Data Processing Agreement (DPA)

1. Preamble, Scope, and Definitions

1.1. This Data Processing Agreement ("DPA") forms an integral and legally binding part of the Terms of Service ("Principal Agreement") between WP in EU (WPinEU.com), operated by administraktor.com, located in Zagreb, Republic of Croatia (hereinafter referred to as the "Processor" or "WPinEU"), and the registered user or entity utilizing WPinEU's web hosting services (hereinafter referred to as the "Controller" or "Customer").

1.2. Applicability: This DPA applies strictly to the extent that WPinEU processes Personal Data on behalf of the Controller within the hosted environment (including cPanel accounts, WordPress installations, MySQL databases, electronic mail accounts, and subdomains under wpat.eu or custom addon domains) that is subject to Regulation (EU) 2016/679 (General Data Protection Regulation — "GDPR") and the Croatian Act on the Implementation of the General Data Protection Regulation (Zakon o provedbi Opće uredbe o zaštiti podataka).

1.3. Exclusion of Household Activities and Platform Account Data: This DPA does not apply where the Customer is a natural person utilizing the hosting service exclusively in the course of a purely personal or household activity within the meaning of GDPR Article 2(2)(c). Furthermore, this DPA does not govern Personal Data that WPinEU collects and processes as an independent Data Controller regarding the Customer's own account registration, EU residency verification, support communications, and platform abuse prevention, which are governed exclusively by the WPinEU Privacy Policy.

1.4. All capitalized terms not defined herein ("Personal Data", "Processing", "Data Subject", "Personal Data Breach", "Supervisory Authority") shall have the meaning assigned to them in Article 4 of the GDPR.

2. Subject Matter, Nature, Purpose, and Duration of Processing

2.1. Subject Matter: The provision of European Union-based web hosting infrastructure, including cPanel server management, NVMe SSD storage, LiteSpeed web serving, Redis caching, MySQL database hosting, electronic mail hosting, automated malware scanning (ImunifyAV), and daily automated backups (JetBackup).

2.2. Nature and Purpose of Processing: WPinEU processes Personal Data solely for the purpose of provisioning, maintaining, securing, backing up, and transmitting the websites, applications, databases, and electronic mail configured by the Controller within the hosting environment, as detailed in Annex I.

2.3. Duration of Processing: Processing shall commence upon the creation of the Controller's hosting account and shall continue for the duration of the Principal Agreement until the deletion or termination of the hosting account, plus the applicable backup overwrite and log retention periods specified in Section 10 and Annex I.

3. Obligations of the Controller (The Customer)

3.1. The Controller warrants that it has established a valid legal basis under GDPR Article 6 (and Article 9, where applicable) for all Personal Data collected, stored, or transmitted via its hosted websites, databases, and email accounts.

3.2. The Controller is solely responsible for publishing an accurate Privacy Notice and Cookie Notice on its own hosted WordPress or web properties, responding to Data Subject rights requests from its website visitors, and ensuring the security of its application-level credentials, WordPress plugins, themes, and user accounts.

4. Obligations of the Processor (WPinEU)

4.1. Processing on Documented Instructions (GDPR Art. 28(3)(a)): WPinEU shall process Hosted Personal Data only on documented instructions from the Controller, unless required to do so by European Union or Croatian law; in such a case, WPinEU shall inform the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest. The Parties agree that the Controller's configuration and use of cPanel tools, WordPress/Softaculous applications, MySQL databases, email services, ImunifyAV security scans, and JetBackup snapshots constitute the Controller's complete and documented instructions to WPinEU.

4.2. Confidentiality (GDPR Art. 28(3)(b)): WPinEU ensures that all personnel and system administrators authorized to process or maintain the hosting infrastructure have committed themselves to strict confidentiality or are under an appropriate statutory obligation of confidentiality. WPinEU shall not access, inspect, or modify the contents of the Controller's files, MySQL databases, or email accounts except as strictly necessary to resolve a support ticket initiated by the Controller, execute automated security/malware scans (ImunifyAV), maintain server stability, or comply with a binding legal order under the EU Digital Services Act.

4.3. Strict European Union Data Sovereignty (GDPR Chapter V): All WPinEU servers, storage arrays, and backup repositories are located exclusively within data centers inside the European Union / European Economic Area (EU/EEA). WPinEU shall not transfer Hosted Personal Data outside the EU/EEA without the prior written consent of the Controller and the implementation of Chapter V GDPR safeguards.

5. Technical and Organizational Security Measures (GDPR Art. 32)

5.1. Taking into account the state of the art, the nature of free educational and professional web hosting, and the risks to Data Subjects, WPinEU implements and maintains the Technical and Organizational Measures ("TOMs") set out in Annex II of this DPA, including CloudLinux account isolation, SSL/TLS encryption in transit, ImunifyAV malware detection, DDoS network mitigation, and encrypted daily JetBackup snapshots.

6. Engagement of Sub-Processors (GDPR Art. 28(2) and 28(4))

6.1. General Written Authorization: The Controller hereby grants WPinEU general written authorization to engage third-party Sub-Processors (specifically EU-based data center colocation/infrastructure providers and network DDoS mitigation providers) necessary to deliver the hosting service, as listed in Annex III.

6.2. Notice of Changes and Right to Object: WPinEU shall update the Sub-Processor list on its website at least fourteen (14) days prior to authorizing any new Sub-Processor to process Hosted Personal Data. If the Controller objects to a new Sub-Processor on reasonable data protection grounds, the Controller may terminate its free hosting account immediately prior to the engagement of the new Sub-Processor.

6.3. Flow-Down Obligations: Where WPinEU engages a Sub-Processor, WPinEU shall impose data protection obligations on the Sub-Processor by way of a written contract under GDPR Article 28(4) that provide at least the same level of protection as set out in this DPA.

7. Assistance with Data Subject Rights and Controller Compliance (GDPR Art. 28(3)(e)-(f))

7.1. Because the Controller retains direct, full self-service control over its files, MySQL databases, and email accounts via the cPanel interface and phpMyAdmin, the Controller is technically capable of fulfilling Data Subject requests for access, rectification, erasure, restriction, and data portability directly.

7.2. Where the Controller cannot fulfill a Data Subject request independently via cPanel, WPinEU shall, taking into account the nature of the processing, assist the Controller by appropriate technical and organizational measures, insofar as this is possible, upon receipt of a written support ticket via the Client Area or support@wpineu.com.

7.3. WPinEU shall assist the Controller in ensuring compliance with obligations pursuant to GDPR Articles 32 to 36 (security of processing, notification of breaches, and data protection impact assessments), taking into account the nature of processing and the information available to WPinEU.

8. Personal Data Breach Notification (GDPR Art. 33)

8.1. In the event of a confirmed Personal Data Breach affecting the underlying WPinEU server infrastructure, storage arrays, or cPanel environment that compromises the confidentiality, integrity, or availability of the Controller's Hosted Personal Data, WPinEU shall notify the Controller without undue delay (and where feasible, within 48 hours) after becoming aware of the breach via the email address registered to the Controller's account.

8.2. Such notification shall describe the nature of the breach, the categories of data affected, the likely consequences, and the remedial measures taken or proposed by WPinEU to mitigate its effects. Unsuccessful security incidents (such as blocked DDoS attacks, failed brute-force login attempts, port scans, or quarantined malware caught by ImunifyAV that do not result in unauthorized access to Personal Data) shall not constitute a reportable Personal Data Breach under this Section.

9. Audits and Demonstration of Compliance (GDPR Art. 28(3)(h))

9.1. WPinEU shall make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in GDPR Article 28.

9.2. Given the multi-tenant shared hosting architecture and the necessity of protecting the security and confidentiality of other tenants on WPinEU servers, physical data center access is restricted. Compliance audits shall be satisfied primarily through WPinEU providing written security documentation, infrastructure certifications of its upstream EU data centers, and responses to reasonable written security questionnaires submitted by the Controller no more than once per calendar year.

10. Deletion and Return of Personal Data Upon Termination (GDPR Art. 28(3)(g))

10.1. Prior to terminating the hosting account, the Controller may export and download all website files, MySQL databases, and email archives in standard structured formats directly via the cPanel Backup Wizard or JetBackup interface.

10.2. Upon termination or deletion of the Controller's hosting account, WPinEU shall permanently delete the Controller's live website files, MySQL databases, and email accounts from active NVMe storage, unless European Union or Croatian law requires temporary preservation (e.g., in response to a valid preservation order from law enforcement or HAKOM).

10.3. Residual copies contained within encrypted JetBackup snapshots shall remain isolated and shall be automatically and irreversibly overwritten upon the completion of the standard backup rotation cycle, and server access logs shall be purged within a maximum of twelve (12) months.

11. Governing Law and Jurisdiction

11.1. This DPA shall be governed by and construed in accordance with the laws of the Republic of Croatia and the directly applicable regulations of the European Union. The competent lead supervisory authority for WPinEU is the Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka — AZOP), Zagreb, Croatia.

ANNEX I TO THE DPA: DESCRIPTION OF THE PROCESSING

ANNEX II TO THE DPA: TECHNICAL AND ORGANIZATIONAL MEASURES (TOMs — GDPR ART. 32)

ANNEX III TO THE DPA: AUTHORIZED INFRASTRUCTURE SUB-PROCESSORS