GDPR Compliance

Last updated: 26 March 2026

1. Overview

The General Data Protection Regulation (GDPR) is a European Union regulation that came into force on 25 May 2018. The United Kingdom has retained equivalent legislation through the UK GDPR and the Data Protection Act 2018 following Brexit.

ETX Hosting is fully committed to GDPR compliance. This page explains our obligations as a data controller and data processor, your rights as a data subject, and how we handle personal data in accordance with the law.

2. Data Controller

ETX Hosting acts as the data controller for personal data collected from visitors to our website, registered account holders, and support contacts.

When you use ETX Hosting to host your own website or services that collect personal data from third parties, ETX Hosting acts as a data processor on your behalf. In this case, you are the data controller and are responsible for ensuring you have a lawful basis for processing your users' data.

3. Data Processing Agreement (DPA)

As a data processor for your hosted services, we offer a Data Processing Agreement (DPA) that satisfies GDPR Article 28 requirements. The DPA covers:

• The nature and purpose of the processing
• The type of personal data processed
• Our security obligations
• Sub-processor management
• Your right to audit
• Data deletion and return procedures

To request a DPA, email [email protected].

4. Lawful Basis for Processing

We process personal data under one or more of the following lawful bases:

• Contract (Article 6(1)(b)) — Processing necessary to deliver the hosting services you have subscribed to
• Legitimate Interests (Article 6(1)(f)) — Security monitoring, fraud prevention, and service improvement, where these interests are not overridden by your rights
• Legal Obligation (Article 6(1)(c)) — Compliance with applicable law, including tax and accounting requirements
• Consent (Article 6(1)(a)) — Marketing communications and non-essential analytics cookies, which you may withdraw at any time

5. Your Rights Under GDPR

As a data subject under the UK GDPR / EU GDPR, you have the following rights:

Right of Access (Article 15)

You have the right to request a copy of the personal data we hold about you, along with information about how we use it.

Right to Rectification (Article 16)

If any of the personal data we hold about you is inaccurate or incomplete, you have the right to request correction.

Right to Erasure / "Right to be Forgotten" (Article 17)

You may request deletion of your personal data where it is no longer necessary for the purpose it was collected, where you have withdrawn consent, or where we have no other lawful basis for processing.

Right to Restriction of Processing (Article 18)

You may request that we restrict how we process your data in certain circumstances, for example while a rectification request is being assessed.

Right to Data Portability (Article 20)

Where processing is based on consent or contract, you have the right to receive your personal data in a structured, commonly used, machine-readable format, and to transmit that data to another controller.

Right to Object (Article 21)

You have the right to object to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we can demonstrate compelling legitimate grounds.

Rights Related to Automated Decision-Making (Article 22)

ETX Hosting does not make solely automated decisions that have a significant legal or similarly significant effect on you.

6. Making a Data Subject Access Request

To exercise any of your rights, submit a request to:

• Email: [email protected]
• Subject line: "Data Subject Request — [Your Name]"

We will respond within 30 days of receiving your request. For complex or multiple requests, this may be extended by a further 2 months, in which case we will notify you.

We may need to verify your identity before processing your request. We will not charge a fee for reasonable requests.

7. International Data Transfers

ETX Hosting primarily processes data within the UK and EEA. Where data is transferred to third countries, we ensure adequate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the relevant supervisory authority
• Adequacy decisions by the UK Secretary of State or European Commission
• Binding Corporate Rules where applicable

8. Data Breach Notification Procedure

In the event of a personal data breach, ETX Hosting will:

• Notify the relevant supervisory authority (ICO in the UK) within 72 hours of becoming aware, where the breach is likely to result in a risk to individuals' rights and freedoms
• Notify affected data subjects without undue delay where the breach is likely to result in a high risk to their rights
• Document all breaches in our internal breach register

If you believe your data has been compromised, please contact us immediately at [email protected].

9. Data Protection Officer

ETX Hosting has appointed a Data Protection Officer (DPO) who is responsible for overseeing our data protection strategy and ensuring compliance with GDPR.

You can contact our DPO at:

• Email: [email protected]
• Post: ETX Hosting, Data Protection Officer, [Company Address]

10. Sub-processors

ETX Hosting uses the following sub-processors to deliver our services. All sub-processors are bound by data processing agreements and GDPR-compliant safeguards:

• Stripe, Inc. — Payment processing (US, SCCs in place)
• PayPal Holdings, Inc. — Payment processing (US, SCCs in place)
• Amazon Web Services (AWS) — Cloud infrastructure (EEA regions)
• Cloudflare, Inc. — CDN and DDoS protection (US, SCCs in place)
• Intercom, Inc. — Customer support platform (US, SCCs in place)

We will notify customers of material changes to our sub-processor list with at least 30 days' notice.

11. Data Retention

We retain personal data only for as long as necessary. Our retention schedule:

• Account data: Duration of account + 2 years after closure
• Financial records: 7 years (legal obligation)
• Server logs: 90 days
• Support tickets: 3 years
• Consent records: Duration of consent + 1 year

12. Right to Lodge a Complaint

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the relevant supervisory authority:

• UK: Information Commissioner's Office (ICO) — ico.org.uk
• EU: Your national data protection authority (see edpb.europa.eu)

We would, however, appreciate the opportunity to address your concerns directly first. Please contact our DPO at [email protected].