1. Introduction and Parties
1.1This Data Processing Agreement ("DPA") forms part of the agreement between EUGameHost Ltd ("EUGameHost", "we", "us" or "Processor") and the customer ("Customer" or "Controller") governing the provision of hosting and related services.
1.2This DPA applies where EUGameHost processes Personal Data on behalf of the Customer in connection with the Services and where applicable data protection legislation requires a controller-processor agreement.
1.3This DPA applies to relevant processing undertaken in connection with Virtual Private Servers (VPS), Virtual Dedicated Servers (VDS), dedicated servers, managed and unmanaged game servers, shared hosting, colocation and associated infrastructure services.
1.4This DPA is incorporated into EUGameHost's Terms of Service by reference and is binding on both parties upon acceptance of the applicable service agreement.
1.5Where a Customer acts as a processor on behalf of another controller, references to "Controller" in this DPA shall include the Customer acting in that capacity, and the Customer shall ensure it is authorised to engage EUGameHost as a sub-processor.
1.6EUGameHost and the Customer shall comply with their respective obligations under Applicable Data Protection Law.
2. Definitions
For the purposes of this DPA:
Applicable Data Protection Law means the UK GDPR, the Data Protection Act 2018, the EU GDPR where applicable, and any other data protection legislation applicable to the relevant processing.
Customer Personal Data means personal data processed by EUGameHost on behalf of the Customer in providing the Services.
Controller, Processor, Personal Data, Personal Data Breach, Processing, and Data Subject have the meanings given to them under Applicable Data Protection Law.
Services means the hosting, infrastructure and associated services supplied under the Customer's agreement with EUGameHost.
Sub-processor means a third party appointed by EUGameHost to process Customer Personal Data on the Customer's behalf.
Documented Instructions means the instructions recorded in this DPA, the applicable service agreement, authorised service configurations and any additional lawful instructions agreed in writing by the parties.
3. Roles and Responsibilities
3.1The Customer acts as Controller, or as a processor authorised by another controller, in relation to Customer Personal Data.
3.2EUGameHost acts as Processor in relation to Customer Personal Data processed on the Customer's behalf.
3.3The Customer determines the purposes for which Customer Personal Data is collected and processed and is responsible for establishing a valid legal basis for such processing.
3.4The Customer is responsible for the legality, accuracy and content of Customer Personal Data uploaded, transmitted, stored or otherwise processed using the Services.
3.5EUGameHost acts as an independent Controller when processing personal data for its own account management, billing, payment administration, fraud prevention, account authentication, security monitoring, legal compliance and related business purposes.
3.6Such independent Controller processing is governed by EUGameHost's Privacy Policy and Applicable Data Protection Law rather than the processor-specific provisions of this DPA.
4. Processing Instructions
4.1EUGameHost shall process Customer Personal Data only on the Customer's Documented Instructions, including instructions relating to international transfers, unless otherwise required by applicable law.
4.2The Customer's selection, configuration and use of the Services constitute instructions to host, store, transmit, retrieve, maintain, make available and delete Customer Personal Data as reasonably necessary to provide those Services.
4.3EUGameHost shall inform the Customer where, in its opinion, an instruction infringes Applicable Data Protection Law, unless prohibited from doing so by law.
4.4Where EUGameHost is legally required to process Customer Personal Data otherwise than on the Customer's instructions, EUGameHost shall notify the Customer of that requirement before processing, unless the law prohibits such notification on important grounds of public interest.
4.5EUGameHost may decline an instruction that is unlawful, technically incompatible with the contracted Services, or outside the agreed scope of processing, while complying with its mandatory legal obligations.
5. Customer Data Access and Confidentiality
5.1EUGameHost does not access, inspect, examine, retrieve or otherwise interact with data stored within customer-managed virtual machines or dedicated server operating systems without the Customer's prior explicit authorisation, except where required by applicable law.
5.2This restriction includes accessing operating systems, mounting virtual disks for content inspection, browsing files, reading databases or examining customer applications.
5.3Where the Customer requests technical assistance requiring access to Customer Personal Data, EUGameHost shall limit access to the authorised purpose and cease that access when the relevant work is complete.
5.4EUGameHost may administer the underlying physical infrastructure, hypervisors, storage systems, networking equipment and hosting management platforms without separate Customer authorisation, provided such administration does not involve accessing customer operating systems or stored content contrary to clause 5.1.
5.5EUGameHost shall ensure that persons authorised to process Customer Personal Data are subject to appropriate confidentiality obligations, whether contractual or statutory.
5.6EUGameHost shall restrict personnel access to Customer Personal Data to the extent necessary to perform authorised activities and shall take appropriate steps to protect such access.
5.7For panel-based game server hosting and shared hosting, EUGameHost support staff have direct technical access through the hosting control panel to the files, databases and console output of the Customer's service. That access is used solely to provide support requested by the Customer or to investigate a service fault, is limited to what the request or fault requires, and does not involve altering Customer content without the Customer's instruction.
5.8For colocation services, EUGameHost provides rack space, power, cooling and network connectivity only. EUGameHost has no access to colocated equipment or the data held on it, performs physical work on such equipment only on the Customer's written instruction, and does not back up, image, wipe or otherwise process the data held on it. The Customer is wholly responsible for the management, security, backup and secure erasure of its own equipment and data, including before equipment is removed or decommissioned.
5.9EUGameHost does not hold the operating-system credentials for any VPS or dedicated server. Out-of-band management (IPMI) on dedicated servers is made available to the Customer. Where the Customer leaves a session logged in through a VNC, KVM or IPMI console, that session could in principle be viewed by anyone with access to the console, including EUGameHost staff carrying out infrastructure work. The Customer is responsible for logging out of console sessions and for securing its own credentials. EUGameHost staff shall not use an open console session to access or alter Customer content.
6. Network Privacy and Abuse Investigations
6.1In the ordinary course of operating its network, EUGameHost does not maintain logs of individual customer network connections and does not perform Deep Packet Inspection (DPI) of customer communications. During DDoS mitigation or the investigation of a network security incident, EUGameHost may capture and analyse traffic affecting the relevant service, including packet captures, for as long as is necessary to identify and mitigate the attack. Such captures are used only for that purpose and are deleted once they are no longer needed.
6.2EUGameHost may inspect limited network-level information, including traffic volumes, protocols, connection characteristics and traffic patterns, where reasonably necessary for network administration, operational troubleshooting, infrastructure security, DDoS mitigation or abuse investigations.
6.3Such monitoring does not involve routine inspection of communication payloads or access to Customer files, operating systems, databases or application content.
6.4EUGameHost may take proportionate action to restrict network traffic, suspend connectivity or suspend Services where permitted by the Terms of Service and necessary to address security incidents, confirmed fraud, unlawful activity or material abuse.
6.5An abuse report alone does not authorise EUGameHost personnel to access data stored inside a Customer's virtual machine or dedicated server.
6.6Where network metadata constitutes Personal Data, EUGameHost shall process it in accordance with Applicable Data Protection Law and the relevant role in which EUGameHost acts.
7. Technical and Organisational Security Measures
7.1EUGameHost shall implement appropriate technical and organisational measures designed to provide a level of security appropriate to the risks presented by the processing, as required by Article 32 of the UK GDPR and, where applicable, the EU GDPR.
7.2Such measures shall include, where relevant and proportionate:
- Access controls for administrative and infrastructure management systems.
- Individual staff administrator accounts.
- Multi-factor authentication for administrative access.
- Encryption of virtual machine snapshots and backups.
- Physical security and restricted access to EUGameHost-controlled infrastructure.
- Network-level security and DDoS mitigation.
- Secure deletion and sanitisation procedures.
- Security incident investigation and response.
- Measures supporting the availability, integrity and resilience of the Services.
- Periodic evaluation of security measures, proportionate to the processing risks.
7.3Further details of EUGameHost's technical and organisational measures are set out in Schedule B.
7.4EUGameHost may update its security measures from time to time, provided such updates do not materially reduce the overall level of protection required by Applicable Data Protection Law.
7.5The Customer acknowledges that EUGameHost provides infrastructure services and that, for unmanaged services, the Customer remains responsible for appropriate operating-system security, software configuration, application security, access controls and independent backups.
7.6Nothing in this section excludes or diminishes EUGameHost's own mandatory obligations concerning the security of Customer Personal Data.
8. Sub-processors
8.1The Customer grants EUGameHost general written authorisation to engage Sub-processors for activities necessary to provide the Services, subject to this section.
8.2The Customer authorises the Sub-processors identified in Schedule C for the stated processing activities, subject to completion and publication of that schedule.
8.3EUGameHost shall give the Customer reasonable advance notice of intended additions or replacements of Sub-processors. The proposed contractual notice period is 30 days, except where urgent security, continuity or legal circumstances reasonably require an accelerated change. Notice is given by email to the Customer's registered account email address and by updating Schedule C on this page.
8.4The Customer may object in writing during the notification period on reasonable data protection grounds.
8.5Where an objection cannot reasonably be resolved, the parties shall seek an appropriate alternative arrangement. If no suitable alternative is available, the affected Service may be terminated in accordance with the applicable service terms, without prejudicing mandatory rights.
8.6EUGameHost shall impose data protection obligations on Sub-processors providing an equivalent level of protection to the relevant requirements of this DPA, including appropriate technical and organisational measures.
8.7EUGameHost shall remain responsible to the Customer for the performance of its Sub-processors' data protection obligations to the extent required by Article 28(4) of the UK GDPR or applicable equivalent legislation.
8.8Sub-processors shall only receive access to Customer Personal Data where necessary to perform the relevant contracted services.
9. International Data Transfers
9.1Customer Personal Data may be processed in the country or region selected by the Customer when ordering or configuring the Services, including the United Kingdom and the United States where such services are offered.
9.2EUGameHost operates UK hosting infrastructure located at NorwichDC. US hosting services are provided using infrastructure operated by Kuroit Limited, identified in Schedule C.
9.3EUGameHost shall not initiate a restricted international transfer of Customer Personal Data contrary to Applicable Data Protection Law.
9.4Where EUGameHost engages a recipient outside the United Kingdom or European Economic Area and a restricted transfer requires safeguards, EUGameHost shall ensure that an appropriate lawful transfer mechanism is in place before the transfer takes place.
9.5Depending on the applicable law and the circumstances, such safeguards may include an applicable adequacy decision, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, the EU Standard Contractual Clauses or another lawful mechanism.
9.6Where a contractual transfer instrument is required, the parties shall complete and execute or validly incorporate the applicable instrument, including its required annexes and any necessary transfer assessment, before relying on it.
9.7The identity, location, processing role and applicable transfer arrangements for relevant Sub-processors shall be recorded in Schedule C.
9.8The Customer is responsible for assessing whether the hosting location selected is suitable for its own legal, regulatory and contractual obligations.
9.9Where the Customer is established in the European Economic Area, transfers of Customer Personal Data to EUGameHost in the United Kingdom are made under the European Commission's adequacy decision for the United Kingdom. Any onward transfer of EU-origin Customer Personal Data to the United States is made under the EU Standard Contractual Clauses or another transfer mechanism valid under the EU GDPR.
10. Assistance with Data Subject Rights
10.1Taking into account the nature of the processing, EUGameHost shall provide reasonable assistance to enable the Customer to respond to requests by Data Subjects exercising their rights under Applicable Data Protection Law.
10.2Such rights may include access, rectification, erasure, restriction, portability, objection and rights relating to automated decision-making, where applicable.
10.3Where the Customer has direct access to Customer Personal Data through its hosting environment, the Customer should ordinarily use that access to fulfil the request.
10.4If EUGameHost receives a request directly relating to Customer Personal Data for which the Customer is Controller, EUGameHost shall, where reasonably possible, refer the request to the Customer without responding substantively, unless legally required to do otherwise.
10.5EUGameHost shall not be required to access or inspect customer-managed systems in contravention of its access restrictions solely to respond to a Data Subject request.
10.6Where technical assistance is necessary and lawfully authorised, EUGameHost shall provide such assistance taking account of the nature of the Services and information available to it.
10.7Assistance under this section beyond referring a request to the Customer under clause 10.4 or providing information already available to the Customer is chargeable at EUGameHost's standard professional services rate, quoted in advance and payable before the work begins.
11. Personal Data Breaches
11.1EUGameHost shall notify the Customer without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data processed by EUGameHost on the Customer's behalf.
11.2Notification shall normally be made to the Customer's registered account email address or another designated security contact.
11.3EUGameHost shall provide information reasonably available to it, including:
- The nature of the breach.
- The categories of affected data and individuals, where known.
- The approximate number of affected records or individuals, where known.
- The likely consequences, where reasonably ascertainable.
- Measures taken or proposed to contain, investigate and mitigate the breach.
- An appropriate contact point for further information.
11.4Where information is incomplete, EUGameHost may provide an initial notification followed by further information as it becomes available.
11.5EUGameHost shall provide reasonable assistance with the Customer's obligations to investigate, assess and, where required, notify the relevant supervisory authority and affected Data Subjects.
11.6Where EUGameHost acts as an independent Controller in relation to affected personal data, it shall separately assess and comply with its own breach notification obligations, including notification to the Information Commissioner's Office where legally required.
11.7Nothing in this DPA makes EUGameHost responsible for reporting every Customer-controlled breach directly to the ICO merely because the affected personal data is hosted on its infrastructure.
12. Data Protection Impact Assessments and Consultation
12.1Taking into account the nature of processing and the information available to it, EUGameHost shall provide reasonable assistance to the Customer in carrying out Data Protection Impact Assessments where required.
12.2EUGameHost shall also provide reasonable assistance with prior consultation with supervisory authorities where required under Applicable Data Protection Law.
12.3The Customer remains responsible for determining whether its own processing activities require a Data Protection Impact Assessment or supervisory authority consultation.
12.4This DPA and Schedule B constitute the information EUGameHost makes available for the Customer's assessments free of charge. Any further assistance under this section is chargeable at EUGameHost's standard professional services rate, quoted in advance and payable before the work begins.
13. Data Retention, Return and Deletion
13.1EUGameHost shall process Customer Personal Data for the duration necessary to provide the contracted Services, subject to the documented instructions and retention arrangements set out in this DPA.
13.2Upon termination of a virtual machine, EUGameHost deletes the associated active virtual disk image from its hosting platform.
13.3Encrypted snapshots associated with a terminated virtual machine are deleted upon termination.
13.4Dedicated server SSDs and NVMe storage devices are subject to an appropriate secure erase or NVMe sanitisation process before reallocation to another customer.
13.5Upon termination of the Services, EUGameHost shall delete Customer Personal Data processed on its behalf in accordance with clauses 13.2 to 13.4 and the Terms of Service, subject to any applicable legal retention requirements.
13.6The Customer is solely responsible for exporting any Customer Personal Data it wishes to retain before the Service is cancelled or terminated, using the tools available within the Service. EUGameHost does not have access to the content of the Customer's service for this purpose and cannot export or return Customer Personal Data on the Customer's behalf, either before or after termination.
13.7Unless the Customer has exported its data before termination, the Customer instructs EUGameHost to delete the Customer Personal Data associated with the terminated Service in accordance with the stated service lifecycle and deletion procedures.
13.8Where retention of Customer Personal Data is required by applicable law, EUGameHost shall retain only the information required and shall protect it from unauthorised access and unnecessary processing.
13.9EUGameHost shall not retain Customer Personal Data beyond the applicable retention requirements or documented instructions, except as permitted or required by law.
13.10For the avoidance of doubt, account information, billing records, payment records, authentication logs and fraud-prevention records processed by EUGameHost as an independent Controller are governed by its Privacy Policy and applicable legal retention requirements.
13.11EUGameHost may retain accounting and transaction records after service termination where required to comply with tax, accounting or other legal obligations.
13.12Termination of an individual Service does not close the Customer's billing account. The account, and the account, billing, payment and authentication records held within it, remain active until the Customer requests closure through the client area or in writing. Those records are processed by EUGameHost as an independent Controller under its Privacy Policy and, following a closure request, are retained only as required by clause 13.11.
13.13For colocation services, return and deletion of Customer Personal Data is effected by the Customer removing its own equipment or wiping its own drives. Clauses 13.2 to 13.4 do not apply to colocated equipment, and EUGameHost does not wipe, sanitise or dispose of it.
14. Customer Obligations
14.1The Customer shall ensure that its instructions to EUGameHost comply with Applicable Data Protection Law.
14.2The Customer shall ensure that it has a valid legal basis and, where required, appropriate notices or consents for processing Personal Data using the Services.
14.3The Customer shall be responsible for selecting appropriate hosting locations and service configurations for its data protection needs.
14.4The Customer shall implement appropriate security measures within environments it manages, including operating-system updates, application security, user permissions, authentication and encryption where appropriate.
14.5The Customer shall maintain appropriate independent backups where the Services do not expressly include a managed backup or recovery service.
14.6The Customer shall promptly notify EUGameHost of any security incident or unlawful access reasonably believed to affect EUGameHost-controlled infrastructure or the Services.
14.7Where the Customer processes special category data, criminal offence data or other sensitive information, the Customer shall assess and implement appropriate additional safeguards and communicate any requirements that EUGameHost must expressly agree to support.
14.8The Customer shall export any Customer Personal Data it needs to keep before cancelling a Service or allowing it to expire, in accordance with clause 13.6.
15. Information, Audits and Inspections
15.1EUGameHost shall make available to the Customer information reasonably necessary to demonstrate compliance with its obligations under Article 28 of the UK GDPR and applicable equivalent provisions.
15.2EUGameHost shall allow for and contribute to audits and inspections conducted by the Customer or an auditor mandated by the Customer in accordance with Applicable Data Protection Law.
15.3For VPS, VDS, dedicated server, game server and shared hosting customers, audits are conducted remotely. EUGameHost satisfies an audit request by supplying relevant documentation, written explanations, policies, technical information or other reasonable compliance evidence. These customers are not granted physical access to EUGameHost's facilities, because the infrastructure is shared with other customers and physical access is restricted to protect their data and the security of the facility.
15.4On-site audits are available only to colocation customers, in respect of their own equipment and the space allocated to them. Any such audit shall be conducted on reasonable prior notice, during agreed times, escorted by EUGameHost personnel and subject to appropriate confidentiality, safety, physical security and operational safeguards.
15.5Audits shall be organised to minimise unnecessary disruption to EUGameHost's infrastructure and services and to protect the confidential information and personal data of other customers.
15.6The parties shall act reasonably concerning the scope, frequency and arrangements for audits. Nothing in this section shall prevent an audit or inspection that is required by Applicable Data Protection Law or lawfully directed by a supervisory authority.
15.7EUGameHost shall promptly address any material non-compliance identified through an audit where required by law or this DPA.
15.8This DPA, including Schedule B, is EUGameHost's standard compliance documentation and is provided free of charge. Any further information request, security questionnaire, remote audit or, for colocation customers, on-site audit is chargeable at EUGameHost's standard professional services rate, quoted in advance and payable before the work begins, and may be exercised no more than once in any 12-month period, except following a Personal Data Breach affecting the Customer or at the direction of a supervisory authority.
15.9Any auditor mandated by the Customer shall be bound by written confidentiality obligations acceptable to EUGameHost and shall not be a competitor of EUGameHost or an employee or contractor of a competitor.
16. Records and Regulatory Cooperation
16.1Each party shall maintain records of processing activities where required by Applicable Data Protection Law.
16.2EUGameHost shall cooperate with relevant supervisory authorities to the extent required by applicable law.
16.3Each party shall provide reasonable cooperation to the other concerning relevant regulatory inquiries affecting processing under this DPA, subject to applicable confidentiality and legal restrictions.
17. Liability
17.1Each party shall be responsible for complying with its own obligations under Applicable Data Protection Law.
17.2Subject to clause 17.3, the parties' contractual liability arising under this DPA shall be governed by the applicable liability provisions of EUGameHost's Terms of Service or another expressly agreed written service agreement.
17.3Nothing in this DPA shall exclude or limit liability to the extent such exclusion or limitation is prohibited by applicable law, including mandatory statutory rights, regulatory powers and liabilities that cannot lawfully be excluded.
17.4Nothing in this DPA shall prevent either party from exercising any right of recovery or compensation available under Applicable Data Protection Law.
17.5No indemnity or uncapped liability on the part of EUGameHost is created by this DPA unless expressly agreed in writing between the parties.
17.6Subject to clause 17.3, EUGameHost's total aggregate liability to the Customer arising out of or in connection with this DPA, whether in contract, tort (including negligence), breach of statutory duty or otherwise, shall not exceed the total fees paid by the Customer to EUGameHost for the affected Service in the 12 months immediately preceding the event giving rise to the claim.
17.7Subject to clause 17.3, and save for any service credits expressly provided under EUGameHost's Service Level Agreement, EUGameHost shall have no liability to the Customer under this DPA for loss of, damage to or corruption of Customer Personal Data or other Customer content, for any interruption, suspension or unavailability of the Services, or for any indirect or consequential loss, loss of profit, revenue, business or goodwill.
17.8The Customer shall indemnify and hold harmless EUGameHost against all claims, losses, damages, fines, penalties, costs and expenses (including reasonable legal fees) arising from or in connection with: the Customer Personal Data or other content the Customer processes using the Services; the Customer's instructions and its lawful basis for processing; any breach by the Customer of this DPA or Applicable Data Protection Law; any loss of data or unavailability affecting the Customer's Service; and any claim by a Data Subject or third party relating to the Customer's processing.
18. Duration and Termination
18.1This DPA shall take effect when incorporated into the applicable service agreement and shall continue for as long as EUGameHost processes Customer Personal Data on behalf of the Customer. It remains incorporated while the Customer's billing account is open and applies automatically to any further Service ordered under that account.
18.2Obligations relating to confidentiality, retained information, liability, and applicable legal compliance shall continue following termination to the extent necessary.
18.3Termination of this DPA shall not relieve either party of obligations accrued before termination.
19. Order of Precedence
19.1In the event of a conflict between this DPA and EUGameHost's Terms of Service concerning the protection or processing of Customer Personal Data, this DPA shall prevail to the extent necessary to comply with Applicable Data Protection Law.
19.2Any applicable mandatory international data transfer clauses shall take precedence over conflicting contractual provisions to the extent required by those clauses.
19.3Except as expressly modified by this DPA, the applicable Terms of Service remain in force.
20. Governing Law
20.1This DPA shall be governed by the laws of England and Wales, subject to any mandatory provisions of Applicable Data Protection Law.
20.2The courts of England and Wales shall have jurisdiction over contractual disputes concerning this DPA, subject to mandatory legal rights and supervisory authority powers.
21. Changes to this DPA
21.1EUGameHost may update this DPA from time to time to reflect changes in Applicable Data Protection Law, regulatory guidance, the Services or its Sub-processors.
21.2EUGameHost shall notify all Customers of any change to this DPA by email to the registered account email address before the change takes effect, and shall publish the updated version on this page with its version number and effective date.
21.3Where a change would materially reduce the protection afforded to Customer Personal Data, the Customer may object in writing within 30 days of the notification, and clause 8.5 shall apply to any objection that cannot reasonably be resolved.
Schedule A: Description of Processing
A1. Subject Matter
Provision of hosting infrastructure and related technical services that enable the Customer to store, transmit, manage and process Personal Data.
A2. Duration
For the duration of the relevant hosting service agreement, including any period necessary to complete lawful termination, return, deletion or required retention activities.
A3. Nature and Purpose
Processing may include:
- Hosting and storage of Customer Personal Data.
- Transmission and delivery of data through hosting networks.
- Provision of virtual or physical computing resources.
- Provision of managed game server and shared hosting environments.
- Storage of encrypted snapshots where supported.
- Maintenance, operational support and restoration activities where applicable.
- Secure deletion and storage sanitisation.
- Processing necessary to provide agreed ancillary hosting services.
A4. Categories of Data Subjects
Depending on the Customer's use of the Services, Data Subjects may include:
- The Customer's employees and contractors.
- The Customer's clients and end users.
- Website visitors.
- Game server players and community members.
- Application users.
- Other individuals whose information the Customer chooses to process through the Services.
A5. Categories of Personal Data
Depending on the Customer's use of the Services, Personal Data may include:
- Names and contact details.
- IP addresses and online identifiers.
- Usernames and account information.
- Application and website databases.
- Game player identifiers and associated information.
- Communication records and user-generated content.
- System and application logs.
- Other Personal Data uploaded or processed by the Customer.
EUGameHost does not determine the specific content stored or processed by customers.
A6. Sensitive Data
The Customer may technically store special category or other sensitive Personal Data in the Services, subject to applicable law and the service agreement. Such data is not specifically requested or routinely accessed by EUGameHost.
The Customer remains responsible for determining whether the contracted Services and security measures are appropriate for that processing.
A7. Processing Locations
- United Kingdom: EUGameHost-controlled hosting infrastructure at NorwichDC.
- United States: Infrastructure operated by Kuroit Limited in Dallas, Texas and Los Angeles, California for applicable US hosting services.
- Other locations: Only where separately disclosed and lawfully arranged.
A8. Controller Rights and Obligations
The Controller determines lawful processing purposes and instructions, manages its data and security responsibilities, may exercise the assistance, audit and deletion rights provided by this DPA, and is responsible for exporting its own data before a Service ends.
Schedule B: Technical and Organisational Measures
B1. Physical Infrastructure
UK-owned hosting equipment is operated from EUGameHost's NorwichDC facility.
Physical infrastructure is subject to operational access controls and facility security arrangements.
For infrastructure operated by third-party providers, applicable physical security measures are supplied by those providers under their contractual responsibilities.
B2. Administrative Access
EUGameHost uses individual administrator accounts and multi-factor authentication for staff access to relevant hosting administration systems and hypervisors.
Administrative access shall be restricted to authorised personnel.
B3. Customer System Privacy
EUGameHost does not enter customer-managed VPS or dedicated server operating systems or inspect stored customer data without prior explicit customer authorisation, except where required by applicable law.
Underlying infrastructure can be managed without routine access to Customer content.
For panel-based game server and shared hosting services, support staff access to Customer files, databases and console output through the control panel is limited to support requested by the Customer or fault investigation, as described in clause 5.7.
EUGameHost does not hold operating-system credentials for VPS or dedicated servers. Console sessions (VNC, KVM, IPMI) left logged in by the Customer are the Customer's responsibility, as described in clause 5.9. Colocated equipment is not accessed by EUGameHost except on the Customer's written instruction.
B4. Encryption
Virtual machine disks and dedicated server drives are not encrypted at rest by EUGameHost. Customers who require encryption at rest should enable it within their own operating system, for example with LUKS or BitLocker, and remain responsible for the keys.
Snapshots and backups taken by the platform are encrypted and stored on hardware controlled by EUGameHost.
Encryption key management and access shall be subject to appropriate security controls.
B5. Network Security
EUGameHost employs network security and abuse mitigation measures appropriate to its hosting environment.
It does not log individual customer network connections or perform Deep Packet Inspection of customer communications in the ordinary course of operation. Packet captures may be taken during DDoS mitigation or a network security investigation, as described in clause 6.1, and are deleted once no longer needed.
Limited traffic metadata or statistics may be reviewed to maintain network security or investigate abuse.
B6. Erasure and Sanitisation
Upon VPS termination, the active virtual disk image and associated encrypted snapshots are deleted.
Before dedicated server storage devices are reallocated, EUGameHost uses appropriate secure erase or NVMe sanitisation procedures.
Colocated equipment is not wiped, sanitised or disposed of by EUGameHost. This is the Customer's responsibility.
B7. Incident Handling
EUGameHost investigates suspected infrastructure security incidents and communicates relevant Personal Data Breaches to affected Customer Controllers without undue delay.
B8. Business Continuity
EUGameHost shall maintain technical and organisational measures appropriate to the contracted Service and the risks associated with processing, including measures supporting availability, resilience and recovery where applicable.
The availability of backups and restoration capabilities depends on the specific contracted Service.
B9. Security Review
EUGameHost shall periodically review the appropriateness of its security measures and update them where reasonably necessary to address identified risks.
Schedule C: Sub-processors and Infrastructure Providers
This schedule identifies third parties engaged to process Customer Personal Data on behalf of EUGameHost, rather than third parties used solely for EUGameHost's own independent Controller activities.
C1. Hosting Infrastructure
- Provider: Kuroit Limited, a company registered in the United Kingdom, together with its United States operating affiliate.
- Location: United States (Dallas, Texas and Los Angeles, California).
- Service: Infrastructure supporting EUGameHost's US hosting products.
- Processing: Hosting, storage, transmission and infrastructure operations, to the extent the provider processes Customer Personal Data on EUGameHost's behalf.
- International Transfer Mechanism: Kuroit Limited is established in the United Kingdom and contracts with EUGameHost under the laws of England and Wales. To the extent processing on its US infrastructure constitutes a restricted transfer, it is made under the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, as incorporated in EUGameHost's agreement with Kuroit Limited.
- Status: Authorised Sub-processor for US hosting services.
C2. UK Hosting Infrastructure
- Provider: EUGameHost Ltd
- Location: United Kingdom (NorwichDC)
- Service: EUGameHost-operated hosting infrastructure.
- Status: Internal infrastructure, not a separate third-party Sub-processor.
C3. Additional Sub-processors
Any additional third party processing Customer Personal Data on EUGameHost's behalf shall be identified in this schedule or the associated maintained Sub-processor Register before being engaged, subject to the authorisation and notification arrangements in clause 8.
C4. Independent Controller Services
The following services are used by EUGameHost in its capacity as an independent Controller for its own account, billing, security and website purposes. They do not receive Customer Personal Data hosted within the Services and are therefore not Sub-processors under this DPA.
- Stripe (including Stripe Radar): card payment processing and fraud prevention.
- PayPal: payment processing.
- Skrill: payment processing.
- Google Analytics 4: website usage analytics.
- Microsoft Clarity: website session analytics and heatmaps.
- EUGameHost device fingerprinting and client-area authentication audit systems: account security and fraud prevention, operated by EUGameHost itself.
Each payment provider's precise role is determined by the relevant processing activity and contractual arrangements. Their use for EUGameHost's own payment and fraud-prevention activities does not, by itself, make them Sub-processors of Customer-hosted Personal Data.
These activities, the lawful basis relied on and the applicable retention periods are disclosed in EUGameHost's Privacy Policy and relevant cookie and tracking disclosures.
Contact Information
- Data Processor: EUGameHost Ltd
- Trading Name: EUGameHost
- Registered Office: Unit 7 Catfield Industrial Estate, Sutton Road, Catfield, NR29 5BG, United Kingdom
- Company Registration Number: 14794898 (England and Wales)
- VAT Number: GB 452303820
- Data Protection Contact: [email protected]
- Website: https://www.eugamehost.com
Customer / Controller: The individual, company or organisation contracting for the relevant Services, as identified in the applicable service agreement.
End of Data Processing Agreement