Data processing agreement

This DPA becomes binding when incorporated into an accepted order or service agreement, or separately accepted by authorised representatives. Publication alone does not create a processing agreement with every website visitor. The parties must complete the service-specific information in the annexes before the relevant processing begins.

The Customer is the controller where it decides the purposes of processing, or a processor where it acts for its own customer. IPXON acts as processor or subprocessor accordingly. A Customer acting as processor confirms it has the authority and instructions needed to appoint IPXON and to pass on lawful instructions.

“Customer Personal Data” means personal data we process on the Customer's behalf within the service. “Personal Data Breach” means a security breach leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access to that data. “Applicable Data Protection Law” means the privacy and data protection requirements applicable to the relevant processing and the parties' roles.

Our independent processing of website, account, billing and business contact information is described in the Privacy Policy. Those activities are not included in this DPA merely because they relate to the same commercial relationship.

Colocation without access to customer systems and mere connectivity may involve different roles for different activities. The service description must identify the processing actually undertaken; this DPA does not assume that every facility operator or carrier can access hosted content.

The subject matter, duration, purposes, data categories, individuals, locations and operations are set out in Annex A and the accepted service documentation. Processing may include storage, retrieval, transmission, availability, support and deletion as needed for the ordered service.

We process Customer Personal Data only on the Customer's documented instructions, including instructions concerning international transfers, unless binding law requires otherwise. The agreement, service configuration and authorised support requests form part of those instructions. Additional instructions must be sent through an authenticated support channel or another method agreed in writing. A request to change scope, cost or risk requires agreement before implementation.

If law requires processing beyond the instructions, we inform the Customer before processing unless legally prohibited. If we believe an instruction infringes Applicable Data Protection Law, we notify the Customer promptly and may suspend that instruction while the parties resolve the issue. We do not silently substitute an unrelated purpose.

We do not sell Customer Personal Data, use it for advertising, or use its content to train general-purpose AI models. Operational use of personal data within the service is limited to providing and securing the service under the agreement, unless a separate lawful role and basis are specifically identified.

The Customer is responsible for the lawfulness of its collection and instructions, appropriate notices and permissions, its authorised users, and the security and configuration of components it manages. It must not upload data requiring safeguards beyond the agreed service scope without first arranging those safeguards. Each party remains responsible for its own obligations.

We limit access to authorised people with a service-related need and ensure they are bound by confidentiality obligations or an appropriate statutory duty. Access rights must be reviewed and removed when no longer needed.

We maintain technical and organisational measures appropriate to the nature of the data, the service and the risk, as described in Annex B. We consider confidentiality, integrity, availability and resilience, and assess the effectiveness of those measures. We may improve or replace measures without materially reducing the agreed level of protection.

Customer-controlled operating systems, applications, keys, identities, networks and backup settings remain within the Customer's responsibility to the extent stated in the service description. That allocation does not reduce IPXON's responsibility for its own infrastructure and accepted management tasks.

The Customer gives general written authorisation for the subprocessors identified for its service in Annex C. We engage each under a written agreement imposing data protection obligations that provide at least the protection required by this DPA for the work assigned. We remain responsible to the Customer for performance of those obligations.

We provide at least 30 days' advance written notice before a new or replacement subprocessor begins processing Customer Personal Data. The notice identifies the entity, work, processing countries and relevant safeguards. A passive update to a webpage without notice is not sufficient.

The Customer may object within 15 days on reasonable data protection grounds. We will work in good faith to resolve the concern through information, safeguards or a practical alternative. If we cannot resolve it before the proposed processing begins, the Customer may terminate the affected service without an early termination charge and receive a refund of unused prepaid recurring charges. The disputed subprocessor will not process that Customer's data while an unresolved timely objection prevents authorisation.

An urgent replacement does not remove the need for lawful authorisation. We will use an already authorised alternative, obtain specific written authorisation or pause affected processing if necessary. A provider handling only our own billing or marketing data is not automatically a subprocessor for customer-hosted data.

Taking account of the nature of processing, we provide reasonable assistance to help the Customer respond to requests for access, correction, deletion, restriction, objection, portability and other applicable rights. We promptly forward requests concerning Customer Personal Data to the Customer and do not independently decide them unless legally required or authorised.

We also assist, taking account of the information available to us, with security obligations, breach assessments, data protection impact assessments and consultations with authorities. Assistance must be timely enough to allow the Customer to meet its applicable deadlines. We do not require the Customer to wait for a routine support queue when a legal deadline requires urgent cooperation.

Routine assistance needed to meet our obligations is included. Substantial additional work outside that scope may be subject to reasonable charges agreed in advance. We do not charge for correcting our own breach or use a fee dispute to withhold legally required assistance.

We notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data. The notification is not postponed until an investigation is complete. We send it to the security contact recorded for the account and use an appropriate alternative if delivery fails.

As information becomes available, we explain the nature of the breach, affected services, approximate categories and numbers of individuals and records where known, likely consequences, containment and remediation measures, a contact for follow-up, and practical steps the Customer can take. We provide updates and cooperate with the Customer's assessment and required notifications.

We take reasonable steps to contain, investigate and mitigate the breach, preserve relevant evidence and address its cause. We do not notify affected individuals on the Customer's behalf without instructions unless law requires it. Notification is not, by itself, an admission of fault. Unsuccessful events that do not compromise Customer Personal Data, such as a blocked scan, do not automatically trigger breach notification.

We make available information reasonably needed to demonstrate compliance with this DPA and allow and contribute to audits, including inspections, by the Customer or an independent auditor it appoints. Existing relevant reports may satisfy a request where they provide adequate evidence; we do not promise a certification or report that does not exist.

Routine audits should be coordinated with reasonable notice during normal business hours, with safeguards for other customers' data, security and confidential information. Ordinarily one routine audit per year is sufficient. That limit does not prevent an additional audit reasonably required following a material incident, credible evidence of non-compliance, a regulator's request or a mandatory transfer clause.

We will not use confidentiality, cost or scheduling requirements to defeat a necessary audit. The Customer bears its own auditor's fees. Any reasonable charge for exceptional assistance must be agreed in advance and does not apply to remediation of our material non-compliance. We address substantiated findings within a period appropriate to their risk.

The accepted order and Annex A identify authorised hosting locations. Annex C identifies subprocessor and support locations. The Customer's selection of one datacenter does not automatically authorise processing in all other IPXON locations. Remote access from another country must be included in the transfer assessment where relevant.

We do not move Customer Personal Data outside the agreed location arrangements without a documented instruction or authorisation and any legally required safeguards. If an emergency requires a change, we coordinate a lawful alternative; an emergency is not a blanket exemption from transfer requirements.

For a transfer restricted by Applicable Data Protection Law, the parties must document and implement a valid mechanism before that transfer begins. Annex D records it. Where mandatory standard contractual clauses are used, their official text, completed particulars and required annexes form part of the agreement. This DPA alone is not a substitute for those clauses.

For applicable transfers from the European Economic Area, this may require the European Commission's Standard Contractual Clauses, with the correct controller-to-processor or processor-to-processor module and completed annexes. Transfers governed by UK requirements may need the UK International Data Transfer Agreement or Addendum. Brazilian, Swiss or other applicable requirements must be addressed for the specific route. A valid adequacy decision may be used only within its actual scope.

We provide reasonable information for the relevant transfer risk assessment and implement required supplementary measures. If adequate protection cannot be maintained, the affected transfer or processing must be suspended until a lawful solution is in place. The Customer may terminate the affected service if no workable lawful solution is available, with refund of unused prepaid recurring fees.

Where legally permitted, we promptly notify the Customer of a binding request for Customer Personal Data and seek to direct the requester to the Customer where appropriate. We review the request's validity, disclose only what is legally required, and challenge unlawful or disproportionate requests where there are reasonable grounds and a lawful avenue to do so.

If notice is prohibited, we seek permission to notify where appropriate and provide information when the restriction permits. We do not provide voluntary unrestricted access to Customer Personal Data. Any additional obligations in mandatory transfer clauses take priority.

The Customer chooses return or deletion of Customer Personal Data at the end of the service, unless applicable law requires limited retention. The Customer can give an earlier lawful deletion instruction; an express instruction to destroy or reinstall a resource may make its data irrecoverable immediately, and we do not promise to restore data already deleted on instruction.

Unless a longer period is expressly agreed, existing data within our control remains available for export for 30 days after termination using available export tools or an agreed secure method. Export access is not continued production service. We may use a restricted alternative where normal access would create a security or legal risk. Additional migration services must be separately agreed.

After the export period, we delete remaining active copies within a further 30 days. Any residual provider-controlled backup copies are deleted or overwritten no later than 90 days after termination. If the Customer chooses earlier deletion, we begin promptly and complete active deletion within 30 days of the authenticated instruction; residual backups are removed within 90 days of that instruction. A stricter legally required deadline takes priority.

Backups awaiting expiry remain protected and excluded from ordinary use. If restored for a necessary recovery, relevant deletion instructions must be reapplied. A legal hold is limited to the data and period required, with restricted access and no unrelated use. We confirm completion on reasonable request and explain any legally retained category.

For data held solely on customer-owned colocation equipment that we cannot access, return occurs through equipment collection. Any wiping or destruction performed by IPXON requires an agreed instruction, appropriate safeguards and confirmation. We do not keep copies merely because the Customer has an unpaid or disputed invoice.

Where applicable state privacy law treats IPXON as a service provider, contractor or processor, we process the covered information only for the specific service purposes in Annex A. We do not sell or share it for cross-context behavioural advertising, retain, use or disclose it outside the direct business relationship or permitted purposes, or combine it with information from unrelated sources except as legally permitted for providing the services.

We provide the protection required by the applicable rules, notify the Customer if we can no longer comply, and allow reasonable steps to verify compliance and stop or remediate unauthorised use. We certify that we understand and will comply with these restrictions where a certification is required. This section applies only within the relevant law's scope and does not turn website advertising providers into processors for hosted data.

The service agreement's liability terms apply between the parties, subject to the DPA-specific cap stated there. They do not restrict an individual's statutory rights, a regulator's powers, liability that cannot lawfully be limited, or a mandatory transfer clause. Nothing in this DPA makes the Customer responsible for IPXON's own failure to comply.

For personal data processing, this DPA takes priority over inconsistent general service terms. Mandatory international transfer clauses take priority over both. Changes may not reduce the agreed protection or retrospectively replace a signed DPA without the required agreement or lawful change procedure.

Provider: Conexum Inc., 3250 W Commercial Blvd, Suite 140, Fort Lauderdale, FL 33309-3459, United States. Data protection contact: privacy@ipxon.com. Security contact: noc@ipxon.com. Customer contacts are recorded in Annex A and must be kept current.

Complete this record in the accepted order or a linked annex retained with it. Identifying a general service family is not a substitute for recording the customer's actual processing.

The following measures are contractual requirements for the components IPXON manages. A service-specific schedule must record their implementation, any permitted equivalent measure, and the boundary with Customer-controlled systems. It must be completed and agreed before processing begins.

The public Security page is not the completed technical annex and cannot replace service-specific measures. Customer backups, operating system patching or encryption tasks do not become IPXON-managed tasks unless included in the order.

The service-specific list must be supplied before acceptance and maintained under section 4. Include legal entities with access to Customer Personal Data, including relevant group companies. A facility supplier with no such processing must be classified according to its actual role, not included or excluded solely by its commercial label.

As of the effective date of this version, IPXON does not use subprocessors to process Customer Personal Data. If this changes, section 4 applies and this list will be updated before the new subprocessor is authorised.

For each entry, record the legal entity, service performed, data categories, processing and remote-access countries, applicable safeguards, authorisation date and any transfer mechanism. If no subprocessors are used for a particular service, record that conclusion explicitly after verification; a blank list does not mean “none.”

For each restricted transfer, the parties record the exporter and importer, their roles and contacts, originating and destination countries, purpose, data and individual categories, frequency, onward transfers, mechanism, risk assessment, supplementary measures and the incorporated instrument's version and acceptance date.

Where the EU Standard Contractual Clauses are applicable, complete the selected module, optional clauses, subprocessor notice period, supervisory authority, governing law, courts and all required annexes. For a UK Addendum, complete its tables and selections. For other mandatory instruments, complete the equivalent required particulars without altering mandatory text.

Do not start a restricted transfer with an empty transfer record or assume a link to official clauses makes them binding. If no restricted transfer occurs, document the factual basis; reassess before changing location, remote access or suppliers.