XServer – we build Internet
Language
Currency
Login
Data Processing Agreement (DPA) — XServer

Data Processing Agreement (DPA)

Annex No. 1 to the Public Terms of Service

Forms an integral part of the Public Terms of Service
(pursuant to Article 28 of the General Data Protection Regulation / GDPR (EU) 2016/679)
Version 1.1. Effective date: 20.10.2026
This DPA is governed by the laws of the Republic of Estonia and the European Union.

  1. Subject Matter and Roles of the Parties

    1. This Data Processing Agreement ("DPA") forms an integral part of the Public Terms of Service for dedicated and virtual server rental services (hereinafter referred to as the "Agreement").
    2. Within the scope of this DPA:
      • The Customer acts as the Data Controller of personal data hosted or processed using the Provider’s infrastructure.
      • The Provider (XServer OÜ, Harju maakond, Tallinn, Kesklinna linnaosa, Kaupmehe tn 7-120, 10114) acts as the Data Processor of such personal data.
    3. This DPA automatically enters into force upon the Customer’s acceptance of the Public Terms of Service and ordering of the Services.

  2. Subject Matter, Nature, and Purpose of Processing

    1. Subject Matter and Purpose: Providing the Customer with computing resources, virtual (VDS) and dedicated server rental services, connectivity, storage space, and related technical support.
    2. Types of Data: All types of personal data uploaded, transmitted, or stored by the Customer or its end-users on the Provider's server equipment.
    3. Categories of Data Subjects: Customer’s end-users, employees, contractors, or any other individuals whose data is processed by the Customer using the Provider’s services.
    4. Duration of Processing: The entire duration of the Service Agreement until full deletion of data in accordance with Section 8 of this DPA.

  3. Obligations of the Processor (Provider)

    The Provider undertakes to:
    1. Instructions of the Controller: Process personal data solely on documented instructions from the Customer (including configurations and settings performed by the Customer in the control panel), unless otherwise required by European Union or Republic of Estonia law.
    2. Confidentiality: Ensure that all Provider personnel who have access to the Customer's infrastructure and data are bound by strict confidentiality obligations.
    3. Security Measures (TOMs): Apply appropriate technical and organizational security measures pursuant to Art. 32 GDPR to protect the infrastructure (see Section 4).
    4. Requests from Government Authorities: Not disclose Customer personal data to third parties or government authorities, unless mandatory under Republic of Estonia law or EU law, or pursuant to a lawful order of an EU court or competent EU authority.
    5. Data Location and International Transfers: Personal data shall be hosted and stored exclusively within the data center location selected by the Customer. Ordering Services in a specific data center (including locations within the EU/EEA, as well as outside the EU/EEA — such as the UK, USA, Ukraine, etc.) constitutes a direct documented instruction and explicit consent of the Customer to process and store data within the respective jurisdiction. The Provider shall not transfer or migrate Customer data to other countries without additional instructions or confirmation from the Customer.

  4. Technical and Organizational Security Measures (TOMs)

    1. The Provider ensures infrastructure protection directly and/or through certified partner data centers (Sub-processors):
      • Data Center Physical Security: 24/7 security personnel, physical access control systems (ACS), CCTV surveillance, restricted access to server rooms.
      • Access Control: Segregation of administrative access based on the Principle of Least Privilege and multi-factor authentication (2FA).
      • Fault Tolerance: Power redundancy (UPS, backup diesel generators) and climate control systems.
      • Hypervisor-Level Customer Isolation (for virtual servers).
      • Logging and Monitoring.
      • Hypervisor Security Patching.
    2. The Customer is solely responsible for configuring encryption, backups, and access rights management within its own operating system and applications installed on the rented server.

  5. Engagement of Sub-processors

    1. The Customer grants general authorization to the Provider to engage third parties (data centers, telecom operators, payment processors) as Sub-processors.
    2. The Provider guarantees that obligations regarding data protection no less stringent than those set out in this Agreement are imposed on each Sub-processor.
    3. An up-to-date list of key infrastructure partners and data centers (Sub-processors) shall be provided to the Customer upon written request (via the ticket system or email).
    4. In the event of planned changes to Sub-processors, the Provider shall notify the Customer via email no later than 14 (fourteen) days prior to engaging the new Sub-processor. The Customer has the right to object to such a change on reasonable grounds within this timeframe. If the Parties cannot reach an agreement regarding the new Sub-processor, the Customer shall have the right to terminate the Agreement prematurely and receive a refund for the unused prepaid balance of Services. The absence of objections within 14 days shall be deemed acceptance of the change.

  6. Notification of Incidents and Requests

    1. Data Breach Notification: In the event of a confirmed security incident at the Provider's infrastructure level leading to a breach or loss of Customer data, the Provider undertakes to notify the Customer within 48 hours of discovery.
    2. Data Subject Rights: Since the Provider provides infrastructure (unmanaged) servers and has no direct access to the Customer’s databases, all requests from individuals (data subjects) exercising their rights (access, erasure, rectification) shall be directed to the Customer. The Provider undertakes to provide reasonable technical assistance to the Customer in fulfilling such requests where technically feasible.

  7. Audit Rights and Compliance Verification

    1. The Provider shall, upon the Customer's written request, make available information and documentation necessary to demonstrate compliance with the obligations laid down in Art. 28 GDPR and this DPA.
    2. Compliance verification shall primarily be carried out by providing the Customer with available security certificates, data center audit reports, or internal reports of the Provider.
    3. If the provided documentation is objectively insufficient, the Customer (or a designated independent auditor) shall have the right to conduct an audit directly. The procedure, dates (at least 30 days' prior written notice), scope, and confidentiality terms of such audit shall be agreed upon by the Parties separately. All costs associated with conducting the audit shall be borne by the Customer.

  8. Deletion and Return of Data

    1. Upon expiration or termination of the Agreement, the Customer is granted an opportunity to export its data within a Data Export Period of 23 days for virtual servers and 7 days for physical servers.
    2. Following the expiration of the retention period, the Provider shall permanently and irrevocably delete all data and virtual machines from physical storage media, unless data retention is required by EU/Estonian law.

This website uses cookies to enhance user experience and analyze website traffic. By clicking «Accept», you consent to the use of cookies.