Data Processing Agreement pursuant to Art. 28 GDPR
This English version is provided for convenience only. In the event of any discrepancy, the German version shall prevail.
This agreement specifies the data protection obligations of the contracting parties arising from the contract concluded between them for hosting, domain, email and related services (hereinafter “Main Contract”). It applies to all activities in which employees of the Processor or sub-processors engaged by it process personal data that the Controller provides when using the services or that arise on the systems provided by the Processor.
The legal basis is Art. 28 (3) GDPR in conjunction with § 14 of our General Terms and Conditions. The agreement becomes part of the contractual relationship upon conclusion of the Main Contract. A separately signed copy is available on request at support@wpresscloud.de.
Version date: 23 September 2026
Scope: all hosting, managed WordPress, WooCommerce, domain and email services provided by WPressCloud
Client (Controller)
The client within the meaning of this agreement is the customer named in the Main Contract with the master data stored in their customer account: company name, address, authorised representative and contact details.
The Client is the controller within the meaning of Art. 4 No. 7 GDPR for the personal data it processes via the Processor’s services. It alone decides on the purposes and means of this processing and assesses its lawfulness. It remains responsible for safeguarding the rights of data subjects.
Contractor (Processor)
WPressCloud®
a business unit of Wpress Group LTD
Piccadilly Business Centre
Aldow Enterprise Park
Manchester, M12 6AE
United Kingdom
Registered in England and Wales
Company number: 16682136
German office: Cologne
Email: support@wpresscloud.de
Data protection officer
Jasmine Calvez
WPress Group LTD, 20 Wenlock Road
London, England, N1 7GU
§ 1 Subject Matter, Duration and Termination
(1) The subject matter of the processing is the provision of the services agreed in the Main Contract, in particular the provision and operation of server capacity, storage space, databases, email mailboxes and domains as well as the associated maintenance, backup and support services. The Processor processes personal data exclusively on behalf of and on the instructions of the Client.
(2) The term of this agreement corresponds to the term of the Main Contract. It ends automatically upon termination of the Main Contract without the need for separate notice.
(3) The Client may terminate this agreement at any time without notice if there is a serious breach by the Processor of data protection regulations or of obligations under this agreement, if an instruction cannot be carried out, or if the Processor refuses the Client’s rights of inspection in breach of contract.
(4) Obligations which by their nature extend beyond the end of the contract, in particular confidentiality, deletion and return, remain unaffected by termination.
§ 2 Nature, Scope and Purpose of Processing
(1) The Processor processes personal data exclusively for the purpose of providing the contractually owed services. No processing takes place for its own purposes.
(2) Processing includes in particular the storage, retention, backup, transfer within the systems used, restoration and deletion of data as well as read access in the context of support, maintenance and security measures.
(3) Processing takes place in member states of the European Union, in the European Economic Area or in third countries in accordance with § 11 of this agreement.
§ 3 Categories of Data and Data Subjects
(1) Categories of personal data (depending on the Client’s specific use):
- Master and contact data (name, address, email, telephone)
- Contract and order data, invoice and payment data
- Access and usage data (user accounts, password hashes, log data, IP addresses)
- Content data from websites, forms, shops and email mailboxes
- Communication data and metadata of email traffic
(2) Data subjects:
- Visitors to the Client’s websites and shops
- Customers and prospects of the Client
- Employees and contact persons of the Client
- Suppliers and other business partners of the Client
(3) The Client decides on its own responsibility whether it processes special categories of personal data under Art. 9 GDPR on the Processor’s systems and takes the necessary additional protective measures for this.
§ 4 Client's Right to Issue Instructions
(1) The Processor processes personal data only on documented instructions from the Client, unless it is required to do so by Union or Member State law. In such a case, it informs the Client of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.
(2) Instructions are generally to be given in text form, primarily via the customer account or by email to support@wpresscloud.de. The Client confirms verbal instructions in text form without delay.
(3) The processing specified in the Main Contract, the service description and this agreement constitutes the Client’s initial instruction. The configuration of the services carried out by the Client itself via the customer account also constitutes an instruction.
(4) If the Processor is of the opinion that an instruction violates data protection regulations, it informs the Client without delay. It is entitled to suspend the execution of the instruction concerned until it is confirmed or changed.
§ 5 Obligations of the Processor
The Processor undertakes in particular:
- to process personal data only within the scope of this agreement and on the instructions of the Client;
- to commit all persons authorised to process data to confidentiality, unless they are already subject to an appropriate statutory obligation of confidentiality (Art. 28 (3) (b) GDPR);
- to implement and maintain the technical and organisational measures pursuant to Art. 32 GDPR (Annex 1);
- to support the Client in fulfilling its obligations under Art. 32 to 36 GDPR, in particular with data protection impact assessments and prior consultations;
- to provide the Client with all information necessary to demonstrate compliance with the obligations under Art. 28 GDPR;
- to maintain a record of all categories of processing activities carried out on behalf of the Client pursuant to Art. 30 (2) GDPR;
- to inform the Client without delay if a supervisory authority takes measures against it that concern the processing on behalf of the Client.
§ 6 Sub-processors
(1) The Client grants the Processor general authorisation to engage further processors (sub-processors). The sub-processors used at the time the contract is concluded are listed in Annex 2 and are deemed approved.
(2) The Processor informs the Client in text form of any intended change concerning the addition or replacement of sub-processors, generally with a lead time of four weeks. The Client may object to the change within two weeks of receipt of the information for an important reason relating to data protection.
(3) If the Client objects and the service concerned cannot be provided without the sub-processor, or only with disproportionate effort, both parties have a special right of termination with regard to the service concerned.
(4) The Processor selects sub-processors carefully, paying particular attention to the suitability of the technical and organisational measures they have taken. It contractually imposes on them the same data protection obligations as set out in this agreement (Art. 28 (4) GDPR) and is liable for their conduct as for its own.
(5) Ancillary services that the Processor uses from third parties, such as telecommunications services, postal services, maintenance and user service, cleaning staff, auditors or the disposal of data carriers, do not constitute sub-processing. The Processor also takes appropriate precautions to protect the data in this respect.
§ 7 Rights of Data Subjects
(1) The Processor supports the Client with appropriate technical and organisational measures in fulfilling its obligation to respond to requests from data subjects under Chapter III GDPR (Art. 28 (3) (e) GDPR).
(2) If a data subject contacts the Processor directly, the Processor forwards the request to the Client without delay and does not respond to it itself.
(3) The Processor only carries out rectification, erasure and restriction of processing on documented instructions from the Client, insofar as the Client cannot do so itself using the administrative functions provided.
§ 8 Notification of Personal Data Breaches
(1) The Processor informs the Client without undue delay after becoming aware of a personal data breach (Art. 33 (2) GDPR). The notification is sent to the contact address stored in the customer account.
(2) Where available, the notification contains: a description of the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed to address it.
(3) The Processor supports the Client in its notification and communication obligations under Art. 33 and 34 GDPR and immediately takes the necessary measures to secure the data and mitigate possible adverse consequences.
§ 9 Evidence and Audit Rights
(1) The Processor demonstrates compliance with the obligations under this agreement to the Client by appropriate means, in particular by self-disclosure, documentation of the technical and organisational measures or by presenting current certificates, attestations or reports from independent bodies.
(2) If this evidence is not sufficient in individual cases, the Processor allows the Client or an auditor commissioned by the Client and bound to confidentiality to carry out audits, including inspections (Art. 28 (3) (h) GDPR).
(3) Audits are carried out after timely notice, generally two weeks in advance, during normal business hours and without avoidable disruption to operations. The auditor may not be a competitor of the Processor. The Processor’s trade and business secrets and the data of other customers must be protected.
(4) The Processor may demand reasonable remuneration for audits that go beyond the cooperation owed by law or that are caused by the Client’s fault.
§ 10 Deletion and Return of Data
(1) After completion of the processing services, the Processor deletes all personal data or, at the choice of the Client, returns it and deletes existing copies, unless Union or Member State law requires storage of the personal data (Art. 28 (3) (g) GDPR).
(2) The Client must request the return or deletion of the data in text form no later than the date on which the termination of the contract takes effect. If the Client makes no choice, the data will be permanently deleted after a reasonable grace period.
(3) Backup copies are automatically overwritten and deleted in accordance with the agreed retention cycles. Until final deletion, they remain protected in the same way as production data.
(4) The Processor may retain documentation serving as evidence of proper data processing beyond the end of the contract in accordance with the statutory retention periods.
§ 11 Processing in Third Countries
(1) Personal data is generally processed in the European Union or the European Economic Area.
(2) The Processor has its registered office in the United Kingdom. The transfer of personal data to the United Kingdom is based on the European Commission’s adequacy decision pursuant to Art. 45 GDPR.
(3) Should there be no, or no longer be an, adequacy decision for a recipient country, data will only be transferred on the basis of appropriate safeguards pursuant to Art. 46 GDPR, in particular the European Commission’s standard contractual clauses, supplemented by the additional measures required following a transfer impact assessment.
(4) The Processor informs the Client of any intended relocation of processing to a third country in accordance with the procedure set out in § 6 of this agreement.
§ 12 Liability and Final Provisions
(1) Art. 82 GDPR applies to the liability of the parties. Otherwise, the liability provisions of the Main Contract apply, insofar as they are compatible with mandatory data protection law.
(2) Changes and additions to this agreement must be made in text form. This also applies to any change to this form requirement.
(3) In the event of contradictions between this agreement and the Main Contract, the provisions of this agreement take precedence insofar as they concern the processing of personal data on behalf of the Client.
(4) Should any provision of this agreement be or become invalid, the validity of the remaining provisions remains unaffected. The parties shall replace the invalid provision with a valid provision that comes closest to the economic purpose pursued.
(5) Annexes 1 and 2 form part of this agreement.
Annex 1 – Technical and Organisational Measures (Art. 32 GDPR)
Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, the Processor takes the following measures to ensure a level of security appropriate to the risk.
1. Confidentiality
Physical access control – The server systems are operated in data centres with secured buildings, access control systems with logging, video surveillance of security-relevant areas and a visitor policy requiring escorts. Only authorised persons are granted access.
System access control – Administrative access takes place via personal, non-shared user accounts. Measures include password policies with minimum complexity, two-factor authentication for administrative access, SSH access via key pairs, automatic lockout after failed attempts and a web application firewall with brute-force protection.
Data access control – Permissions are granted on a least-privilege and role basis and are reviewed regularly. Administrative access to customer data only takes place when required in the context of support, maintenance and security measures, and is logged.
Separation control – The data of different customers is processed separately. Each customer is run in its own isolated system environment with separate file system areas, databases and access credentials. Production, test and development environments are separated.
Pseudonymisation – Where the purpose of processing permits, data is pseudonymised or anonymised, for example by truncating IP addresses in log data.
2. Integrity
Transfer control – Data is only ever transferred in encrypted form: TLS for website, panel and email access, SFTP or SSH for file transfers, encrypted connections for administrative access. Data carriers are securely erased or destroyed before decommissioning.
Input control – System access, administrative activities and security-relevant events are logged. The logs are protected against subsequent alteration and retained for a defined period, so that it remains traceable who entered, changed or removed which data and when.
3. Availability and Resilience
Availability control – Redundant power supply with uninterruptible power supply and emergency generator, redundant network connection, air conditioning as well as early fire detection and extinguishing systems in the data centres. The storage systems are designed redundantly.
Data backup – Regular, automated backups of customer data in accordance with the cycles agreed in the Main Contract. Backups are stored separately from the production system; the ability to restore is checked regularly.
Resilience – Continuous monitoring of system status, load and availability, protective measures against overload and DDoS attacks, and a defined process for security updates to the operating system, server services and applications.
4. Procedures for Regular Testing and Evaluation
Data protection management – Appointed data protection officer, commitment of all employees to confidentiality, regular awareness training and a record of processing activities pursuant to Art. 30 (2) GDPR.
Incident response management – Defined process for detecting, assessing, containing and reporting security incidents, including the notification obligations under § 8 of this agreement.
Data protection by design and by default – Data-minimising configuration of systems, secure default settings and review of data protection-relevant changes before going live (Art. 25 GDPR).
Processor control – Careful selection of sub-processors, written agreements pursuant to Art. 28 GDPR, ongoing monitoring of the agreed protective measures and regular review of the effectiveness of our own measures.
Annex 2 – Approved Sub-processors
The Processor uses the following sub-processors as at the date of this version. They are deemed approved pursuant to § 6 (1) of this agreement.
| Category | Provider | Purpose of processing |
|---|---|---|
| Data centre and server infrastructure | Servflix Server system srv72.servflix.com | Provision and operation of the physical server, network and storage infrastructure, including data backup |
| Payment processing | Stripe Payments Europe, Ltd. 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland | Processing of card and SEPA direct debit payments for paid services |
We provide the complete and current list of sub-processors used, including company name, registered office, place of processing and purpose of processing, on request at support@wpresscloud.de. We inform you of changes in accordance with the procedure set out in § 6 (2).
Request a signed copy
If you need a signed copy of this data processing agreement for your data protection documentation, send us a short message with your customer number and full company details to support@wpresscloud.de. You will usually receive the copy within two working days.
Please direct any data protection questions to our data protection officer Jasmine Calvez, WPress Group LTD, 20 Wenlock Road, London, England, N1 7GU.
Further information: Privacy policy · Terms and conditions · Legal notice
