SN WHITE HOSTING – Data Processing Addendum (DPA)
Effective date: October 24, 2026
1. PURPOSE
This Data Processing Addendum ("DPA") forms part of the contract between the Customer and SN SOLUTIONS LLC (EIN: 32-0817400), trading as SN WHITE HOSTINGâ„¢, and governs the processing of personal data we carry out on behalf of the Customer when providing our services, in accordance with Article 28 of Regulation (EU) 2016/679 ("GDPR") and other applicable data protection law.
It does not cover data we process as a controller (for example, your account or billing data), which is explained in the Privacy Policy.
2. ROLES
- Controller: the Customer, who decides the purposes and means of processing the data hosted on their services.
- Processor: SN SOLUTIONS LLC, which processes that data only on the Customer's behalf.
- Sub-processor: any provider we use for part of the processing.
If the Customer is itself a processor for a third party (for example, a reseller or an agency), we act as its sub-processor on the same terms.
3. DESCRIPTION OF THE PROCESSING
| Subject matter | Hosting, storage, transmission and backup of the data the Customer stores or processes on their services |
| Duration | That of the service ordered, plus the time needed to delete it (section 10) |
| Nature | Storage, copying, transmission over the network, restoration and deletion. We do not access the content except to provide the service, give support at the Customer's request or comply with a legal obligation |
| Types of data | Those decided by the Customer: usually identification and contact data, website and database content, emails and files |
| Data subjects | Those decided by the Customer: usually their customers, users, employees and contacts |
The Customer must not host special categories of data (health, ethnic origin, etc.) or children's data without applying the measures required by law; the Customer is responsible for assessing whether our services are suitable for this.
4. OUR OBLIGATIONS
As a processor we undertake to:
- Process the data only on the Customer's documented instructions, which are this contract and the configuration the Customer makes of their services. If an instruction seems to us to breach the law, we will say so.
- Not use the data for our own purposes or disclose it to third parties, except to sub-processors or when required by law.
- Ensure that persons authorised to process it are bound by confidentiality.
- Apply the security measures in section 7.
- Help the Customer, as far as we can, to meet its obligations on security, breaches, impact assessments and consultations with the authority.
- Make available the information needed to demonstrate compliance with this DPA.
5. SUB-PROCESSORS
- The Customer gives us a general authorisation to use sub-processors in these categories: data centers and infrastructure providers (in Spain, in other European Union countries and in the United States, depending on the location of the service), backup and network providers, and email and attack protection services.
- The specific list of sub-processors is provided to customers who request it, confidentially, by writing to privacy@snwhitehosting.com.
- We will give you at least 15 days' notice before adding or replacing a sub-processor. If you have a reasonable data protection reason, you may object within that period; if we cannot find a solution, you may cancel the affected services free of charge.
- We require each sub-processor, by contract, to meet the same data protection obligations as this DPA, and we remain liable to the Customer for their compliance.
6. INTERNATIONAL TRANSFERS
If the processing involves transferring data outside the European Economic Area, we will do so with the safeguards of the GDPR: countries with an adequacy decision, providers certified under the EU-US Data Privacy Framework or standard contractual clauses approved by the European Commission. If you choose a service located outside the European Economic Area, the data is hosted in that country by your decision.
7. SECURITY
We apply technical and organisational measures appropriate to the risk, including: encryption of communications and sensitive data, access restricted to authorised staff with two-step verification, logging of administrative actions, firewalls and intrusion detection, backups on the services that include them, and system monitoring. We review them regularly. They are described in more detail in the Acceptable Use and Security Policy.
On services administered by the Customer (for example, unmanaged VPS and dedicated servers), the security of the system and its data is the Customer's responsibility.
8. SECURITY BREACHES
If we suffer a security breach affecting the Customer's data, we will notify the Customer without undue delay and at the latest within 48 hours of becoming aware of it, with the information available so that it can meet its notification obligations: what happened, which data and persons may be affected, the likely consequences and the measures taken.
9. DATA SUBJECTS' RIGHTS
If a person contacts us to exercise their rights over data we process on the Customer's behalf, we will pass the request to the Customer without replying to it directly. We will help the Customer handle such requests with the tools of the services, as far as possible.
10. END OF THE SERVICE
When the service ends, the Customer must download its data before cancellation. Afterwards, we will delete the data within the periods in the terms of each service, including its backups when they are overwritten, unless the law requires us to keep it.
11. CHANGES
We may change this DPA because of legal, regulatory or technical changes. We will give you at least 15 days' notice. Changes will not reduce the level of data protection.