Data Processing Agreement

Our DPA for unmanaged VPS hosting: download the agreement and understand how we protect your data and share responsibilities.

Version 2.1 · 6 November 2026

Download DPA v2.1 (English, PDF)

The English PDF is the contractual document. This page and its translations explain the agreement for convenience; they do not replace or amend it.

DPA explained

Who is the agreement with, and what does it cover?

Your agreement is with EDGBL Ltd., registered in Cyprus under HE 445836, trading as EDIS Global. The DPA sets out our obligations when processing personal data on your behalf for unmanaged VPS hosting. You may act as controller or as a processor authorised by your own customer. It does not cover unrelated consulting or AI services.

It provides contractual terms for processing under Article 28 GDPR. Compliance also depends on your purposes, legal basis, data, configuration and chosen location. You remain responsible for assessing whether the service and safeguards meet your needs. The DPA is not a blanket compliance certificate.

Where is my VPS data stored?

VPS data and any ordered QCOW2 export remain on our infrastructure in the country you booked. We do not relocate them to another country without your documented instruction. This storage commitment does not control destinations you choose for downloads, backups or network communications. Selecting a country does not waive applicable international-processing requirements.

Who can administer the infrastructure?

Only authorised administrators directly employed by EDGBL administer our infrastructure, from Cyprus and other EU Member States. Access is for infrastructure operation, maintenance and security, with multi-factor authentication, IP restrictions, personal SSH keys and access logging. Our personnel do not log into your VPS operating system. Infrastructure control nevertheless carries technical capabilities; it is not a promise that accessing data is technically impossible.

Do you outsource VPS hosting or administration?

We operate our own server hardware and do not rent servers or appoint another company to host or administer VPS content. Data centres provide facilities and authorised physical assistance without console access or administrative credentials. Off-site repair partners receive no customer data. A supplier’s actual activities determine its GDPR role; any future subprocessor requires the specific written authorisation described in the DPA.

Who is responsible for security and updates?

We maintain and secure the hosting infrastructure, including host operating systems, hypervisors and kernels. You administer and secure your VPS operating system, applications, accounts and configuration, including their updates. This division does not transfer our own security duties or statutory liability to you.

Do you keep backups of my VPS?

No routine backups or additional VPS replicas are included. You must arrange independent backups and test recovery. An expressly ordered QCOW2 export is a separate copy available for a limited period; the retention window is not a backup or recovery guarantee.

Are VPS contents encrypted?

We do not provide managed encryption of VPS contents at rest. You choose and implement encryption and manage the keys according to your risks and obligations. QCOW2 exports use HTTPS, a long random filename and separate username/password protection. The SHA256 checksum verifies file integrity; it does not encrypt the file.

When are data and exports deleted?

After actual VPS termination, its data is retained for six days and then permanently deleted. An ordered QCOW2 export is deleted 30 days after creation; this period can extend beyond deletion of the VPS. We cannot manually shorten these automatic periods. Mandatory legal obligations remain applicable. Arrange any export before termination and download it before expiry.

What happens if there is a personal data breach?

We notify the customer without undue delay after becoming aware of a breach affecting personal data processed on its behalf. We do not wait for a risk assessment before sending the initial notification. Available details may follow in stages. Our escalation route operates 24/7/365. This is not a promise of instantaneous notification or a fixed notification deadline.

How do I conclude the DPA?

Download the English PDF, complete the customer details and have an authorised representative sign it. Send the complete signed document with your customer account reference to the contact below; we will return a countersigned copy. Keep the completed agreement with your records. Downloading the PDF alone does not conclude the agreement. If you already have a valid DPA, publication of a new version does not by itself replace it.

How does the Digital Services Act relate to this?

The DSA concerns our obligations as a provider of intermediary services. Our legal notice explains the Authority’s confirmation of DSA scope and the planned register publication. This is separate from this data-processing agreement and does not certify your GDPR compliance.