Data Processing Agreement

This Data Processing Agreement (the "Agreement") forms part of the contract between MIRAKL SRL and the customer under the Terms and Conditions. It sets out the conditions under which we process personal data on the customer's behalf, in accordance with Article 28 of Regulation (EU) 2016/679 (the "GDPR").

• This Agreement applies to business customers (legal persons and professionals) and to any customer whose hosted content contains personal data of third parties (for example data of website visitors, online shop customers, newsletter subscribers, or the contents of mailboxes).
• For that data, the customer is the controller and MIRAKL SRL is the processor.
• This Agreement does not apply to data we process as a controller in our own right (client account, billing, payments, domain registrant data sent to registries, security logs). The Privacy Policy applies to that data.
• If your activity is purely personal or household, the GDPR may not apply to your processing; in that case we still apply the measures in this Agreement on a contractual basis.
• Accepting the Terms and Conditions when ordering includes accepting this Agreement. Business customers accept it expressly when ordering.

• We process personal data only on documented instructions from the customer, including with regard to transfers to third countries, unless required to do so by Union or Romanian law. In that case, we inform the customer of that legal requirement before processing, unless the law prohibits such information on important grounds of public interest.
• The customer's instructions are set out in the contract, in this Agreement, in the configuration of the service made by the customer, and in requests sent through the client area or by e-mail.
• We immediately inform the customer if, in our opinion, an instruction infringes the GDPR or other data protection provisions.
• We do not use the customer's data for our own purposes, do not sell it, and access it only as needed to provide the service, for technical support, for security or to comply with the law (for example following an order from an authority or a notice about illegal content).

We ensure that persons authorised to process the personal data (employees, contractors) have committed themselves to confidentiality or are under a statutory obligation of confidentiality, and that their access is limited to what is necessary.

We take appropriate technical and organisational measures under GDPR art. 32, taking into account the state of the art, the costs and the risks. In general terms, they include:

• hosting servers in a data centre in the European Union, with physical security and access control provided by the data centre operator;
• restricting administrative access to authorised persons, with secure authentication;
• separation of customer accounts on the servers;
• encryption of traffic in transit where the service allows it (for example TLS/SSL certificates);
• network-level protection (firewall, filtering and DDoS protection);
• timely application of security updates to the infrastructure we manage;
• monitoring and logging for security purposes;
• incident management procedures.

We do not hold security certifications and do not claim compliance with any particular standard. The security of applications, passwords and content installed and managed by the customer (for example WordPress, plugins, scripts) is the customer's responsibility, as is keeping its own backups (see the Terms and Conditions).

1. General authorisation. By accepting this Agreement, the customer gives us a general written authorisation, within the meaning of Article 28(2) GDPR, to engage other processors ("sub-processors") for the processing needed to provide the services, for example: data centres and server infrastructure, network, DNS and protection against attacks, backup storage, e-mail delivery and specialised technical support.
2. List of sub-processors. The current list, with each sub-processor's activity, the place of processing and the safeguards for transfers, is published on the List of sub-processors page. The list is informative and not part of the clauses of this Agreement, so updating it in line with this section is not an amendment of the Agreement.
3. Prior notice. We inform the customer of any intended addition or replacement of a sub-processor with access to the customer's data at least 14 days before the change takes effect, by e-mail to the address in the client account or by a message in the client account, and we update the list at the same time.
4. Urgent replacements. If a sub-processor must be replaced urgently to keep the service running or secure (for example because it stops operating, a security incident or a breach of its obligations), we may make the replacement before the notice period ends and inform the customer without delay. The right to object below also applies in that case, from the date of the notice.
5. Right to object. The customer may object to a change within 14 days of the notice, by an e-mail giving data protection reasons, sent to [email protected]. We consider the objection in good faith and look for a reasonable solution (for example an alternative for the customer's service). If we find none, the customer may end the services affected by the change, without penalty, with a pro rata refund of the unused part of the paid period. No objection within the period means the change is accepted.
6. Sub-processors' obligations. We impose on each sub-processor, by contract or another legal act, the same data protection obligations as in this Agreement, in particular sufficient guarantees of appropriate technical and organisational measures, under Article 28(4) GDPR.
7. Liability. We remain fully liable to the customer for the performance of each sub-processor's obligations.
8. Who is not a sub-processor. The payment processor, domain name registries, registrars and public authorities process data as independent controllers under their own rules and have no access to the content the customer hosts. We mention them on the page above for transparency only.

Hosted data is stored in the European Union. If a sub-processor processes the customer's data outside the European Economic Area (for example as part of a global traffic delivery and protection network), the transfer takes place only with one of the safeguards of Chapter V GDPR: an adequacy decision of the European Commission (including the EU-US Data Privacy Framework, for certified entities), standard contractual clauses approved by the European Commission or other appropriate safeguards. The safeguard for each sub-processor is shown on the List of sub-processors.

Taking into account the nature of the processing, we assist the customer with appropriate technical and organisational measures, insofar as possible, in fulfilling its obligation to respond to data subject requests (access, rectification, erasure, restriction, portability, objection). Normally the customer can respond to these requests directly, as it has full access to its content. If we receive a request directly from a data subject concerning the customer's data, we forward it to the customer without delay and do not respond on the merits unless the customer agrees or the law requires us to.

• We notify the customer without undue delay after becoming aware of a personal data breach affecting the customer's data.
• We aim to send the notice quickly enough for the customer, as controller, to meet the 72-hour deadline for notifying the supervisory authority under GDPR art. 33 (a deadline that runs from when the controller becomes aware of the breach).
• The notice includes, to the extent available: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and contact details for further information. Information not available at first is provided later, without undue delay.
• The notice is sent to the e-mail address in the client account.
• We take reasonable measures to mitigate the effects of the breach and cooperate with the customer.
• Incidents caused by the customer's applications, passwords or configuration (for example a compromised WordPress site) are not security breaches on our part; we nevertheless inform the customer of them if we detect them.

Taking into account the nature of the processing and the information available to us, we assist the customer in meeting its obligations under GDPR arts. 32–36 (security, breach notification, communication to data subjects, data protection impact assessment and prior consultation of the authority), in particular by providing relevant information about the service and the security measures. Assistance beyond providing this information may be charged at reasonable cost, communicated in advance.

• During the contract, the customer can download its content at any time using the service tools (for example the control panel, FTP/SFTP, database export).
• When the service ends, at the customer's choice, we delete all personal data or make it available to the customer for download, and then delete existing copies, unless Union or Romanian law requires their storage.
• The customer must download its data before termination or during the period between suspension and deletion provided in the Terms and Conditions. After that period, the data is deleted from the live servers.
• Backups (7 daily, 4 weekly, 3 monthly) are overwritten or deleted in the normal rotation cycle, within 90 days at most of the data being deleted from the live servers.

• We make available to the customer, on request, all information necessary to demonstrate compliance with the obligations in GDPR art. 28.
• We allow for and contribute to audits, including inspections, conducted by the customer or an auditor mandated by it, on the following conditions: at least 30 days' prior notice; an auditor bound by confidentiality; carried out without affecting the security or data of other customers; at most once a year, unless a personal data breach has occurred or a supervisory authority requests the audit.
• Inspections at sub-processors' data centres follow their policies; instead of an inspection we may provide the reports or documents made available by the sub-processors.
• The costs of the audit are borne by the customer, unless the audit finds a material breach of this Agreement on our part.

• The customer, as controller, is responsible for the lawfulness of the processing of the data it hosts: the legal basis, informing data subjects, responding to their requests and, where applicable, notifying breaches to the authority and to data subjects.
• The customer ensures that its instructions comply with the law and that it is entitled to transfer the data to us.
• The customer chooses and configures the security measures within its control (passwords, updates, backups, application-level encryption of sensitive data).

• This Agreement applies for the term of the contract and, after termination, until all of the customer's data has been deleted.
• The parties' liability is as provided in GDPR art. 82 and in the Terms and Conditions, within the limits permitted by law.
• In case of conflict between this Agreement and the Terms and Conditions regarding data protection, this Agreement prevails.
• This Agreement is governed by Romanian law. We may update it following the procedure for changes to the Terms and Conditions, except for changes to sub-processors, to which section 6 applies.
• Questions about this Agreement can be sent to [email protected].
• This Agreement is in force from 29 October 2026.