Data Processing Agreement

1. Parties and subject matter

This agreement is concluded between you, the NBT Host customer, as controller, and NBT X SOLUTIONS SRL (Tax ID (CUI) 50912500, Trade Register No. J2024042916004, Șos. Ștefan cel Mare și Sfânt nr. 71A, Camera 1, Iași, Romania), as processor.

It applies to the services in which we process personal data on your behalf:

• web, WordPress, cloud and Bulk hosting — including the separate server we set up for a Bulk 500 or Bulk 1000 plan;
• email on your domain and backups;
• the work you ask us to do: restores, website migration, WordPress installation, support;
• WordPress maintenance, if you have subscribed to it;
• “We build your website” — for data about other people in the materials you send us (for example photos or names of your employees) and in the website under construction.

It forms part of the contract with NBT Host, together with the Terms and Conditions, and applies for the entire duration of the service. As regards data protection, this agreement takes precedence over the terms.

Your own customer data (name, contact, billing) and the data of a domain registrant are not covered here: we process these as controller, under the Privacy Policy.

2. What we process, for whom and why

• Nature of the processing: storing files, databases and emails on the server; transmitting emails; spam filtering; DNS for domains that use our name servers; backups and their restoration; work you request; for maintenance, updates, test copies and website checks; for the website we build for you, building it and the preview before handover.
• Purpose: solely the provision of the services in section 1. We do not use your data for any other purpose and we do not sell it.
• Categories of data: determined by you, through what you upload to the server or send us — for example contact details, orders, user accounts, message content, photos.
• Data subjects: your customers, visitors, users and employees, as well as anyone who emails you.
• Duration: for as long as the service is active, plus the deletion period in section 9.

If you store special categories of data (for example health data), it is your responsibility to assess whether the security measures below are sufficient for their risk and to tell us if you need additional measures.

3. Our obligations

1. We process the data only on the basis of your documented instructions: the contract, the settings you make in Enhance and the requests you send us in writing. If an instruction appears to us to infringe the law, we will inform you.
2. Access to the data is limited to the people who manage the servers, who are bound by confidentiality. We open the content of your account only when needed for the service: at your request, for contracted maintenance, for a file flagged as dangerous, for a report of illegal content or when the law requires us to.
3. We apply the security measures in section 4 and the backup rules in section 5.
4. We help you, insofar as it depends on us, to respond to requests from data subjects (access, rectification, erasure, portability) and to meet the obligations under Art. 32–36 GDPR.
5. We make available to you the information needed to verify that we comply with this agreement, and we accept an audit on reasonable request, with advance notice.
6. Hosted data stays in the European Economic Area: the server and backups are in data centers in the European Union (section 6).

4. Security measures

• servers in data centers in the European Union;
• encrypted connections for websites, email and the control panel (HTTPS, IMAPS and SMTPS), with certificates issued and renewed automatically; for FTP, encrypted FTP (FTPS) is available;
• administrative access to the server is restricted to the team that manages it, using cryptographic keys and strong passwords;
• the server's administration panel (Enhance) is protected by a strong password and by automatic blocking of repeated sign-in attempts;
• hosting accounts are isolated from one another and do not have SSH access;
• the sending limit is 200 emails per hour from each email address and 200 per hour from the code of each website;
• security updates applied regularly to the operating system and the control panel;
• daily backups, with an encrypted copy on a separate storage space (section 5).

5. Backups

• every day we make a copy of each hosting account — files, databases and emails;
• copies on the server are kept for at most 30 days, then deleted automatically;
• an encrypted copy goes to a storage space separate from the hosting server, with the same provider, in the European Union; there we keep 7 daily and 4 weekly copies, so a copy is deleted automatically within at most 5 weeks;
• at your request, we restore the account or part of it from one of the copies, free of charge.

Backups are a safety measure, not an archive. We recommend that you also keep a copy yourself: in Enhance you can download the backup of each website at any time.

6. Sub-processors

By this agreement you give us general authorization to use the sub-processors below. We bind them by contract to the same data protection obligations. We will notify you by email at least 30 days before we add or replace a sub-processor; during this period you can object and, if we cannot find a solution, you can terminate the service without penalties.

We will tell you the name of the data center provider on request, by email, at suport@nbt-host.com.

The following are not sub-processors for hosted data: the registrar Openprovider (Hosting Concepts B.V., the Netherlands) and the domain registries, which receive only the data of a domain's registrant, in order to register and manage it; and Cloudflare, which only handles the DNS for our own domains — nbt-host.com and the preview domain — and our program that checks from outside that the server responds, without seeing the hosted data.

7. Security incidents

8. Your obligations

• You have a legal basis for the data you upload and process, and you inform the people whose data you hold.
• For the website we build for you, you have the right to use the materials you send us and, if they contain data about other people (for example photos of employees), you have a legal basis for doing so.
• You protect your accounts: strong passwords for Enhance, email and applications, which you do not share.
• You keep the applications you install yourself (for example WordPress, themes and plugins) up to date, unless you have subscribed to maintenance with us.
• You send us your instructions in writing, to suport@nbt-host.com.

9. On termination of the service

After the contract ends, the data remains available for download until the account is deleted, under the terms: in case of non-payment, the service is suspended 7 days after the due date, and the data is permanently deleted 30 days after suspension. We notify you before each step.

After the account is deleted, backups that still contain the data are deleted automatically when their retention period expires: those on the server within at most 30 days, and those on the separate storage space within at most 5 weeks of the date they were made. If the law requires us to keep certain data, we keep it only for as long as the law requires.

When WordPress maintenance ends, we no longer work on the website; its data remains in your hosting account. For a website we built for you, we delete the preview from our server after handover.