Data Processing Agreement

Last updated: 22 August 2026

Everything below, the Data Processing Agreement (DPA), forms part of our Terms of Service. Any time you store or process personal data through our services as the controller, this agreement takes effect, and our role becomes that of your processor under the UK GDPR and, where it applies, the EU GDPR.

1. Roles

Personal data you upload, store or send through our platform is data you control, which makes you the controller of it. Our role is processor, and we act on your documented instructions alone. For most customers those instructions are simply the ones built into using the service they bought.

2. Our obligations as processor

• Handle personal data on your instructions alone, unless the law compels us to act otherwise (and we will tell you when it does, unless the law bars us from saying so).
• Ensure our staff who access personal data are bound by confidentiality.
• Apply appropriate technical and organisational security measures — see our Data Security page.
• Help you, within what we can reasonably do, to meet data-subject requests when they arrive and to discharge your security, breach-notification and impact-assessment duties.
• Tell you without undue delay once we learn of a personal-data breach that touches your data.

3. Sub-processors

You authorise us in general terms to engage sub-processors for delivery of the service. Their performance stays our responsibility. Which sub-processors we currently use, and the job each one does, you will find listed in our Privacy Policy. Among them sit our upstream hosting platform, the provider who handles payments, and our domain registry partners. Should we plan a change, we will put a route in place for telling you, leaving room to object.

4. International transfers

Should a sub-processor sit outside the UK or the EEA, the transfer relies either on an adequacy decision or on standard contractual clauses backed by appropriate supplementary measures.

5. Return and deletion

Once your service ends, and once any short retention window set out in the service terms has run its course, we delete the personal data we hold for you or hand it back, the exception being data the law requires us to keep.

6. Audits

Ask in writing, within reason, and we will supply the information needed to show compliance with this DPA. That stands at once a year at most, unless a regulator requires more.

7. Requesting a signed copy

Running a business and need the DPA countersigned for your files? Request a copy by emailing info@ifasthosting.com.

Company details

iFastHosting is operated by Minix Mart Ltd, a company registered in England and Wales under Company No. 14845184. Registered office: The Workspace Basildon, 7 High Pavement, Basildon, England, SS14 1EA.

Our entry on the public register: Companies House.