DynHost

Data processing agreement (DPA)

Effective date: 2026-06-14

This DPA is incorporated into the Terms of Service and forms a binding agreement under Article 28 of the UK GDPR between DynHost (a trading name of DynDev Ltd) (“Processor” or “DynHost”) and the business customer (“Controller” or “Customer”).

1. Definitions

Capitalised terms have the meanings given in the UK GDPR.

2. Roles

For the processing of Personal Data uploaded, stored, or transmitted by the Customer (or by Data Subjects on the Customer’s behalf) using the Services, the Customer is the Controller and DynHost is the Processor.

For Personal Data that DynHost processes about the Customer for its own purposes (such as billing data, account credentials, and support correspondence), DynHost is the Controller.

3. Subject matter, nature, and duration

  • Subject matter: DynHost’s processing of Personal Data on behalf of the Customer, in connection with the Services.
  • Nature and purpose: hosting, transmitting, storing, backing up, securing, and (where instructed) deleting Personal Data.
  • Duration: for the duration of the agreement between the parties, plus any post-termination retention period.

4. Types of Personal Data and Data Subjects

Determined by the Customer’s use of the Services. The Customer has sole responsibility for determining the categories of Personal Data and Data Subjects.

5. Processor obligations

DynHost shall:

  • Process the Personal Data only on documented instructions from the Controller.
  • Ensure all persons authorised to process Personal Data are bound by an appropriate duty of confidentiality.
  • Implement appropriate technical and organisational measures (Article 32).
  • Engage Sub-processors only in accordance with Section 6.
  • Assist the Controller in responding to Data Subject rights requests.
  • Assist the Controller with Articles 32–36 obligations.
  • Notify the Controller of a personal data breach without undue delay and in any event within 72 hours.
  • At the Controller’s choice, delete or return all Personal Data after the end of the provision of the Services.
  • Make available all information necessary to demonstrate compliance and allow for and contribute to audits.

6. Sub-processors

  • General authorisation. The Customer provides a general authorisation for DynHost to engage Sub-processors, subject to the conditions in this section.
  • Current sub-processors. Published at dynhost.co.uk/legal/sub-processors.
  • Changes. DynHost shall give the Customer at least 30 days’ notice of any intended addition or replacement of a Sub-processor.
  • Right to object. The Customer may object to a proposed new or replacement Sub-processor on reasonable data protection grounds by writing to privacy@dynhost.co.uk within 30 days.
  • Sub-processor terms. DynHost shall impose data protection obligations no less protective than those in this DPA.
  • Liability. DynHost remains fully liable to the Customer for the performance of each Sub-processor’s obligations.

7. International transfers

Where Personal Data is transferred outside the UK, DynHost shall use the UK IDTA, the UK Addendum to the EU SCCs (with a documented Transfer Risk Assessment), or rely on the UK-US Data Bridge, as applicable.

8. Security measures

DynHost implements technical and organisational measures including TLS 1.2+ in transit, AES-256 encryption at rest, RBAC, 2FA, network segmentation, logging, vulnerability management, and background checks. Full details in Annex 1.

9. Personal data breach notification

DynHost shall notify the Customer without undue delay, and in any event within 72 hours, of becoming aware of a personal data breach affecting the Customer’s Personal Data.

10. Data Subject rights

The Customer is responsible for responding to Data Subject requests. DynHost shall, on the Customer’s reasonable request, assist via standard tools and additional reasonable assistance on a time-and-materials basis.

11. Audit rights

DynHost shall make available information necessary to demonstrate compliance on reasonable request. On-site audits may be requested on at least 30 days’ notice, no more than once per calendar year, at the Customer’s expense, conducted during business hours with minimal disruption.

12. Return or deletion at end of Services

On termination, the Customer may, within 30 days, request a copy of all Personal Data and/or permanent deletion. Backups are retained on a rolling basis (currently 30 days) and Personal Data in backups is overwritten in the ordinary course.

13. Liability

DynHost’s liability under this DPA is subject to the limitations and exclusions of liability set out in the Terms of Service. The aggregate liability cap is the total fees paid by the Customer to DynHost in the relevant 12-month period.

14. Governing law and jurisdiction

This DPA is governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

15. Processor details

DynHost is a trading name of DynDev Ltd.
Company number: 17089603 (registered in England and Wales)
Registered office: 1 Borrowdale Close, Eastbourne, East Sussex, BN23 8HX

Annex 1 — Technical and Organisational Measures

  1. Encryption: TLS 1.2+ in transit, AES-256 at rest, encrypted backups.
  2. Access control: least-privilege, RBAC, mandatory 2FA on admin access, immediate revocation on role change.
  3. Network security: segmentation, WAF, rate limiting, annual penetration testing.
  4. Logging and monitoring: centralised logs, 24/7 monitoring, 90-day retention minimum.
  5. Vulnerability management: regular patching, automated dependency scanning, security advisory subscriptions.
  6. Personnel: background checks where permitted, confidentiality clauses, regular training, disciplinary procedures.
  7. Business continuity: daily backups, offsite encrypted storage, annual restore testing, documented incident response and DR plans.
  8. Physical security: UK datacenter with 24/7 physical access control and CCTV; no physical office storage of Personal Data.
  9. Data minimisation and retention: only necessary data collected and retained, automated deletion where feasible.
  10. Sub-processor management: vetting, contractual obligations, public list, customer notification of changes.