Very Easy Web Hosting · Version 1.0 · 4 November 2026
1. Scope and roles
This addendum applies when Ashley Deutschmann trading as Very Easy Web Hosting processes personal information on behalf of a customer in supplying an accepted hosting, Mail, Cloud, managed website or related service. The customer is the controller or responsible party; we are its processor or operator. If the customer acts as a processor, it confirms authority from its controller and passes on the applicable instructions. This addendum does not turn our independent billing, fraud-prevention, security or identity-service purposes into processing on the customer's behalf; those purposes are explained in the privacy notice.
The subject matter is operating and supporting the ordered service. Processing includes receipt, storage, organisation, transmission, retrieval, backup, recovery and deletion. Duration is the contract period plus the agreed retrieval, backup-expiry and legally required retention periods. The purpose is solely to provide and secure the service under documented lawful instructions.
Data subjects may include the customer's staff, clients, contacts, website visitors, account holders and, for educational customers, students and teachers. Data may include identifiers, contact details, account information, correspondence, files, website submissions and technical logs. Special-category or other especially sensitive information is included only where the customer has a lawful basis, documents the categories and agrees appropriate safeguards before using the service for that purpose. Standard hosting is not an assurance that every regulated workload is suitable.
2. Instructions and confidentiality
We process only on documented instructions, including those about transfers, unless law requires otherwise. We notify the customer of a legal requirement before processing where permitted. We promptly inform the customer if an instruction appears to infringe applicable data-protection law and may suspend that instruction while the issue is resolved.
People authorised to process the information are subject to confidentiality obligations and receive access only as needed for their duties. We do not sell customer-hosted information, use it for unrelated advertising, or train general-purpose AI models on it as part of this processing service. Support access is limited to the task and appropriate authorisation.
3. Security measures
We maintain measures proportionate to the processing risk, including access control and least privilege, protection of privileged access, encrypted network connections where supported, patch and vulnerability management, logging, separation of customer access, incident response and controlled backup/recovery arrangements where included. The service specification records applicable encryption, backup frequency, retention, recovery expectations and customer responsibilities. No unverified certification or end-to-end encryption guarantee is implied.
We review the effectiveness of relevant measures and do not materially reduce the agreed protection during the contract without an appropriate equivalent safeguard. The customer controls its users, devices, content permissions, lawful collection and application-level configuration outside our managed scope.
4. Subprocessors
The customer authorises only the subprocessors identified in the service-specific register supplied before processing starts. The register identifies the legal provider, function, processing locations and applicable transfer safeguards. A generic list of possible suppliers is not the approval register.
We give at least 30 days' notice of a proposed new or replacement subprocessor where practicable. The customer may raise a reasonable data-protection objection during that period. We work on a suitable alternative; if none is feasible, either party may end the affected service before the change, with a refund of unused prepaid service fees. An emergency replacement needed to protect availability or security is notified as soon as practicable, with the same right to raise a reasonable objection and seek a remedy.
We impose materially equivalent relevant data-protection obligations by written agreement and remain responsible for our subprocessors' performance of those obligations as required by applicable law. A payment provider, independent registrar or identity provider acting for its own purposes is not inaccurately described as our subprocessor for those purposes.
5. Assistance and incidents
We assist, taking account of the nature of processing and information available to us, with data-subject requests, security obligations, breach assessment, impact assessments and consultation with authorities. We promptly forward requests concerning customer-controlled content and do not independently decide the substantive response unless authorised or legally required.
We notify the customer without undue delay after becoming aware of a personal-data breach affecting the processing. For POPIA operator processing, we notify the responsible party immediately where the statutory notification trigger is met. We provide the available nature of the incident, affected information and people, likely consequences, contact point and containment or remediation measures, with updates as facts become available. We do not wait for a complete investigation before the initial notice.
The customer is responsible for its controller notifications and we provide reasonable assistance. No contractual provision prevents a regulator or data subject receiving a notification required by law. Reasonable pre-agreed fees may apply to exceptional assistance beyond the ordinary service, but not as a condition of necessary incident notification or correction of our own breach.
6. Demonstrating compliance
We provide information reasonably necessary to demonstrate compliance with this addendum and permit proportionate audits or inspections by the customer or its mandated independent auditor, subject to confidentiality and safeguards for other customers. Existing independent reports may satisfy an ordinary request where adequate. Scheduling, scope and reasonable costs are agreed in advance, without obstructing a mandatory regulator request, urgent incident investigation or legally required audit. No clause gives unrestricted access to other customers' data.
7. Transfers
Processing locations and onward transfers are documented in the service register. Where GDPR, UK GDPR or POPIA restricts an international transfer, the parties implement the applicable lawful mechanism before that transfer, such as a valid adequacy basis or the appropriate executed standard contractual clauses and supplementary measures following the required assessment. This addendum alone is not an executed EU or UK international-transfer instrument and does not assert that every country offers adequate protection. Remote access from a different country is included in the assessment where applicable.
8. Return and deletion
At the customer's choice, we return or delete customer personal information after the service ends, subject to the agreed retrieval period and any legal retention requirement. We delete existing copies through the applicable controlled lifecycle, including backup rotation; retained backup copies are restricted against ordinary use and expire according to the agreed schedule. If a backup must be restored, valid deletion instructions are reapplied where relevant. We provide confirmation of completed deletion on reasonable request. Statutory records retained for our own legal duties are restricted and handled under our privacy notice.
9. Applicable protection
The parties comply with the data-protection law applicable to their respective activities, including POPIA and GDPR or UK GDPR where applicable. This addendum does not remove a regulator's powers or a person's statutory rights. Mandatory standard-contractual-clause provisions prevail where executed. The commercial agreement governs other matters only insofar as consistent with this addendum and mandatory law.
Service record to accompany each processing order
The order must record: customer and authorised instruction contact; service and purpose; data-subject groups and data categories; any special-category data; duration and deletion arrangements; approved subprocessors and actual processing locations; transfer instruments where required; relevant technical and organisational measures; agreed backup and restoration scope; and incident contact. Processing requiring additional safeguards begins only after those safeguards and the record are agreed.