{"id":633,"date":"2026-09-17T19:18:28","date_gmt":"2026-09-17T17:18:28","guid":{"rendered":"https:\/\/www.webmonster.io\/data-processing-agreement\/"},"modified":"2026-11-04T13:16:36","modified_gmt":"2026-11-04T12:16:36","slug":"data-processing-agreement","status":"publish","type":"page","link":"https:\/\/www.webmonster.io\/en\/data-processing-agreement\/","title":{"rendered":"Personal data processing agreement"},"content":{"rendered":"\n<div class=\"wp-block-group alignfull wm-legal-page wm-section has-purple-bg-3-background-color has-background has-global-padding is-layout-constrained wp-block-group-is-layout-constrained\">\n\t\n\t<div class=\"wp-block-group wm-legal-layout is-layout-flow wp-block-group-is-layout-flow\">\n\t\t\n<aside class=\"wm-legal-sidebar wm-panel-soft\">\n\t<nav class=\"wm-legal-nav\" aria-label=\"Legal pages\">\n\t\t<details class=\"wm-legal-nav__disclosure\" data-wm-legal-nav-disclosure open>\n\t\t\t<summary class=\"wm-legal-nav__title\">Legal pages<\/summary>\n\t\t\t<div class=\"wm-legal-nav__groups\">\n\t\t\t\t\t\t\t<div class=\"wm-legal-nav__group wm-legal-nav__group--information\">\n\t\t\t\t\t<p class=\"wm-section-kicker wm-legal-nav__group-title\">Legal information<\/p>\n\t\t\t\t\t<ul class=\"wm-legal-nav__list\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<li><a class=\"wm-legal-nav__link\" href=\"https:\/\/www.webmonster.io\/en\/legal-notice\/\">Legal notice<\/a><\/li>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<li><a class=\"wm-legal-nav__link\" href=\"https:\/\/www.webmonster.io\/en\/terms-and-conditions\/\">General terms and conditions<\/a><\/li>\n\t\t\t\t\t\t\t\t\t\t\t<\/ul>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t<div class=\"wm-legal-nav__group wm-legal-nav__group--privacy\">\n\t\t\t\t\t<p class=\"wm-section-kicker wm-legal-nav__group-title\">Privacy<\/p>\n\t\t\t\t\t<ul class=\"wm-legal-nav__list\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<li><a class=\"wm-legal-nav__link\" href=\"https:\/\/www.webmonster.io\/en\/privacy-policy\/\">Privacy policy<\/a><\/li>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<li><a class=\"wm-legal-nav__link\" href=\"https:\/\/www.webmonster.io\/en\/cookie-policy\/\">Cookie policy<\/a><\/li>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<li><a class=\"wm-legal-nav__link\" href=\"https:\/\/www.webmonster.io\/en\/data-processing-agreement\/\">Data processing agreement<\/a><\/li>\n\t\t\t\t\t\t\t\t\t\t\t<\/ul>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t<div class=\"wm-legal-nav__group wm-legal-nav__group--service\">\n\t\t\t\t\t<p class=\"wm-section-kicker wm-legal-nav__group-title\">Service terms<\/p>\n\t\t\t\t\t<ul class=\"wm-legal-nav__list\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<li><a class=\"wm-legal-nav__link\" href=\"https:\/\/www.webmonster.io\/en\/hosting-terms\/\">Hosting terms<\/a><\/li>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<li><a class=\"wm-legal-nav__link\" href=\"https:\/\/www.webmonster.io\/en\/domain-terms\/\">Domain terms<\/a><\/li>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<li><a class=\"wm-legal-nav__link\" href=\"https:\/\/www.webmonster.io\/en\/email-terms\/\">Email terms<\/a><\/li>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<li><a class=\"wm-legal-nav__link\" href=\"https:\/\/www.webmonster.io\/en\/webmonster-care-terms\/\">WebMonster Care terms<\/a><\/li>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<li><a class=\"wm-legal-nav__link\" href=\"https:\/\/www.webmonster.io\/en\/webmonster-managed-terms\/\">WebMonster Managed terms<\/a><\/li>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<li><a class=\"wm-legal-nav__link\" href=\"https:\/\/www.webmonster.io\/en\/webmonster-pros-terms\/\">WebMonster Pros terms<\/a><\/li>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<li><a class=\"wm-legal-nav__link\" href=\"https:\/\/www.webmonster.io\/en\/service-level-agreement\/\">Service level agreement (SLA)<\/a><\/li>\n\t\t\t\t\t\t\t\t\t\t\t<\/ul>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t<div class=\"wm-legal-nav__group wm-legal-nav__group--partners\">\n\t\t\t\t\t<p class=\"wm-section-kicker wm-legal-nav__group-title\">Partners<\/p>\n\t\t\t\t\t<ul class=\"wm-legal-nav__list\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<li><a class=\"wm-legal-nav__link\" href=\"https:\/\/www.webmonster.io\/en\/partners-terms\/\">Partners and Recommend WebMonster<\/a><\/li>\n\t\t\t\t\t\t\t\t\t\t\t<\/ul>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t<div class=\"wm-legal-nav__group wm-legal-nav__group--accessibility\">\n\t\t\t\t\t<p class=\"wm-section-kicker wm-legal-nav__group-title\">Accessibility<\/p>\n\t\t\t\t\t<ul class=\"wm-legal-nav__list\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<li><a class=\"wm-legal-nav__link\" href=\"https:\/\/www.webmonster.io\/en\/accessibility-statement\/\">Accessibility statement<\/a><\/li>\n\t\t\t\t\t\t\t\t\t\t\t<\/ul>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t<\/details>\n\t<\/nav>\n<\/aside>\n\n\n\n\t\t\n\t\t<div class=\"wp-block-group wm-legal-content has-global-padding is-layout-constrained wp-container-core-group-is-layout-a3d4608d wp-block-group-is-layout-constrained\">\n\n<p class=\"wm-section-kicker wp-block-paragraph\">Privacy<\/p>\n\n\n<h1 class=\"wp-block-heading\">Personal data processing agreement<\/h1>\n\n\t\t\t\n\t\t\t<div class=\"wp-block-group wm-panel-soft has-wm-white-background-color has-background has-global-padding is-layout-constrained wp-container-core-group-is-layout-a4995e39 wp-block-group-is-layout-constrained\" style=\"margin-top:var(--wp--preset--spacing--50);padding-top:var(--wp--preset--spacing--50);padding-right:var(--wp--preset--spacing--50);padding-bottom:var(--wp--preset--spacing--50);padding-left:var(--wp--preset--spacing--50)\">\n\n\n\n<h2 class=\"wp-block-heading\">1. Parties, roles and acceptance<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>1.1.<\/strong> This agreement governs personal data processing carried out by Santiago \u00c1ngel Lope del Palacio, trading as <strong>WebMonster<\/strong> and identified in the <a href=\"https:\/\/www.webmonster.io\/en\/terms-and-conditions\/\" target=\"_blank\" rel=\"noopener\">General terms and conditions<\/a>, on behalf of the Customer identified in the accepted order or quote.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>1.2.<\/strong> Where the Customer determines the purposes of processing, the Customer acts as controller and WebMonster as processor. If the Customer provides services on behalf of another controller, WebMonster acts as sub-processor. In that case, the Customer must hold the necessary authorisation, convey the controller&#8217;s instructions and identify the controller where needed to comply with this agreement. The terminology used does not alter each party&#8217;s actual role.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>1.3.<\/strong> This agreement forms part of the contract through the applicable general and specific terms, together with its annexes and the Customer&#8217;s documented instructions. It is concluded electronically and does not require a separate paper signature. WebMonster will retain the version incorporated into the contract.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>1.4.<\/strong> Data processed by WebMonster for its own commercial relationships, billing, payment collection or compliance with legal obligations is governed by its Privacy policy. This agreement concerns data hosted or processed on the Customer&#8217;s behalf, even where it relates to the same individuals.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>1.5.<\/strong> Communications under this agreement should be sent to <a href=\"mailto:hola@webmonster.io\">hola@webmonster.io<\/a> or through a support request in the customer area. WebMonster will use the primary email address on the Customer&#8217;s account unless another data protection contact is designated. Both parties will keep their contact details up to date.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">2. Purpose, scope and duration<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>2.1.<\/strong> The purpose of processing is to provide purchased hosting, email, backup, migration, WordPress management through Managed or Care, and WebMonster Pros work requiring personal data processing. Annex I describes operations, data types and categories of data subjects. Only operations necessary for services and tasks actually purchased apply.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>2.2.<\/strong> Processing continues during service provision and any return, deletion or retention activities required on termination. For Pros, it covers the authorised intervention and handling of any working copies obtained; the validity of an hour package does not authorise keeping a copy of website data for that entire period.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>2.3.<\/strong> The annexes, order and subsequent instructions define the scope for each Customer. Additional processing or safeguards will be documented before being implemented. A commercial upgrade does not, by itself, authorise new uses of data.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">3. Customer instructions and obligations<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>3.1.<\/strong> WebMonster will process data according to the Customer&#8217;s documented instructions, including instructions on international transfers. This agreement, settings and operations requested through the control panel, and requests verified through contractual channels constitute instructions within the purchased scope.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>3.2.<\/strong> WebMonster will not use data covered by the engagement for its own advertising, sale of information or purposes unrelated to service provision. It will not disclose data to third parties except under documented instructions, through authorised sub-processing or under an applicable legal obligation.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>3.3.<\/strong> If European Union or Member State law requires WebMonster to carry out different processing, it will inform the Customer before doing so unless that law prohibits notification on important public interest grounds. If it considers an instruction to infringe data protection law, it will notify the Customer immediately and coordinate its correction before execution.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>3.4.<\/strong> The Customer is responsible for establishing a lawful basis for their processing, informing data subjects, defining necessary data and retention periods and issuing lawful instructions. They must also manage user permissions and maintain elements under their control, without being assigned tasks expressly undertaken by WebMonster.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>3.5.<\/strong> Where the nature or risk of processing requires additional measures, the Customer will communicate this before processing starts so the suitability of the service and necessary safeguards can be established. This includes, where applicable, health or other special-category data, criminal-offence data and high-risk processing. Purchasing hosting alone does not establish that every Customer application or processing activity meets its specific requirements.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">4. Confidentiality and security<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>4.1.<\/strong> Access to personal data will be limited to authorised persons who need it to perform their duties. They must be bound by confidentiality commitments or equivalent statutory obligations, receive appropriate instructions and training, and maintain confidentiality after their involvement ends.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>4.2.<\/strong> WebMonster will apply technical and organisational measures appropriate to the risk to protect the confidentiality, integrity, availability and resilience of systems, enable data recovery and regularly review the effectiveness of measures. Annex II specifies measures and procedures applicable to the service.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>4.3.<\/strong> WebMonster may update technical security arrangements while maintaining an appropriate level of protection and the purchased features. Material changes affecting the processing engagement will be documented and communicated. Absolute freedom from incidents is not guaranteed; this does not remove WebMonster&#8217;s prevention, response and assistance obligations.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>4.4.<\/strong> Data used for support, development or testing will be limited to what is necessary. Fictitious or anonymised data, or a subset of information, will be used wherever the task permits. Production copies in staging or working environments will retain appropriate access and protection measures while they contain personal data.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">5. Sub-processors<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>5.1.<\/strong> The Customer authorises WebMonster to use the sub-processors in Annex III for the described functions, and to add or replace sub-processors under the following procedure. WebMonster will check their safeguards and formalise the relevant data protection obligations before allowing processing.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>5.2.<\/strong> WebMonster will inform affected customers of a planned addition or replacement sufficiently in advance to allow objections on substantiated data protection grounds. The notice will identify the provider, function, location and, where applicable, transfer safeguards, and state the objection period. If no objection is raised within that period, the change falls within the general authorisation.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>5.3.<\/strong> If a substantiated objection is raised, the parties will seek a reasonable alternative before entrusting affected data to the new provider. If the service cannot continue in accordance with the contract and applicable law, the affected service may be terminated, with the financial consequences required by law.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>5.4.<\/strong> WebMonster will impose equivalent data protection obligations on each sub-processor for the assigned tasks, including security, confidentiality, assistance and deletion. WebMonster remains liable to the Customer for their performance under Article 28(4) GDPR. Commercial SLA exclusions do not alter this obligation.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>5.5.<\/strong> Providers engaged directly by the Customer for their website do not thereby become WebMonster sub-processors. If WebMonster integrates or administers those services, it will act according to the Customer&#8217;s instructions and each party&#8217;s actual role. Content, credentials or personal data unnecessary for a support enquiry will not be sent to external support.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">6. Locations and international transfers<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>6.1.<\/strong> Annex III identifies providers and hosting locations. Ancillary services and support may involve processing in other locations, subject to this section&#8217;s safeguards. WebMonster will provide the Customer with necessary information about processing and access locations affecting their service.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>6.2.<\/strong> Necessary international transfers must comply with documented instructions and Chapter V GDPR. Where appropriate, a valid adequacy decision or appropriate safeguards, such as standard contractual clauses with the necessary assessment and supplementary measures, will be used. WebMonster will document the applicable mechanism and provide information necessary for the Customer to verify its safeguards.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>6.3.<\/strong> If a safeguard ceases to be valid or sufficient, WebMonster will adopt a lawful alternative or suspend the affected transfer and inform the Customer. Acceptance of this agreement does not constitute general consent from data subjects to any international transfer.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">7. Individual rights and assistance<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>7.1.<\/strong> Taking account of the nature of processing, WebMonster will help the Customer address rights of access, rectification, erasure, objection, restriction, portability and rights concerning automated decisions. Assistance includes available tools and necessary actions concerning data processed on their behalf.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>7.2.<\/strong> If WebMonster directly receives a request concerning data under this engagement, it will forward it to the Customer&#8217;s contact without undue delay and will not decide its substance unless instructed by the Customer or legally required. Such requests will be distinguished from those relating to data for which WebMonster is controller, which it will handle directly.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>7.3.<\/strong> WebMonster will provide information and assistance needed for risk assessment, impact assessments, prior consultation with the authority and compliance with security obligations, according to the processing and information available to it. The Customer retains decisions and responsibilities assigned to them by law.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>7.4.<\/strong> Additional work beyond purchased features and legally required assistance may be quoted before execution. Mandatory or urgent action will not be conditional on buying a Pros hour package, and necessary work to remedy WebMonster&#8217;s own breaches will not be charged as an extra.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">8. Personal data breaches<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>8.1.<\/strong> On becoming aware of a breach affecting data processed on the Customer&#8217;s behalf, WebMonster will notify the designated contact without undue delay. It will not omit notification because it considers risk to individuals unlikely, or wait until the entire investigation is complete.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>8.2.<\/strong> The initial notification will contain available information about what happened, data and individuals potentially affected, known or foreseeable consequences, measures taken or proposed and a follow-up contact. Where possible, it will include categories and approximate numbers of individuals and records affected. Outstanding information will be provided in stages without undue delay.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>8.3.<\/strong> WebMonster will act to contain the incident, preserve necessary evidence and reduce its effects, coordinating with the Customer and providers involved. It will document the incident and provide information needed for the Customer to meet their own obligations.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>8.4.<\/strong> The controller is responsible for assessing and making required notifications to the supervisory authority and communications to affected individuals. WebMonster will assist and may make them under documented instructions, without automatically assuming that role. Where the Customer acts as processor, they will pass information to the controller without undue delay.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">9. Information and compliance verification<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>9.1.<\/strong> WebMonster will maintain the processing records required of it as processor and make available to the Customer the information needed to demonstrate compliance with this agreement. It will cooperate with supervisory authorities exercising their powers.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>9.2.<\/strong> The Customer or an authorised auditor may verify compliance, including through necessary inspections. Available documentation will be used first where it provides sufficient verification, without ruling out a justified audit or inspection. Reasonable scope and notice will be agreed, adapted to urgency in the event of an incident or official request.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>9.3.<\/strong> Verification will protect other customers&#8217; data, confidentiality and system security. These precautions will not prevent access to necessary information or the authority&#8217;s exercise of its powers. The parties will coordinate actions to avoid unnecessary interruptions.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">10. Termination, return and deletion<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>10.1.<\/strong> On termination of processing, the Customer may choose return or deletion of their personal data. Return to the Customer or their authorised provider will be facilitated through the service&#8217;s access and download facilities, with legally required assistance. Remaining copies will then be deleted under this agreement, except where retention is legally permitted or required.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>10.2.<\/strong> Cancellation with immediate deletion or deletion at the end of the purchased period, and deletion of websites, mailboxes or databases from the control panel, constitute deletion instructions under the specific terms. Cancellation for non-payment follows its own deadlines and notices. Return instructions and legally required recovery periods will be respected; this agreement does not replace them with the mere possibility that a backup exists.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>10.3.<\/strong> Residual copies due for deletion will no longer be used for ordinary purposes and will be deleted under the procedure and maximum period in Annex II. Where a particular item cannot technically be deleted immediately from a backup, it will remain protected with restricted access until deletion within that period. If a copy is restored, applicable deletion or restriction instructions will be reapplied before ordinary data use resumes.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>10.4.<\/strong> Temporary copies for migrations, testing or Pros work will be deleted once no longer needed, within the specific period in Annex II. WebMonster will pass return and deletion instructions to sub-processors and, on request, inform the Customer of completion and any data that must remain retained.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>10.5.<\/strong> Where retention is legally required or blocking is appropriate for potential liabilities arising from the relationship, only necessary data will be kept for a justified period, with use and access restricted under the law. This exception does not authorise indefinite archiving of all websites or email. Retention of invoices and other commercial relationship data is distinct from content hosted on the Customer&#8217;s behalf.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">11. Coordination with the main contract<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>11.1.<\/strong> For processing on the Customer&#8217;s behalf, this agreement prevails over incompatible commercial terms. Changes will be documented and notified under the general terms, respecting specific sub-processing and transfer rules.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>11.2.<\/strong> Liability will be determined under applicable law and section 15 of the general terms. The SLA and its credits do not replace data protection obligations or restrict data subjects&#8217; rights or authorities&#8217; powers.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Annex I. Description of processing<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>A. Purposes and operations by service<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li><strong>Hosting and email:<\/strong> receipt, transmission, organisation and storage of files, databases, messages and necessary technical logs; publication of content the Customer chooses to make public; email filtering and service protection; limited access for support, copying, recovery and deletion.<\/li>\n\n\n<li><strong>Migrations:<\/strong> authorised source access, copying, transmission and technical adaptation to the purchased destination, verification and deletion of temporary copies. Contacts, calendars and other items not included in the service are not incorporated.<\/li>\n\n\n<li><strong>Managed:<\/strong> in addition to hosting, access and inspection for WordPress management, updates, security, diagnosis, small adjustments, testing and restorations included in the plan. Staging copies fall within the same processing engagement.<\/li>\n\n\n<li><strong>Care:<\/strong> access and inspection for WordPress updates, technical and visual checks, diagnosis, security, malware removal, additional backups and restorations included in the service. Limited to the covered installation; email is not included.<\/li>\n\n\n<li><strong>Pros:<\/strong> access, inspection, testing, modification or development only as needed for the authorised task. Work may take place on Customer or third-party infrastructure without that third party automatically becoming a WebMonster sub-processor.<\/li>\n\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Processing is continuous during hosting or email provision and occasional or periodic according to management and support interventions. Volume depends on purchased capacity and usage. Duration and final disposition are governed by sections 2 and 10.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>B. Categories of individuals<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Website users, visitors, subscribers and customers; email senders, recipients and people mentioned in messages; employees, collaborators, suppliers and contacts whose data is incorporated into the service. Depending on the Customer&#8217;s use, data about children or other individuals requiring specific protection may be present. For engagements with a different scope, categories will be specified through documented instructions.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>C. Types of data<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Identity and contact details; user identifiers and authentication data; IP addresses and technical usage and security logs; communications, forms, documents, images and other content supplied by the Customer or their users; professional, order, billing and transaction information contained in hosted applications. Not all categories are present in every service.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The possible presence of special-category or criminal-offence data requires the assessment and safeguards in section 3.5. This inventory neither gives WebMonster an independent purpose for the content nor requires systematic inspection of all Customer files and messages.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Annex II. Measures and retention<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>A. Security measures<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>Restricted administrative access, with two-factor authentication and other security mechanisms for WebMonster personnel. Two-factor authentication is optional for the Customer in their customer area.<\/li>\n\n\n<li>Temporary provider support access, limited to the necessary intervention and removed on completion.<\/li>\n\n\n<li>Encrypted connections for service administration and management, and access logs retained as long as needed for security and diagnostic purposes.<\/li>\n\n\n<li>Website isolation and resource limits under the hosting terms.<\/li>\n\n\n<li>Confidential access to content limited to authorised service provision, support and security work.<\/li>\n\n\n<li>Management of supported PHP versions and retirement of obsolete versions according to the contractual schedule.<\/li>\n\n\n<li>Protection, scanning and file quarantine tools where appropriate, email filters and security features included in the plan. Managed and Care add the updates, virtual patching and malware removal included in each service.<\/li>\n\n\n<li>Backups at the frequencies, for the periods and with the features in the service&#8217;s specific terms.<\/li>\n\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>B. Backup retention<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Residual backups after cancellation or deletion are removed through normal rotation: thirty days from creation of each primary copy and sixty days from creation of each Managed secondary copy. Cancellation or deletion does not restart these periods. While copies exist, section 10.3 restrictions apply; retention does not guarantee data recovery. For Care, additional backups become unavailable when the service ends and are deleted under its specific terms. Residual copies that cannot be deleted immediately will remain protected and unavailable for ordinary use, for no more than fifty days from creation. Ending Care does not delete data or backups belonging to hosting that remains active.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Temporary copies may be obtained during migrations and Pros work to carry out, verify or allow recovery of the work. They will be deleted once no longer needed and in all cases no later than six months after creation, respecting applicable return or deletion instructions. They may be deleted sooner, and retention or availability throughout that period is not guaranteed.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Annex III. Sub-processors, locations and safeguards<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>A. Infrastructure providers<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li><strong>Cloudi NextGen S.L.:<\/strong> primary web hosting and email infrastructure, in <strong>Spain<\/strong>.<\/li>\n\n\n<li><strong>The Constant Company, LLC:<\/strong> supporting infrastructure, in <strong>Spain<\/strong>.<\/li>\n\n\n<li><strong>Hetzner Online GmbH:<\/strong> supporting infrastructure, in <strong>Germany<\/strong>.<\/li>\n\n\n<li><strong>Krystal Hosting Ltd:<\/strong> <strong>website hosting in the United States<\/strong>, exclusively at the Customer&#8217;s express request; email is not included.<\/li>\n\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Origin hosting for websites and email is located in the European Union, except websites for which the stated US location has been requested. This rule concerns hosting infrastructure and does not automatically extend to all Managed or Care ancillary services. A request for US hosting documents a Customer instruction and does not replace the transfer safeguards required by section 6.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">SMTP relay and spam filtering run on infrastructure managed by WebMonster. Backups are stored with the listed infrastructure providers, respecting the location and safeguards applicable to the service.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>B. Management and security tools<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">WebMonster includes Cloudflare, WP Rocket, Imagify and Complianz in Managed, and Patchstack in Managed and WebMonster Care. These tools are not, in themselves, part of ordinary WCH or BCH hosting: they apply according to the additional service purchased. Their use at the Customer&#8217;s own decision and expense is governed by section 5.5.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li><strong>Cloudflare, Inc.:<\/strong> network, content delivery and website protection services through its international network, potentially involving processing outside the European Economic Area. Transfers will rely on the EU\u2013US Data Privacy Framework where applicable, or standard contractual clauses and appropriate safeguards. Its <a href=\"https:\/\/www.cloudflare.com\/gdpr\/subprocessors\/\" target=\"_blank\" rel=\"noopener\">sub-processors and locations<\/a> provide further information about the processing chain.<\/li>\n\n\n<li><strong>WP Media SAS, France:<\/strong> external image optimisation through Imagify and performance optimisation through WP Rocket. WP Rocket&#8217;s external features may send page addresses to the provider for processing. Its French headquarters do not, by themselves, determine where external processing takes place.<\/li>\n\n\n<li><strong>Patchstack O\u00dc, Estonia:<\/strong> security and virtual patching, processing security data according to the features used, with processing infrastructure in Ohio, United States. Standard contractual clauses and appropriate safeguards apply to transfers requiring them. Its <a href=\"https:\/\/patchstack.com\/subprocessors\/\" target=\"_blank\" rel=\"noopener\">sub-processor list<\/a> identifies the processing chain.<\/li>\n\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Sub-processing exists only where the provider processes personal data on the Customer&#8217;s behalf. A licence or local installation of a plugin, such as Complianz, does not in itself constitute sub-processing.<\/p>\n\n\n\n<p class=\"has-text-align-right wm-legal-version wp-block-paragraph\">VERSION: 26-2<\/p>\n\n<\/div>\n\n<\/div>\n\n<\/div>\n\n<\/div>\n\n","protected":false},"excerpt":{"rendered":"<p>Legal pages Legal information Legal notice General terms and conditions Privacy Privacy policy Cookie policy Data processing agreement Service terms Hosting terms Domain terms Email terms WebMonster Care terms WebMonster Managed terms WebMonster Pros terms Service level agreement (SLA) Partners Partners and Recommend WebMonster Accessibility Accessibility statement Privacy Personal data processing agreement 1. Parties, roles [&hellip;]<\/p>\n","protected":false},"author":0,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"no-title","meta":{"footnotes":""},"class_list":["post-633","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.webmonster.io\/en\/wp-json\/wp\/v2\/pages\/633","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.webmonster.io\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.webmonster.io\/en\/wp-json\/wp\/v2\/types\/page"}],"replies":[{"embeddable":true,"href":"https:\/\/www.webmonster.io\/en\/wp-json\/wp\/v2\/comments?post=633"}],"version-history":[{"count":0,"href":"https:\/\/www.webmonster.io\/en\/wp-json\/wp\/v2\/pages\/633\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.webmonster.io\/en\/wp-json\/wp\/v2\/media?parent=633"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}