The formal agreement governing how GrandHosting processes personal data on your behalf, in accordance with GDPR Article 28.
Last updated: March 14, 2026
This Data Processing Agreement (“DPA”) forms part of the Terms of Service between GrandHosting (“Processor,” “we,” “us”) and the customer (“Controller,” “you”) who uses the GrandHosting platform to host websites and web applications.
This DPA is entered into pursuant to Article 28 of Regulation (EU) 2016/679 (the General Data Protection Regulation, “GDPR”) and applies to all processing of personal data carried out by the Processor on behalf of the Controller in connection with the Service.
This DPA applies to the processing of personal data that the Controller stores on or transmits through the GrandHosting platform. The Processor processes personal data solely for the purpose of providing the managed WordPress hosting service as described in the Terms of Service.
The Processor does not determine the purposes or means of processing the personal data — the Controller retains full control over what data is collected through their website(s) and how it is used.
The personal data processed may relate to the following categories of data subjects, as determined by the Controller:
The types of personal data processed depend on the Controller’s website and may include:
The Processor performs the following processing activities in the course of providing the Service:
Processing continues for the duration of the Controller’s use of the Service. Upon termination, the Processor retains data for 30 days to allow for data export, after which all personal data is permanently deleted, including backup copies.
The Processor shall process personal data only on documented instructions from the Controller, unless required to do so by EU or Member State law. The documented instructions are set out in the Terms of Service and this DPA. If the Processor believes an instruction infringes the GDPR or other data protection provisions, it shall immediately inform the Controller.
The Processor ensures that all personnel authorized to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. Access to personal data is limited to personnel who require it to perform their duties.
The Processor implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, as described in Section 7 (Security Measures) of this DPA. These measures are designed to protect against unauthorized or unlawful processing and against accidental loss, destruction, or damage.
The Processor shall not engage another processor (sub-processor) without prior written authorization from the Controller. The Controller provides general authorization for the sub-processors listed in Section 5 of this DPA. The Processor shall inform the Controller of any intended changes regarding the addition or replacement of sub-processors, giving the Controller the opportunity to object.
Where the Processor engages a sub-processor, it shall impose the same data protection obligations as set out in this DPA by way of a contract. The Processor remains fully liable for the performance of each sub-processor’s obligations.
The Processor shall assist the Controller in fulfilling its obligation to respond to requests from data subjects exercising their rights under Chapter III of the GDPR (access, rectification, erasure, portability, restriction, objection). This includes providing the Controller with the technical means to export, modify, or delete personal data stored on the platform.
The Processor shall notify the Controller without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach. The notification shall include:
Upon termination of the Service, the Processor shall, at the choice of the Controller:
The Controller has 30 days after termination to export their data. After this period, all data is permanently deleted.
The Controller authorizes the use of the following sub-processors for the specified purposes:
| Sub-Processor | Purpose | Location |
|---|---|---|
| EU Infrastructure Provider | Infrastructure hosting — servers, storage, networking | Germany (EU) |
| GrandHosting CDN | Content delivery — media file caching and distribution | EU (Slovenia) |
| GrandHosting Backup Storage | Backup storage — encrypted website and database backups | EU region |
| Supabase | Platform authentication and database | EU region |
| Stripe | Payment processing | Ireland (EU) |
| GrandHosting SMTP | Transactional email delivery | US (SCCs in place) |
| Sentry | Error tracking and application monitoring | EU data region |
The Processor will notify the Controller by email at least 14 days prior to engaging any new sub-processor. If the Controller objects to a new sub-processor on reasonable data protection grounds, the parties will work in good faith to find an alternative solution. If no resolution is reached, the Controller may terminate the affected services without penalty.
The Processor implements the following technical and organizational measures pursuant to Article 32 of the GDPR:
The Processor stores and processes personal data primarily within the European Economic Area (EEA). Where a sub-processor processes personal data outside the EEA (see Section 5), the Processor ensures that one of the following safeguards is in place:
The Processor will provide details of the specific safeguards upon request.
The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR and this DPA.
The Processor shall allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller, subject to the following conditions:
Where multiple Controllers request audits, the Processor may provide a single consolidated audit report (e.g., SOC 2 or ISO 27001 certification) to satisfy multiple requests, provided it adequately addresses the Controller’s concerns.
In the event of a personal data breach, the following procedures apply:
This DPA enters into force on the date the Controller begins using the GrandHosting Service and remains in effect for the duration of the processing.
This DPA automatically terminates when:
The obligations regarding confidentiality, data deletion, and breach notification survive termination of this DPA.
This DPA is governed by and construed in accordance with the laws of the Republic of Cyprus, without regard to its conflict-of-law provisions. Any disputes arising from this DPA shall be subject to the exclusive jurisdiction of the courts of the Republic of Cyprus.
This DPA is subject to the mandatory provisions of the GDPR. In the event of a conflict between this DPA and the GDPR, the GDPR shall prevail.
For questions or requests related to this Data Processing Agreement, please contact:
Grandhosting LTD
Lordou Vyronos 36, 1096 Nicosia, Cyprus
European Union
Early access pricing stays yours forever. Create a free demo site — no credit card, no contracts.
Create Free Demo Site