pursuant to Article 28 of Regulation (EU) 2016/679 (GDPR)
This Data Processing Agreement (the “DPA”) forms an annex to the Terms of Service for GigantHost and applies whenever a User stores or otherwise processes personal data of third parties through the Service, particularly in the case of business and B2B customers.
- Controller: the User of the Service.
- Processor: CODECYBER s.r.o., Company ID No. 29690242, with its registered office at Korunní 2569/108, 101 00 Prague 10 (the “Operator”).
Effective from: 27 July 2026 | Version: 1.0
1. Subject matter and duration
1.1. The Processor processes personal data for the Controller solely for the purpose of providing the Service, including the storage, technical processing, transmission and disclosure of Content on the Controller’s instructions.
1.2. This DPA remains in effect for as long as the Processor processes personal data for the Controller within the Service.
2. Nature, purpose and scope of processing
- Nature of processing: hosting, retention, technical processing, access, transmission and deletion of data.
- Purpose: provision of online storage and data sharing under the agreement.
- Types of data: any personal data contained in Content uploaded by the Controller; the Controller determines its scope.
- Categories of data subjects: any data subjects whose personal data the Controller uploads to the Service, such as employees, clients and contacts.
3. Controller’s instructions
3.1. The Processor processes personal data only on the Controller’s documented instructions, which consist of the Terms of Service, this DPA and the settings or actions selected by the Controller within the Service.
3.2. The Processor will inform the Controller if it believes that an instruction infringes the GDPR or other applicable law.
4. Confidentiality
The Processor will ensure that persons authorised to process personal data are bound by contractual or statutory confidentiality obligations.
5. Security (Article 32 GDPR)
The Processor will implement appropriate technical and organisational measures corresponding to the risk and the low-cost nature of the Service, including encryption in transit, access controls, server security and technical operational backups. The Processor does not provide a separate backup service for the Controller’s Content.
6. Other processors (sub-processors)
6.1. The Controller grants the Processor general authorisation to engage other processors, particularly hosting and data-centre providers and providers of payment and communication services.
6.2. The Processor will impose equivalent data-protection obligations on its sub-processors and will inform the Controller of intended changes by appropriate means so that the Controller has an opportunity to object.
7. Assistance to the Controller
7.1. Taking account of the nature of the processing and the information available, the Processor will reasonably assist the Controller in responding to requests from data subjects under Articles 12–23 GDPR and in meeting the obligations under Articles 32–36 GDPR.
7.2. If a data subject sends a request directly to the Processor, the Processor will forward it to the Controller without undue delay.
8. Personal data breaches
The Processor will notify the Controller of a personal data breach without undue delay after becoming aware of it and will provide the assistance necessary for the Controller to meet its notification obligations under Articles 33 and 34 GDPR.
9. Transfers outside the EU/EEA
Transfers outside the EU/EEA will take place only where appropriate safeguards under Articles 44 et seq. GDPR are in place, in particular Standard Contractual Clauses or an adequacy decision.
10. Deletion or return of data after termination
After the Service ends, the Processor will, at the Controller’s choice and in accordance with the Terms of Service, delete the personal data or enable its export. Content remains available for download for 14 days and technical backups are deleted within no more than 30 days, unless applicable law requires further retention.
11. Audits and information
The Processor will provide the Controller with the information necessary to demonstrate compliance with Article 28 GDPR and will permit audits to an extent reasonable for the low-cost nature of the Service, generally by providing documentation and evidence of infrastructure-provider certifications.