Last updated: March 24, 2026
1. Subject Matter and Scope of the Agreement
This Data Processing Agreement (hereinafter – Agreement) defines the procedure by which SIA Request, registration number: 40203423105, legal address: Stabu iela 109 – 1, Riga, LV-1009, Latvia (hereinafter – the Processor) processes personal data on behalf of the Customer (hereinafter – the Controller) while providing hosting and infrastructure services (hereinafter – the Services) under the brand request.host.
This Agreement is an integral part of the distance agreement “Terms of Service” (hereinafter – the Terms) concluded between the Processor and the Customer, hereinafter referred to separately as – the Party and collectively as – the Parties.
The Parties undertake to comply with Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (hereinafter – the Regulation) and other applicable laws and regulations.
2. Object, Nature, and Purpose of Processing
The Processor shall process personal data on behalf of the Controller in accordance with Article 4(2) of the Regulation and documented instructions from the Controller, including with regard to transfers of personal data to third countries, unless required to do so by applicable law.
Object of Processing
Personal data hosted by the Controller on the Processor’s hosting infrastructure and server instances.
Nature and Purpose of Processing
Provision of cloud services, virtual private servers (VPS), and managed infrastructure services, including maintenance and data storage.
The Processor does not actively use or analyze personal data and accesses such data only to the extent necessary for the provision, maintenance, security, or support of the Services.
Types of Personal Data
Any data the Controller chooses to process (e.g., names, emails, IP addresses, purchase history, website content, system logs, etc.).
Categories of Data Subjects
The Controller’s website visitors, customers, employees, and other individuals whose data the Controller processes within the Services.
Duration of Processing
For the entire duration of the Service provision until data is deleted or returned in accordance with this Agreement.
Legality of Instructions
The Processor does not assume an obligation to verify the legality of the Controller’s instructions or uploaded data. The Controller confirms that a legal basis exists for the processing of all transferred data.
The Controller is solely responsible for compliance with data protection regulations, specifically ensuring that both the transfer of data to the Processor and its processing are lawful.
3. Data Transfer to Third Countries
The provision of the agreed-upon data processing shall occur in a member state of the European Union or the European Economic Area (EEA), unless the Controller explicitly selects a server location outside these regions (e.g., United States of America (USA) or Singapore) during the Service ordering process.
Any transfer to a third country requires the prior consent of the Controller and may only occur if the conditions defined in Article 44 and subsequent articles of the Regulation are fulfilled.
4. Technical and Organizational Measures
The Processor ensures the appropriate protection of the Controller’s data in accordance with Article 32 of the Regulation by combining its own technical and organizational measures with those managed by the sub-processors.
These measures guarantee the confidentiality, integrity, availability, and resilience of systems and services.
| Area | Responsibility | Description of Measures |
|---|---|---|
| Physical Security | Sub-processor | Electronic access control, 24/7 video surveillance, and intrusion protection at the Sub-processor’s data centers. |
| Availability | Sub-processor | Redundant power supply (UPS), climate control, and high availability network infrastructure managed by the Sub-processor. |
| Access Control | Processor / Controller | Two-factor authentication (2FA) and individual hosting control panel accounts. The Controller secures access to their own server instances and applications. |
| Data Isolation | Processor | Logical separation of Customer data utilizing containerization technologies and strictly isolated hosting environments. |
| Data Encryption | Processor / Controller | TLS / HTTPS encryption for data in transit to the hosting control panel. The Controller is responsible for the encryption of data at rest within their server instance. |
| Data Integrity | Processor | Regular updates of host servers and the hosting control panel, firewall configuration, and DDoS protection measures. |
| Monitoring | Processor / Sub-processor | 24/7 monitoring of server and hosting control panel uptime by the Processor, alongside physical hardware and network monitoring by the Sub-processor. |
5. Obligations of the Processor
Confidentiality
The Processor ensures that all persons authorized to access personal data (including employees, contractors, and other authorized persons) are bound by confidentiality obligations. This obligation continues after the termination of the Agreement.
Cooperation
The Processor shall inform the Controller of inspections by the supervisory authority insofar as they relate to this Agreement.
Data Subject Requests
The Processor assists the Controller in fulfilling Data Subject requests pursuant to Chapter III of the Regulation. If a Data Subject contacts the Processor directly, the request is immediately forwarded to the Controller.
Compliance Assistance
Taking into account the nature of the processing and the information available, the Processor shall assist the Controller in ensuring compliance with the obligations set out in Articles 32 to 36 of the Regulation, including with regard to security, breach notification, and data protection impact assessments (DPIA).
Breach Reporting
The Processor shall notify the Controller without undue delay upon becoming aware of any personal data breach.
6. Approved Sub-processors
The Controller provides general authorization for the Processor to engage sub-processors for the processing of personal data, subject to the conditions set out in this Agreement.
| Sub-processor | Description of Processing |
|---|---|
| Hetzner Finland Oy 1 | Data center operator and infrastructure service provider in Finland. |
| Hetzner Online GmbH 1 | Data center operator and infrastructure service provider in Germany. |
| Hetzner US LLC 2 | Data center operator and infrastructure service provider in the United States of America (USA). |
| NTT Global Data Centers Americas Inc. 2 | Data center colocation and physical infrastructure service provider in the United States of America (USA). |
| QTS Investment Properties Hillsboro LLC 2 | Data center colocation and physical infrastructure service provider in the United States of America (USA). |
| Hetzner Singapore Pte LTD 3 | Data center operator and infrastructure service provider in Singapore. |
| NTT Global Data Centers SG1 Pte LTD 3 | Data center colocation and physical infrastructure service provider in Singapore. |
1 If the Controller selects a server location within the European Union (EU), data is processed exclusively within the EU, and only the marked EU sub-processors are engaged.
2 United States of America (USA) sub-processors are only engaged if the Controller explicitly selects a server location in this region.
3 Singaporean sub-processors are only engaged if the Controller explicitly selects a server location in this region.
The Processor ensures that sub-processors are bound by the same data protection obligations as set out in this Agreement and remains responsible for the performance of the sub-processors’ obligations as required by applicable law.
The Processor informs the Controller of any changes to the list of sub-processors at least 14 days in advance by sending a notice to the Controller’s registered email address.
If the Controller objects to a new sub-processor based on reasonable data protection grounds within 14 days of being notified, and the Parties are unable to resolve the objection through negotiation, the Controller shall have the right to terminate the Service and this Agreement with immediate effect as its sole and exclusive remedy.
7. Inspection and Audit Rights
The Processor does not hold independent data protection certifications. Compliance with the Regulation is demonstrated using the publicly available audit reports and certificates (e.g., ISO 27001) of the sub-processors.
The provision of such information to the Controller is considered sufficient to demonstrate the Processor’s compliance with Article 28(3)(h) of the Regulation.
Any preparation of additional information or responding to the Controller’s audit questionnaires that greatly exceeds standard documentation is a paid service according to the Processor’s hourly rate.
If the Controller disagrees with the information provided or deems it insufficient, the Controller’s sole and exclusive remedy is to discontinue the Services and terminate the Agreement.
8. Deletion and Return of Personal Data
After the conclusion of the Services, the Processor returns or deletes all personal data at the request of the Controller.
The Processor retains data for a 14-day restoration period; after this period, all data and server instances are permanently deleted in accordance with the Processor’s procedures.
9. Governing Law and Responsibility
This Agreement has been drafted in accordance with and is governed by the applicable laws and regulations of the Republic of Latvia.
All disputes and disagreements arising or that may arise during the execution of the Services or in connection with this Agreement shall be resolved through mutual negotiations.
The limitation of liability agreed in Section 11 of the Terms applies to this Agreement.
The Processor is not liable for indirect losses, lost profits, reputational damage, data loss, or business interruption, to the extent permitted by applicable laws and regulations.
10. Other Provisions
The Processor shall have the right to make changes to the Agreement at its sole discretion in order to ensure its compliance with current laws and regulations or to reflect changes in the provision of Services.
The Controller shall be notified of any material changes at least 30 days before they take effect. The current version of the Agreement is available on the website www.request.host, and by continuing to use the Services after the changes take effect, the Controller confirms its agreement to the new terms of the Agreement.
In the event of any conflict between the Agreement and the Terms, the Agreement’s provisions on data protection shall prevail in all respects.
This Agreement is also available on the Latvian language version of the Processor’s website (www.request.host/lv/datu-apstrades-ligums). In the event of any inconsistency or conflict between the English and Latvian versions, the Latvian version (www.request.host/lv/datu-apstrades-ligums) shall prevail in all respects.
In case of any questions regarding the Agreement or the applicable provisions on data protection, the Processor may be contacted by sending an official letter to the Processor’s legal address: Stabu iela 109 – 1, Riga, LV-1009, Latvia or by email: [email protected]