Data Processing Agreement (DPA)

pursuant to Art. 28 GDPR
Effective Date: 15 October 2026

This Data Processing Agreement ("DPA") is entered into between the customer as controller ("Controller") and Nona Consult LLC, 30 N Gould St Ste R, Sheridan, WY 82801, USA, operating under the brand "Fuyonet", as processor ("Processor"). It supplements our Terms of Service and applies to all Services in which the Processor processes personal data on behalf of the customer.

Conclusion: This DPA becomes part of the contract upon conclusion of the hosting contract or use of the Services, without the need for a separate signature.

1. Subject Matter and Duration

The subject matter is the provision of web hosting, email, database, server and related services. This DPA applies for the term of the main contract and thereafter for as long as the Processor processes personal data of the Controller.

2. Nature, Purpose, Types of Data and Data Subjects

  • Nature and purpose: storage, hosting, transmission, backup and technical provision of content supplied by the Controller; delivery of email; operation, maintenance and troubleshooting of the systems.
  • Types of data: all data that the Controller or its users store or process on the Services, in particular master, contact, communication, contract and usage data, contents of emails, files and databases, and log data (e.g. IP addresses in server logs).
  • Data subjects: customers, prospects, visitors, users, employees and correspondents of the Controller.

The Processor accesses the content of customer data only as necessary to provide, secure or maintain the Services, as instructed by the Controller, or as required by law.

3. Location of Processing

The servers on which customer data is stored and processed are located in data centers in the European Union (France). Backups are also stored in the EU.

Administrative access and support (e.g. maintenance, troubleshooting, handling of requests) may be performed by the Processor from outside the EU. Insofar as this involves a transfer of personal data to a third country, the EU Standard Contractual Clauses pursuant to Commission Implementing Decision (EU) 2021/914, Module 2 (controller to processor), apply and are incorporated into this DPA by reference (see Section 11).

4. Instructions

The Processor processes personal data only on documented instructions of the Controller — including instructions given through the configuration of the Services — unless required to do otherwise by law. In that case the Processor informs the Controller beforehand, unless the law prohibits this. If the Processor considers an instruction to infringe data protection law, it will inform the Controller.

5. Confidentiality

The Processor ensures that all persons authorized to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

6. Technical and Organizational Measures (Art. 32 GDPR)

  • Physical access control: operation in professional data centers with access control, video surveillance and 24/7 security staff.
  • System and data access control: administrative access only for authorized staff via encrypted connections (key-based SSH, TLS); separation of customers through dedicated system users, file permissions and PHP processes per subscription; protection against attacks by firewall and automatic blocking (fail2ban).
  • Transfer control: encrypted transmission (HTTPS/TLS, SMTP/IMAP/POP3 with TLS, SFTP/FTPS); encrypted transfer of backups.
  • Input control: logging of administrative actions in the control panel and at system level.
  • Availability control: regular backups, redundant power and network connectivity of the data centers, 24/7 system monitoring, timely security updates.
  • Separation control: logical separation of the data of different customers.
  • Review: regular review and adjustment of the measures to the state of the art.

7. Sub-processors

The Controller grants general authorization for the engagement of sub-processors. Currently engaged:

  • Operator of the data centers and server infrastructure, registered office and place of processing France (EU) — provision of data center, hardware and network connectivity.
  • Provider of cloud storage for backups, storage location Netherlands (EU) — storage of server backup copies.

Full details of the sub-processors are provided to customers on request. The Processor informs the Controller in advance of any intended changes; the Controller may object on reasonable data protection grounds. The Processor contractually binds sub-processors to an equivalent level of data protection.

8. Assistance

The Processor assists the Controller, to a reasonable extent, in fulfilling data subject rights (Art. 12–23 GDPR) and the obligations under Art. 32–36 GDPR (security, notification of personal data breaches, data protection impact assessment). Many rights can be implemented by the Controller directly via the control panel (e.g. deleting mailboxes, files and databases).

9. Notification of Personal Data Breaches

The Processor notifies the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's data and provides the information required for a notification under Art. 33 GDPR, insofar as available to it.

10. Deletion and Return

After termination of the contract the Processor deletes the customer data unless a statutory retention obligation applies. Until the end of the contract the Controller can back up its data itself via the control panel or via FTP/SFTP, IMAP and database export. Backups are deleted as part of the regular rotation.

11. Third-Country Transfers — EU Standard Contractual Clauses

For transfers within the meaning of Section 3, the parties agree on the Standard Contractual Clauses pursuant to Implementing Decision (EU) 2021/914, Module 2, with the following specifications: Clause 7 (docking clause) does not apply; Clause 9 Option 2 (general authorization, information with reasonable notice); the optional language in Clause 11 does not apply; Clause 17: law of France; Clause 18: courts of France. Annex I (parties, description of the transfer) follows from Sections 1–3, Annex II (technical and organizational measures) from Section 6, and Annex III (sub-processors) from Section 7 of this DPA. In the event of conflict, the Standard Contractual Clauses prevail.

12. Audits

The Processor makes available to the Controller on request the information necessary to demonstrate compliance with this DPA. Audits are carried out primarily by means of information and documentation; on-site inspections after reasonable prior notice, during business hours and without disrupting operations.

13. Liability and Final Provisions

Liability is governed by Art. 82 GDPR; otherwise the liability provisions of the main contract apply. In the event of conflict between this DPA and other agreements, this DPA prevails with respect to data protection. Should any provision be invalid, the validity of the remaining provisions remains unaffected.

Contact

Nona Consult LLC — Fuyonet. For data protection questions and requests regarding this DPA, please open a ticket in your customer account or use our contact form.