Data processing agreement for your hosting at WWW4
Hosting is by definition processing of personal data: your database, your visitors' uploads, the contents of your mailboxes and the server logs physically sit on our servers. The GDPR (Article 28) requires a written agreement for that between you as controller and JAAN bv as processor. That data processing agreement is free and available on request, even before you become a customer.
On this page you can read why you need it, what it contains, how to request it and what you arrange yourself alongside it. The page is an explanation; only the signed agreement is binding.
Why hosting is always processing
A contact form stores a name and email address in your database. A webshop keeps customers, addresses and orders. A mailbox holds your staff's correspondence. And the web server logs the IP address of every visitor. None of that data sits in your office; it sits on a server of JAAN bv. That makes us a processor within the meaning of the GDPR, and you must have an agreement with us that sets out what we may do with that data, how we secure it and what happens when you leave.
That applies to a webshop with a thousand customers just as much as to an association with a member list and three mailboxes. Without a data processing agreement you cannot demonstrate, in the event of a complaint or an inspection, that you engaged your hosting provider correctly. That shortcoming lies with you as controller, not with us.
You: controller
You decide which data your website and mailboxes collect, why, and how long you keep it. You take care of the legal basis, the privacy statement and the response to anyone who wants to access or erase their data. What your CMS and your plugins do with data is your responsibility.
JAAN bv: processor
JAAN bv stores your files, database and mailboxes on its servers, keeps them reachable, backs them up daily and logs what is needed to deliver and secure the service. Not for its own purposes, and only on your instructions. We do not look into your data unless you ask us to for support.
What the agreement covers
The agreement follows the structure prescribed by Article 28 GDPR. These are the eight parts, in plain language and applied to hosting.
Subject matter and duration
Hosting your website(s), databases and mailboxes on the servers of JAAN bv, for the term of your hosting contract. A VPS or a dedicated server is covered as well.
Nature and purpose
Storing, keeping available, backing up and logging, solely to deliver the service you purchase and to secure it. No analysis, no reuse.
Categories of data and data subjects
Everything you put on the server yourself: customer and user data in your database, form submissions, uploads, the contents of mailboxes and IP addresses in the server logs. Data subjects are your customers, members, staff and visitors. You fill in what applies to you.
Security measures
Own servers in Belgian data centers, daily backup of files and database, DDoS protection at network level, maintenance of the server side and separate FTP accounts and mailbox passwords per person. The full list is attached to the agreement as an annex.
Sub-processors
Other companies may be involved for supporting services. The current list forms part of the agreement; a new sub-processor is only engaged with notice to you, so that you can object.
Assistance with requests and data breaches
If a data subject asks for access or erasure, it is your move in your own CMS; if you need something from the server for that, we help. A data breach affecting your data we report to you without undue delay, with what we know about its nature and extent.
Return or deletion at the end
You can download your files and database yourself via FTP and the control panel until the end. Afterwards we delete the environment; backups expire after their 14-day retention period. Where a legal retention obligation applies, the agreement says so.
Audit
You have the right to verify compliance. JAAN bv cooperates in a way that does not disrupt the service to other customers on the same servers.
How to request the data processing agreement
Four steps, no legal department needed. Allow a few working days between the request and the signed copy.
Request it via the contact form
State your company or association name, your company number if you have one, and the email address of the person authorised to sign. Not a customer yet? Say so; you may read the text in advance.
Read the agreement through
You receive the text with the annexes (security measures and sub-processors) by email. Pay particular attention to the categories of data: a webshop with customer accounts fills that in differently than an association with a member list.
Ask your questions before you sign
Unclear what a clause means for your situation? Call +32 9 328 03 83 or reply to the email. Adjustments are open to discussion as long as they respect the core of Article 28.
Sign and file your copy with your record
Sign, send it back and file the copy signed by both parties with your record of processing activities. In an inspection, that is the document they ask for.
What you arrange yourself alongside it
A data processing agreement covers the processor. These points remain your responsibility, and you need them to fill in the agreement correctly.
Unsure about the legal basis of a processing activity or about a retention period? That question is for your DPO or legal adviser. JAAN bv explains how the hosting works, but does not judge your processing.
Why the chain at WWW4 is short
Server, backup, mail and support all sit with JAAN bv itself, on our own hardware in Belgian data centers. There is no intermediate hosting party and no support layer outside the EU. That makes the agreement shorter and your record of processing activities clearer: one processor, one country, one point of contact.