Data Processing Agreement (DPA)

1. Definitions

Capitalised terms not defined here have the meaning in the UK GDPR / EU GDPR. "Personal Data", "Processing", "Controller", "Processor", "Data Subject", and "Personal Data Breach" align with those laws.

2. Subject matter, nature, and purpose

Subject matter: hosting and related platform services for WordPress sites on SwiftPress infrastructure.

Duration: for the term of the hosting subscription and until deletion/return of data in line with the Terms and technical backup cycles.

Nature and purpose: storage, hosting, transmission, backup, security monitoring, support as requested by you, and other processing necessary to provide the Services you configure.

Types of data: may include identifiers, technical logs, content you upload (including WordPress database fields), and other data you choose to process on the platform.

Categories of data subjects: determined by you (e.g. your website visitors, customers, members).

3. Your instructions

We process Personal Data only on documented instructions from you, including these Terms, this DPA, and your configuration of the Services (including support tickets you submit). We will inform you if we believe an instruction infringes applicable law, unless prohibited from doing so.

4. Confidentiality and personnel

We ensure that persons authorised to process Personal Data are bound by confidentiality or statutory professional obligations.

5. Security

We implement appropriate technical and organisational measures appropriate to the risk, including as described in our Privacy Policy and security practices for the hosting platform (access control, monitoring, patching, segmentation as applicable).

6. Subprocessors

You authorise us to engage subprocessors to support the Services (e.g. infrastructure, payments where they touch Personal Data, email delivery). We impose data protection obligations on subprocessors materially equivalent to those here. We remain responsible for their performance. We will notify you of changes to subprocessors where required by law; where we provide a general list or update mechanism on our website or client area, you may object on reasonable data-protection grounds as described there.

7. Data subject requests

Taking into account the nature of hosting, we assist you by appropriate technical and organisational measures, insofar as possible, in responding to requests from Data Subjects to exercise their rights under applicable law. Many requests for site visitor data must be fulfilled by you as controller; we assist where the data is solely in our possession as processor.

8. Breach notification

We notify you without undue delay after becoming aware of a Personal Data Breach affecting Personal Data we process on your behalf, and provide information reasonably available to us to assist you in meeting your own notification duties.

9. Deletion and return

At your choice, we delete or return Personal Data after the end of the provision of Services, except where law requires retention. Backup media may retain residual copies for a limited period until overwritten in the ordinary course.

10. Audits

On reasonable request, we make available information necessary to demonstrate compliance with Article 28 GDPR and allow for audits, including inspections conducted by you or a mutually agreed auditor, subject to confidentiality, security, and proportionality (e.g. annual questionnaire or summary reports where full onsite audit is impractical for a cloud host).

11. International transfers

Where Personal Data processed under this DPA is transferred outside the UK or EEA, we implement appropriate safeguards (e.g. UK IDTA, EU Standard Contractual Clauses, or adequacy) as required by law.

12. Conflict

If this DPA conflicts with the Terms of Service on processor obligations, this DPA prevails for processing of your end-users' Personal Data as described above. Otherwise the Terms prevail.

13. Contact

Processor contact: SwiftPress Software Ltd — use swiftpress.io or my.swiftpress.io support channels, or the registered address below marking "DPA".