Data Processing Agreement

Last updated: 22 August 2026

This Data Processing Agreement (DPA) forms part of our Terms of Service. It applies whenever you, as a controller, store or process personal data using our services, and we act as your processor under the UK GDPR and, where relevant, the EU GDPR.

1. Roles

You are the controller of the personal data you upload, store or transmit through our platform. We are your processor and act only on your documented instructions, which for most customers are the instructions inherent in using the service you have bought.

2. Our obligations as processor

• Process personal data only on your instructions, unless we are required by law to do otherwise (in which case we will tell you, unless the law forbids it).
• Ensure our staff who access personal data are bound by confidentiality.
• Apply appropriate technical and organisational security measures — see our Data Security page.
• Assist you, so far as we reasonably can, with your obligations to respond to data-subject requests and to security, breach-notification and impact-assessment duties.
• Notify you without undue delay after becoming aware of a personal-data breach affecting your data.

3. Sub-processors

You give general authorisation for us to engage sub-processors to deliver the service. We remain responsible for their performance. The current sub-processors and what each does are listed in our Privacy Policy. They include our upstream hosting platform, our payment provider and our domain registry partners. We will give you a way to be informed of any intended change so you can object.

4. International transfers

Where a sub-processor is outside the UK or EEA, transfers are covered by an adequacy decision or by standard contractual clauses with appropriate supplementary measures.

5. Return and deletion

On termination of your service, and after any short retention window described in the service terms, we delete or return the personal data we hold for you, except where law requires us to keep it.

6. Audits

On reasonable written request, and no more than once a year unless a regulator requires otherwise, we will make available the information needed to demonstrate compliance with this DPA.

7. Requesting a signed copy

Business customers who need a countersigned DPA for their records can request one by emailing info@ifasthosting.com.

Company details

iFastHosting is operated by Minix Mart Ltd, a company registered in England and Wales under Company No. 14845184. Registered office: The Workspace Basildon, 7 High Pavement, Basildon, England, SS14 1EA.

Our entry on the public register: Companies House.