All our employees keep up to date with all technical aspects of security and ensure the ongoing security of our servers and systems. This means that any security patches are applied to our systems as a matter of priority and any changes or updates to our own systems are done so, always, with data protection and privacy in mind and where appropriate, in discussion with our customers. Where we have an agreement in place with our customers to do so, we also maintain the security of our customer’s own servers or hosted applications.
Access to servers
Remote admin access to our servers is strictly restricted to key personnel within our Technical Support team. Our team will access a server only to resolve an issue reported by the client or our monitoring system. Or to ensure that the Managed Hosting Service Level opted for by a client is met.
Data centre staff have physical access to the servers, but we have strict protocols in place to ensure they only do so if requested by a member of our technical support team and such a request will only be in cases when they need to carry out a visual check of a server or carry out physical maintenance on the server itself.
All employees are trained and made aware of their responsibilities under GDPR. This includes their responsibilities with regards to access, security and processing of any personal data stored on our servers. Security and data governance are covered in our employee handbooks and actively discussed as part of quarterly meetings to ensure all staff are up to date.
Third party services
Other than the data centres who host our servers,EZPZ Hosting does not use any third party suppliers or services that would have access to, or process, any data you process on our servers.
Strict protocols (as set out above) are in place regarding data centre staff access to our servers.
Changes to our approach
Should our approach to any aspect covered by this statement change we will make sure, where your data is impacted, that we notify you within a reasonable timeframe and in line with any contractual terms in place between us.
We will also be updating both our Terms of Service and Privacy Policies before the GDPR deadline.
Changes to Domain Whois
The European data protection authorities have expressed concern over the unlimited publication of personal data of domain name registrants in the WHOIS. To ensure our WHOIS output is compliant with the GDPR, we will implement the following changes starting May 25th, 2018:
For Existing Domain Names:
- For all existing domain names, if either of the Registrant, Admin, Tech and/or Billing contacts is identified as being from the EU, we will mask the WHOIS output for that domain name with placeholder details in place of the users’ personal information (this service will be referred to as “GDPR WHOIS Protection”).
- All domain names that have Privacy Protection enabled, which is a separate service from GDPR WHOIS Protection, will continue to show the Privacy Protection contact details in the WHOIS output. In addition Privacy Protection provides the following services and functionality which are not available with GDPR WHOIS Protection:
For New Domain Registrations, Renewals, Transfers:
- All domain registrations and transfers from SuperSite will use the details from the customer contact created during the purchase flow or all the 4 contacts: Admin, Billing, Technical and Registrant contact.
- The customer can log in to the control panel and change the default contact or edit any of the 4 contacts
- If any of these contacts created / selected at the time of domain registration are from within the EU region, GDPR WHOIS Protection will be enabled for the Domain name by default during the purchase process. GDPR WHOIS Protection will work exactly as explained above
In the unlikely event of a breach occurring (as defined in the GDPR) we will notify you within 48 hours of the breach coming to our attention. This will be enough time for you to consider your requirements, under GDPR, for reporting the breach to the ICO and Data Subjects.
What if I have more questions about GDPR?
Please consult legal advise or a GDPR professional if you are unsure about any of the GDPR regulations. You can also view the GDPR guidelines on the ICO website.