Hosting service terms

Effective from: 25 September 2026
Version: 1.3

1. Provider

The services are provided by:

Jan Pavlík
Company ID: 72625635
Registered office: Školská 660/3, 110 00 Praha 1
E-mail: jan@pavlik.do
Web: pavlik.do
Registered in the Czech Trade Licensing Register kept by the Trade Licensing Office of Prague 1

(the "Provider").

These general terms and conditions (the "Terms") govern the provision of hosting and related services to businesses and consumers. A "Consumer" is an individual who enters into the contract outside their trade, business or profession; all other customers are referred to as "Business Customers". For a Consumer, mandatory law and the Consumer Information on this page prevail over any conflicting provision of these Terms.

2. Contract documents

The contractual relationship consists of the individual quotation or order, any separate contract or SLA, these Terms, the Abuse Policy, the Consumer Information where the customer is a Consumer, and any applicable DPA. In the event of a conflict, the individual agreement prevails, subject to the following exceptions:

1. the DPA prevails in matters of personal data processing,
2. the Abuse Policy prevails in matters of prohibited use and security action,
3. the Consumer Information prevails for a Consumer,
4. mandatory law always prevails.

A deviation from the DPA or the Abuse Policy is effective only if expressly agreed in writing and the specific provision is identified.

The customer's business terms, purchasing conditions or other indirect terms apply only where the Provider expressly accepts them in the individual quotation or contract. An acceptance containing an addition or a deviation is not an acceptance; Section 1740(3) of the Civil Code does not apply.

3. Services provided

The Provider may individually provide, in particular:

• web hosting and file storage,
• database services,
• e-mail services,
• DNS and domain services,
• FTP/SFTP or other technical access,
• data backup and restore,
• virtual or dedicated servers,
• monitoring, administration and technical support,
• other related IT services.

The specific scope, price, capacity, billing period, support, backup and any SLA are set by individual agreement. The technical infrastructure may be operated by the Provider or its suppliers in data centres within the European Union, in particular in Germany.

Where the e-mail service is a publicly available number-independent interpersonal communications service, the Provider informs the customer that it is a microenterprise and relies on the exemption under Section 63e of Czech Act No. 127/2005 Coll.; the provisions listed in Section 63e(1) therefore do not apply to that service unless the Provider also supplies another electronic communications service. The e-mail service does not provide access to emergency services.

4. Formation of the contract

Publication of these documents or general information that hosting may be available is not a public offer or a promise to enter into a contract. The Provider is not obliged to accept an enquiry or order.

Before the contract is formed the Provider makes these Terms, the Abuse Policy, the Consumer Information where the customer is a Consumer, and any applicable DPA available to the customer, either attached to the quotation or by a link to their specific version.

The contract is formed only when the customer expressly accepts the Provider's individual quotation, the Provider expressly accepts the customer's order, or the parties sign a contract. The Provider activates the service only afterwards. By accepting, the customer acknowledges that they have read those documents, understand their meaning and agree to them.

The customer is responsible for the accuracy and currency of their identification, billing and contact details.

5. Price and payment terms

The price is set by the individual quotation or contract. Unless agreed otherwise, services are invoiced in advance.

Invoices are payable within 14 days. If the customer is in default, the Provider may, after prior notice, restrict or suspend the service. This does not affect the obligation to pay the price for the ordered period or any statutory interest and costs on it.

The price of a domain, licence or other third-party service may change from the next billing period in line with that supplier's price. The Provider will inform the customer of a material change in advance where circumstances allow.

The Provider is not a Czech VAT payer and the prices stated are final. The Provider is VAT-identified for relevant cross-border transactions. For supplies to a business in another EU member state the reverse charge applies and the customer accounts for the tax under the rules of its own state; the price is unaffected. Should the Provider become a Czech VAT payer, VAT at the statutory rate will be added to the price from the effective date of that registration, and the Provider will inform the customer in advance.

6. Customer obligations

The customer shall in particular:

• use the service in accordance with law, the contract, these Terms and the Abuse Policy,
• be responsible for their content, applications, data and the activity of users to whom they have made the service available,
• protect passwords, keys and access credentials,
• keep their applications and content management systems updated and reasonably secured,
• report a security incident or suspected misuse without undue delay,
• not exceed the agreed technical limits and not endanger the operation of other services,
• keep their own independent copy of important data unless expressly agreed otherwise.

The customer must not use the service for, in particular, unlawful activity, phishing, distribution of malware, spam, unauthorised attacks, infringement of third-party rights, or activity endangering the security or reputation of the infrastructure.

7. Cooperation and Provider access

The customer shall provide reasonable cooperation needed to set up, migrate, maintain, secure and terminate the service.

The Provider may access the technical configuration, logs and data of the service to the extent necessary for support, diagnostics, security, backup, restore, compliance with legal obligations or incident response. It does not use the content of the data for its own marketing purposes.

For e-mail services, the Provider preserves the confidentiality of messages and related traffic data and accesses them only to the necessary extent described above or where required by law.

8. Availability, maintenance and changes to the service

The Provider aims for reliable operation. Unless an SLA is expressly agreed, availability is not guaranteed at any specific percentage and the customer has no automatic entitlement to a service credit.

The Provider may carry out planned and urgent maintenance, in particular for security, updates or prevention of damage. Where possible it will inform the customer in advance of planned downtime that may have a significant impact.

The Provider may change the technical implementation of the service provided this does not materially reduce its agreed functionality.

9. Backup and restore

The scope, frequency and retention of backups are governed by the individual quotation. Where backup is part of the ordered service and unless agreed otherwise, a server image is created daily and the last 7 daily restore points are retained. This is neither a continuous backup nor an independent archival copy.

Restoring an individual file may require restoring the whole image into a separate environment and may not always be technically possible. The Provider does not guarantee the completeness or success of a restore unless a specific guarantee has been expressly agreed. Restore may be charged for. The customer therefore keeps its own independent copy of critical data.

10. Domains and third-party services

The rules of the relevant registry and registrar also apply to the registration or administration of domains. The Provider is not liable for refusal of registration, withdrawal of a domain or a change to third-party rules that it could not reasonably influence.

The customer shall provide correct domain holder details and pay the related fees on time.

11. Unlawful or prohibited content

If the Provider identifies a possible breach of law, the contract, these Terms or the Abuse Policy, it may, having regard to the seriousness and urgency:

• call on the customer to remedy the matter,
• restrict access to specific content,
• suspend part or all of the service,
• remove or disable specific content,
• terminate the contract,
• preserve necessary evidence and cooperate with the competent authorities.

Where there is an immediate security risk, phishing, active malware, an attack or manifestly unlawful content, the Provider may act without prior notice.

It applies restrictions diligently, objectively and proportionately, having regard to the rights and legitimate interests of the persons concerned. In the cases set out in the DSA it will provide the affected customer with a clear and specific statement of reasons and information on the available remedies.

The procedure for notifying unlawful content is described in the DSA section on this page.

12. Personal data protection

The Provider processes the customer's identification, contact, billing and operational data as an independent controller in accordance with the Privacy Notice.

Where it processes personal data on the customer's behalf in the course of providing the service, it acts as a processor as a rule. Such processing is governed by the DPA, which forms part of the contract documents.

13. Liability

Each party is liable for damage to the extent set out by law and the contract.

The Provider is not liable for damage caused by circumstances outside its reasonable control, in particular an outage of a supplier, connectivity or the power grid, an attack by a third party, force majeure, a defect in the customer's application, compromised customer credentials or the customer's breach of obligations.

In relation to a Business Customer, the Provider is not liable for lost profit, loss of business opportunity or indirect or consequential damage, where the law permits such a limitation.

In relation to a Business Customer, where the law permits limitation of damages, the Provider's total liability for events relating to one service is limited to the amount actually paid for that service over the last 12 months.

The parties acknowledge the reasonable ground for that limit: the price of the service is set against the risk so defined, the customer holds their own access to their data and keeps an independent copy of it under Article 6, and the Provider is a single natural person. A higher limit may be agreed in the individual quotation, as a rule for a higher price, and the customer is entitled to ask for one before the contract is formed.

The limitation does not apply to harm caused intentionally or by gross negligence, harm to a person's natural rights, claims by data subjects under the GDPR, or where the law does not permit it. This article does not limit a Consumer's statutory conformity rights or any other mandatory consumer rights.

14. Term and termination

Unless agreed otherwise, the contract is concluded for an indefinite term. In relation to a Business Customer, either party may terminate it with effect from the end of the paid billing period; notice must be delivered at least 30 days before the end of that period. A Consumer may terminate an indefinite-term contract at any time on 30 days' notice, and the Provider may do the same. The Provider accounts for and refunds the Consumer's unused prepaid amount after setting off due claims.

The Provider may terminate the contract without notice in the event of a material breach of obligations, non-payment even within an additional period, repeated misuse of the service, or immediate danger to the infrastructure or to third parties.

The customer shall export its data before termination. Where security and legal circumstances allow, the Provider will give reasonable assistance with the export. Production data may be deleted at any time after 30 days from the end of the service. Backup copies containing it will then expire no later than during the next seven-day retention cycle, unless otherwise agreed or required by law.

15. Changes to the Terms

In relation to a Business Customer, the Provider may reasonably amend these Terms, in particular because of a change in law, security, supplier conditions or the scope of services. It will notify the Business Customer of a significant change by e-mail to the contact address under Article 16, at least 30 days before the proposed effective date, unless an urgent legal or security situation requires a shorter period.

The Business Customer may reject the change within that period. On rejection the existing version continues to apply and the contract ends on expiry of the paid billing period, and in any event no sooner than 30 days after the rejection, so that the Business Customer has time enough to obtain comparable performance from another supplier. If the Business Customer does not reject the change within the period, the new version applies from the stated date.

Termination under this Article carries no penalty and no special obligation for the Business Customer. Changes to a contract with a Consumer are governed by the Consumer Information and mandatory law. The version in force when the contract was concluded applies to performance already completed or to one-off performance.

16. Communication and delivery

Ordinary communication takes place electronically to the parties' contact addresses. The customer shall notify any change of contact e-mail. A message is deemed delivered once it reaches the addressee's mailbox, unless the sender receives a non-delivery report.

The contact points under the DSA are set out in the DSA section on this page.

17. Defective performance

The customer shall notify a defect in performance without undue delay after discovering it, or after they ought to have discovered it with due care, electronically to the Provider's contact address. The notice shall describe the defect, the service affected and when it appeared.

The Provider will assess the notice without undue delay and, where the complaint is justified, remedy the defect within a period appropriate to its nature and its impact on operation. Where a remedy is not possible or not purposeful, the parties will agree a reasonable reduction of the price for the period concerned.

A Consumer's statutory conformity rights and the method and time limits for handling complaints are also governed by the Consumer Information and mandatory law.

A restriction or suspension of the service under Articles 5 and 11 or under the Abuse Policy, planned or urgent maintenance under Article 8, and unavailability caused by a circumstance listed in Article 13 are not defects.

18. Final provisions

The legal relationship is governed by the law of the Czech Republic.

The parties will first attempt to resolve any dispute amicably. In relations between Business Customers, the parties agree in writing, to the extent permitted by law, on the local jurisdiction of the Provider's general court. A Consumer may use the competent general court and the out-of-court dispute resolution described in the Consumer Information.

The invalidity or ineffectiveness of one provision does not affect the remaining provisions. The current version of the Terms is published on this page.

Effective from: 4 September 2026
Version: 1.0

1. When this section applies

This section applies only where the customer enters into the contract as a Consumer. It supplements and prevails over the Terms. Neither the Terms nor an individual quotation limit the Consumer's statutory rights.

The Provider is Jan Pavlík, Company ID 72625635, Školská 660/3, 110 00 Prague 1, Czech Republic, e-mail jan@pavlik.do, telephone +420 735 842 934. The contract is concluded individually by e-mail or signature, not through self-service checkout on the website.

2. Information before the contract is formed

The individual quotation, together with these documents, states in particular the description and scope of the service, total price and how it is calculated, billing period, method and time of activation, term, termination conditions, any minimum commitment, backup and support. Where material to the service, the quotation also states its functionality, compatibility and technical limitations.

After formation, the Provider sends the Consumer by e-mail confirmation of the contract and the documents that apply to it, or another record that allows them to be stored unchanged and displayed later.

The technical process is simple: the Provider sends a quotation, the Consumer may correct or supplement their details before acceptance, and the contract is formed by the Consumer's unambiguous e-mail acceptance or signature. The Provider stores the contract for the term of the relationship and the necessary period afterwards; the Consumer receives a copy by e-mail and no separate customer portal is provided. The contract is concluded in Czech; the English and Spanish documents are translations for information.

3. Withdrawal within 14 days

A Consumer may withdraw from a distance or off-premises contract without giving a reason within 14 days after it is formed. It is sufficient to send an unambiguous statement within that period to jan@pavlik.do or the Provider's address. The model below may be used but is not mandatory.

The Provider starts providing the service before the end of the 14-day period only at the Consumer's express request. If the Consumer withdraws after requesting an early start, the Consumer pays the proportionate price for performance supplied until withdrawal. The right of withdrawal is lost upon complete performance within that period only if the Consumer expressly consented to the early start and acknowledged in advance that the right would be lost upon complete performance.

The Provider refunds money received within 14 days after withdrawal using the same means of payment, unless the parties agree otherwise.

4. Model withdrawal notice

Addressee: Jan Pavlík, Školská 660/3, 110 00 Prague 1, Czech Republic, jan@pavlik.do

I hereby give notice that I withdraw from the contract for [identify the service], concluded on [date].

Consumer's full name: [complete]
Consumer's address: [complete]
Date: [complete]
Signature: [only if sent on paper]

If the Consumer wants immediate activation, they may state when accepting the quotation: "I expressly request that the service begin before the end of the 14-day withdrawal period. I acknowledge that, if I withdraw, I must pay a proportionate amount for performance already supplied and that, under the conditions laid down by law, I lose the right to withdraw once the service has been fully performed."

5. Conformity and complaints

The service must conform to the individual quotation, the Terms and statutory requirements. The Provider also supplies updates necessary to maintain its agreed and statutory conformity where they are part of the Provider's performance. A Consumer may complain at support@pavlik.do or the Provider's address, identifying the service, defect, when it appeared and the remedy requested. The Provider confirms receipt and resolution in writing.

The Consumer may request that the defect be remedied. If remedy is impossible, is not completed within a reasonable time, or the defect is serious, the Consumer may request an appropriate price reduction or terminate the contract as provided by law. The Provider handles the complaint within the statutory period; for a digital service, within a reasonable time having regard to its nature and purpose.

For a publicly available e-mail service, a complaint about the price or the supplied service must be made without undue delay and no later than 2 months after defective supply or delivery of the bill, otherwise the right expires. The Provider resolves it within 1 month, or within 2 months where resolution requires consultation with a foreign operator.

6. Changes to a continuous digital service

The Provider may change a continuous digital service beyond changes necessary to maintain conformity only for a valid reason, in particular a legal requirement, security or a change in the infrastructure used, without additional cost to the Consumer and after clear notice. Where the change negatively affects access to or use of the service more than only minimally, the Provider gives reasonable advance notice on a durable medium and the Consumer may terminate without penalty within 30 days after notice or implementation, whichever is later; this does not apply where the Provider allows the unchanged service to be retained without additional cost and without a defect.

7. Out-of-court dispute resolution

The Consumer should contact the Provider first. For a consumer dispute concerning hosting or another service outside the competence of the Czech Telecommunication Office, the competent entity is the Czech Trade Inspection Authority; information and the application are available on the CTIA website.

For a dispute concerning a publicly available e-mail service within the scope of the Czech Electronic Communications Act, the competent entity is the Czech Telecommunication Office, Sokolovská 219, Prague 9, e-mail spotrebitelskespory@ctu.gov.cz; information is available on the CTO website.

Effective from: 4 September 2026
Version: 1.1
Operator: Jan Pavlík, Company ID 72625635

1. Purpose

The purpose of this policy is to protect customers, users, third parties and the technical infrastructure against unlawful, harmful or disruptive use of the hosting services.

2. Prohibited use

The services must not be used for, in particular:

• malware, ransomware, trojans, malicious scripts or distribution of compromised files,
• phishing, pharming, theft of access or payment credentials, or impersonation,
• unsolicited bulk messages, e-mail harvesting or operating infrastructure that supports spam,
• botnets, DDoS attacks, their command and control, or providing the means for attacks,
• unauthorised scanning, intrusion, testing of other people's credentials or circumvention of security measures,
• fraudulent activity, counterfeit goods or deceptive offers,
• unlawful content or activity infringing the rights of third parties,
• unauthorised distribution of copyright-protected content,
• child sexual abuse material or other content whose possession or distribution is a criminal offence,
• threats, targeted harassment or publication of personal data contrary to law,
• operation that disproportionately loads, damages or endangers the infrastructure, other customers or the reputation of the address space.

The list is not exhaustive. What matters is the nature, impact, lawfulness and risk of the particular use.

3. Reporting abuse

Suspected abuse can be reported electronically to:

abuse@pavlik.do

Where possible, a report should contain:

• the domain, IP address and exact URL,
• a description of the problem and the reason for the report,
• the date and time of discovery, including the time zone,
• relevant headers, logs, screenshots or other supporting material,
• the contact details of the reporting party.

For notices of unlawful content under the DSA, the procedure set out in the DSA section on this page also applies.

4. Handling reports

Every sufficiently specific report will be assessed individually, in a timely, diligent, objective and proportionate manner. The Provider may in particular:

• request that the report be supplemented,
• contact the customer and require remedy,
• temporarily block specific content or access,
• isolate a compromised service,
• suspend or terminate the service,
• preserve necessary evidence,
• inform the competent authorities where the law or the seriousness of the situation requires it.

In urgent cases, in particular phishing, active malware, an attack in progress or immediate danger to persons or systems, the Provider may act immediately.

No action is taken solely on the basis of a manifestly unfounded, vague or unverifiable request. The Provider may, however, adopt a temporary security measure for the time needed to verify the matter.

5. Repeat infringement

Repeated or serious infringement may lead to restriction or termination of the service. The decision takes into account the number, seriousness, frequency, intent and impact of the infringements as well as the customer's previous cooperation. Any financial settlement is governed by the Terms and the individual agreement.

6. Contact

Technical support: support@pavlik.do
Abuse and unlawful content: abuse@pavlik.do
Legal communication: legal@pavlik.do

Effective from: 29 September 2026
Version: 1.2

This section sets out the information required by Regulation (EU) 2022/2065 of the European Parliament and of the Council on a Single Market for Digital Services (the "DSA").

1. Provider of the service

Jan Pavlík
Company ID: 72625635
Registered office: Školská 660/3, 110 00 Praha 1
Web: pavlik.do

2. Contact point for public authorities

For communication with the authorities of EU Member States, the European Commission and the European Board for Digital Services under Article 11 DSA:

legal@pavlik.do

Communication is possible in Czech, English and Spanish. The contact point is intended for electronic communication on DSA matters.

3. Contact point for recipients of the service

For direct and rapid electronic communication by customers and other recipients of the service under Article 12 DSA:

support@pavlik.do

Communication is handled by a human being; the contact does not rely solely on automated tools. Communication is possible in Czech, English and Spanish.

4. Notifying unlawful content

If you consider specific content hosted through my services to be unlawful, please report it electronically to:

abuse@pavlik.do

Use a subject line such as: DSA Notice – example.cz – https://example.cz/path.

To enable me to handle a notice, please provide:

1. a sufficiently substantiated explanation of why you consider the information to be unlawful content,
2. the exact URL or other unambiguous electronic identification of the content, and any further details needed to locate it,
3. the name and e-mail address of the reporting party; this is not required in the cases where the DSA permits anonymity for notices concerning certain child sexual abuse offences,
4. a statement that you are submitting the notice in good faith and that the information in it is, to the best of your knowledge, accurate and complete,
5. any available evidence or supporting material, if you have it.

5. Handling notices

Where a notice contains electronic contact details for the reporting party, I will confirm receipt without undue delay.

I do not generally monitor content proactively. Moderation is based mainly on specific notices, orders from public authorities, and security signals or logs. I do not use algorithmic decision-making to determine whether content is unlawful; intervention decisions are made by a human being.

I will assess the notice in a timely, diligent, objective and non-arbitrary manner. Depending on the circumstances I may request further information, contact the customer, leave the content in place, remove or disable it, or restrict or terminate the service.

I will inform the reporting party without undue delay of the decision concerning the reported content and of the remedies available.

6. Statement of reasons

Where I restrict specific content, a service, an account or a payment on grounds of unlawfulness or a breach of the terms, I will provide the affected recipient with a clear and specific statement of reasons in the cases set out in Article 17 DSA.

The statement of reasons may in particular contain:

• a description of the measure taken and its territorial and temporal scope,
• the facts and circumstances on which the decision was based,
• whether the decision followed a notice or my own investigation,
• the legal or contractual ground applied,
• whether automated means were used,
• the remedies available.

7. Remedies

The reporting party or the affected customer may request a free human review of the decision at legal@pavlik.do, setting out why they consider it incorrect. I will communicate the outcome without undue delay. This does not affect the right to turn to a competent court, administrative authority or Digital Services Coordinator where they have jurisdiction over the matter.

8. Suspicion of a serious criminal offence

If I become aware of information giving rise to a suspicion that a criminal offence involving a threat to the life or safety of a person has taken place, is taking place or is likely to take place, I will promptly inform the law-enforcement or judicial authorities of the Member State concerned and provide the relevant information available. If that Member State cannot be identified with reasonable certainty, I will inform the Czech authorities or Europol.

9. Personal data protection

I process personal data from notices only to the extent necessary to handle the notice, comply with legal obligations, secure the service and protect the rights of the persons concerned. Details are set out in the Privacy Notice.

Effective from: 4 September 2026
Version: 1.0

1. Scope and roles

This information supplements the general Privacy Notice at pavlik.do for hosting and e-mail services. The controller of customer, contract and operational data is Jan Pavlík, Company ID 72625635, Školská 660/3, 110 00 Prague 1, Czech Republic, e-mail jan@pavlik.do. For personal data stored by the customer in the service, the customer is generally the controller and the Provider is the processor under the DPA.

2. Data, purposes and legal bases

As controller, the Provider processes identification, contact, contract and billing data, service configuration, operational and security records, support communication and records of incidents, abuse or DSA notices. Data are obtained from the customer and its users, operation of the service, reporters, suppliers and authorised authorities.

Processing is necessary to take steps before and perform the contract, comply with legal obligations, and pursue legitimate interests in service security, prevention of abuse, support and protection of legal claims under Article 6(1)(b), (c) and (f) GDPR.

3. Recipients and international transfers

Where necessary, data may be received by infrastructure and hosting providers including Hetzner, Cloudflare, e-mail and telecommunications providers, domain registries and registrars, banks and professional advisers, and authorised authorities. Current sub-processors of hosted content are listed in the DPA. Transfers outside the European Economic Area rely on an adequacy decision, Standard Contractual Clauses or another safeguard permitted by the GDPR.

4. Retention

Ordinary server and security logs are retained for no more than three months unless an incident or legal claim requires longer. For a publicly available e-mail service, traffic data created or processed in providing the service are retained to the extent required by law for six months; message content is not retained in that statutory store. The data are destroyed afterwards unless a specific legal ground prevents this.

Contract and customer communication is retained for the relationship and applicable limitation periods, and accounting and tax records for their statutory periods, up to ten years where applicable. Abuse records, DSA notices and related decisions are generally retained for three years after the case is closed. Production data and backups are deleted under the contract and DPA.

5. Rights

Subject to the GDPR, a person may request access, rectification, erasure, restriction or portability and object to processing based on legitimate interests. Requests may be sent to jan@pavlik.do. A complaint may be submitted to the Czech Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, the Office’s contact page.

Effective from: 4 September 2026
Version: 1.1

This data processing agreement (the "DPA") forms part of the contractual relationship between the customer identified in the accepted quotation, order or main contract as controller of personal data (the "Controller") and:

Jan Pavlík
Company ID: 72625635
Registered office: Školská 660/3, 110 00 Praha 1

as processor (the "Processor").

The DPA applies where the Processor processes personal data on the Controller's behalf in the course of providing hosting or related services.

1. Subject matter and purpose of processing

The Processor processes personal data solely for the purpose of providing the ordered services, in particular web hosting, databases, e-mail, storage, DNS, backup, server services, monitoring, security, migration, restore and technical support.

The scope of the service and of the operations is determined by the contract, the order, the technical configuration and the Controller's documented instructions.

2. Duration of processing

Processing takes place for the duration of the service and thereafter for the period necessary to securely delete or return the data.

After the service ends, production personal data will be deleted or returned in accordance with Article 15 of this DPA. Backup copies containing it will then expire no later than during the next seven-day retention cycle, unless the law requires a longer period.

3. Nature of processing

Processing may include in particular:

• receipt, transmission and storage,
• organisation and making available to the Controller's systems,
• automated backup and restore,
• technical administration, monitoring and diagnostics,
• security, incident isolation and logging,
• migration, export, restriction and deletion.

The Processor does not actively use the content of the data for its own marketing or profiling purposes.

4. Categories of personal data

Depending on how the service is used, this may include in particular:

• identification and contact data,
• customer and contract data,
• user accounts and authentication data,
• IP addresses, device identifiers and technical logs,
• the content of electronic communications,
• the content of databases, documents and files,
• billing and transaction data,
• other personal data determined by the Controller.

Without a prior express written agreement, the service is not intended for special categories of personal data, data relating to criminal matters, full payment card data, or other processing requiring a special regulatory or security regime. The Controller is responsible for the lawfulness, proportionality and scope of personal data placed into the service and will verify that the agreed service is suitable before placing such data into it.

5. Categories of data subjects

Data subjects may include in particular customers, users of websites and applications, employees, contractors, applicants, business partners, suppliers, recipients and senders of communications, and other persons whose data the Controller processes through the service.

6. Controller instructions

The Processor processes personal data only on the Controller's documented instructions, including instructions to transfer personal data to a third country, unless the processing is required by EU or Member State law applicable to the Processor. In that case the Processor will inform the Controller in advance, unless the law prohibits this on important grounds of public interest.

The contract, the order, this DPA, the technical configuration carried out by the Controller and requests sent through the agreed contact channels are treated as documented instructions.

If the Processor considers that an instruction infringes the GDPR or other data protection rules, it will notify the Controller without undue delay and may suspend performance of the instruction until the matter is clarified.

7. Controller obligations and rights

The Controller shall in particular:

• be responsible for the legal basis and transparency of the processing,
• determine the purposes, scope and duration of the processing,
• provide data subjects with the necessary information,
• configure access and security for its own applications and accounts,
• not give the Processor an unlawful instruction,
• assess whether the agreed service matches the risk and sensitivity of the data,
• notify changes that materially affect the risk of the processing.

The Controller has the rights set out in the GDPR, this DPA and the main contract, in particular the right to give instructions, to obtain reasonable information and to verify the Processor's compliance.

8. Confidentiality and authorised persons

The Processor shall ensure that persons authorised to process personal data are bound by confidentiality or subject to an appropriate statutory obligation. Access will be limited to persons who need it for operation, support, maintenance, security or compliance with legal obligations.

9. Security of processing

The Processor shall adopt appropriate technical and organisational measures under Article 32 GDPR, having regard to the state of the art, the costs, and the nature, scope, context, purposes and risks of the processing.

To the extent applicable to the ordered service, the measures include:

• limiting administrator access to the Provider and reviewing permissions at least annually,
• individual SSH keys and multi-factor authentication where supported,
• encrypted transmission for administration and user access through supported protocols,
• hardening, security updates, firewalling, monitoring and security logging,
• daily backups and the last seven daily restore points where backup is part of the ordered service, and at least one sample restore test each year,
• a procedure for detecting, responding to and documenting security incidents,
• physical security provided by the data-centre operator.

The content of customer data will not be submitted to a generative artificial intelligence service without a documented instruction from the Controller.

The specific measures may evolve, but must not materially reduce the overall level of protection without an equivalent replacement.

10. Sub-processors

The Controller grants the Processor general written authorisation to engage sub-processors necessary for providing the service.

The sub-processors that may be engaged depending on the ordered service and its configuration are listed in Appendix B to this DPA.

The Processor shall impose on any sub-processor, by contract, substantially the same data protection obligations, in particular the provision of sufficient guarantees and appropriate security. The Processor remains liable to the Controller for the sub-processor's performance to the extent set out in the GDPR.

The Processor will inform the Controller at least 15 days in advance of an intended addition or replacement of a sub-processor. If a security incident or another urgent circumstance requires immediate engagement, the Processor will inform the Controller without undue delay and preserve its opportunity to object. The Controller may raise a specific and reasoned objection concerning data protection. The parties will attempt to find a reasonable solution; if none is possible, the affected service may be terminated.

11. Transfers to third countries

The core hosting infrastructure is operated within the European Economic Area, in particular in Germany.

By accepting this DPA the Controller gives a documented instruction to transfer personal data to the sub-processors listed in Appendix B, on the conditions and under the legal mechanism stated for each of them. Beyond Appendix B, the Processor will not transfer personal data outside the EEA without a separate documented instruction from the Controller and an appropriate mechanism under the GDPR, such as an adequacy decision or standard contractual clauses. Where necessary it will assess the legal environment of the destination country and adopt supplementary measures.

12. Personal data breach

If the Processor identifies a breach of security of personal data processed on the Controller's behalf, it will notify the Controller without undue delay after becoming aware of it.

To the extent of the information available, it will in particular state:

• the nature of the incident and the systems affected,
• the categories and approximate volume of data and data subjects affected,
• the likely consequences,
• the remedial measures taken or proposed,
• a contact point for further communication.

Information may be provided in phases. The Controller is responsible for assessing and discharging notification duties towards the supervisory authority and data subjects, unless the law provides otherwise.

13. Data subject rights

If the Processor receives a data subject request concerning data processed on the Controller's behalf, it will forward it to the Controller or inform the Controller of it without undue delay, unless the law prevents this. It will not substantively comply with the request without the Controller's instruction, unless legally obliged to do so.

Having regard to the nature of the processing, the Processor will provide the Controller with reasonable technical and organisational assistance in handling requests.

14. Assistance and audits

The Processor will provide reasonable assistance needed for the Controller to discharge its obligations under Articles 32 to 36 GDPR, having regard to the nature of the processing and the information available to it.

On reasonable request it will provide the information needed to demonstrate compliance with Article 28 GDPR and allow an audit carried out by the Controller or by an independent auditor appointed by the Controller.

An audit must be notified in advance, take place during working hours, not unreasonably disrupt operations, and not endanger the security or rights of other customers. Available reports, certifications and remote verification will be used first. Unless the audit is required by a supervisory authority or by reasonable suspicion of a serious breach, the Processor may require reimbursement of the reasonable costs of an individual audit.

The Processor will inform the Controller immediately if, in its view, an audit request endangers the confidentiality or security of another person, and will offer a reasonable alternative means of verification.

15. Return and deletion of data

After the provision of the service ends, the Processor will, at the Controller's choice, return the personal data in a commonly available format or delete it and delete existing copies, unless EU or Member State law requires it to be retained.

The Controller shall state its choice and, where applicable, carry out an export before the service is terminated. If the Controller does not state another choice in time, deletion is deemed selected. Production data not returned earlier will be deleted no later than 30 days after termination. Backup copies containing it will then expire no later than during the next seven-day retention cycle. Until then they will remain protected, be used only for restore, and, if restored, be enrolled for deletion again.

16. Order of documents and liability

In matters of personal data processing, this DPA prevails over the general provisions of the Terms. The parties' liability is governed by the GDPR, the main contract and the Terms; no contractual limitation applies where the law does not permit it.

17. Final provisions

The DPA takes effect at the same time as the main contract and lasts until the Processor's processing of personal data ends. The provisions on confidentiality, security, audit, liability and deletion of data survive termination to the extent appropriate to their nature.

The legal relationship is governed by the law of the Czech Republic, without prejudice to the directly applicable rules of the GDPR.

Appendix A – Processing overview

Subject matter: provision of individually agreed hosting and related services.
Duration: for the term of the service and the technical retention period after it ends.
Purpose: operation, storage, transmission, backup, support and security of the Controller's systems.
Nature of operations: as per Article 3.
Categories of data: as per Article 4.
Categories of data subjects: as per Article 5.
Frequency: continuous, according to the Controller's use of the service.

Appendix B – Sub-processors

The Processor uses the following sub-processors: