Uzaily Data Processing Agreement (DPA)
Version 1.0, 27 October 2026
Version 1.0, subject to legal review; a new version requires re-acceptance.
1. Who the parties are
- Processor ("we", "Uzaily"): Hallridge Holdings LLC, a Wyoming limited liability company, 30 N Gould St Ste R, Sheridan, WY 82801, USA, trading as Uzaily. Contact: hello@uzaily.com.
- Controller ("you", "the Customer"): the business or person whose account owner accepts this DPA in the Uzaily app. We record the Customer's name, the person accepting, their email, the date and time (UTC) and the version at acceptance.
"Controller" and "processor" are GDPR and UK GDPR terms. Under POPIA the same roles are called "responsible party" and "operator". This DPA forms part of the Uzaily Terms of Service (the "Main Terms"). If the two conflict on data protection, this DPA wins.
2. What we process, and why
| Item | Detail |
|---|---|
| Subject matter | Hosting, running, backing up and monitoring the Customer's websites, apps, databases, email and domains on Uzaily. |
| Nature and purpose | Storage, hosting and serving of the Customer's site files and databases; backups and restores; email hosting; DNS and domain management; uptime and server monitoring (including the optional server agent); support and fixes the Customer approves; optional AI assistant features. All of this is done on the Customer's instructions. |
| Types of personal data | Customer site data: whatever the Customer and its visitors put into the Customer's sites, apps, databases, files and mailboxes. We don't choose this data and we don't routinely look at it. Operational data: server logs and short redacted error-log extracts used to explain outages, visitor IP addresses in web logs, and Customer account users (name, email, login records). |
| Special categories | Not intended. The Customer decides what its sites store and must tell us before it hosts special-category data. We do not accept special-category workloads unless agreed in writing beforehand. |
| Data subjects | The Customer's site visitors, users, customers and email correspondents, and the Customer's own staff users. |
| Duration | For as long as the Customer has an Uzaily account, plus the return and deletion period in section 11. |
Customer billing data (name, billing address, payment status) is processed by us as a controller for our own billing and is not covered by this DPA; Stripe acts as an independent controller for payment data.
3. Instructions (GDPR Art. 28(3)(a))
We process personal data only on the Customer's documented instructions: this DPA, the Main Terms, and what the Customer does or approves in the app (for example, approving a fix). If the law requires us to process it otherwise, we tell the Customer first unless the law forbids that. If we think an instruction breaks data protection law, we tell the Customer.
4. Confidentiality (Art. 28(3)(b); POPIA s20)
Everyone we allow to process Customer data, including our staff and personnel under confidentiality (individual contractors working for us), is bound by confidentiality by contract or by law and gets only the access the task needs. We do not disclose Customer data except as this DPA allows or the law requires.
5. Security (Art. 28(3)(c) and Art. 32; POPIA s19 and s21)
We keep appropriate technical and organisational measures in place. These include: - TLS in transit - per-Customer separation of servers and accounts - access only for people who need it - approval before any change to a Customer server (human sign-off on fixes) - an append-only audit log of admin and agent actions - off-site backups - a monitoring agent that is read-only and push-only: no inbound port, a non-root user, a per-server token that can be revoked, and redaction of log extracts before sending
We review these measures as risks change. A fuller list is attached as Annex 2: encryption in transit (TLS) and at rest for backups, MFA and least-privilege admin access, audit logging, daily backups kept 14 days, patching and monitoring.
6. Sub-processors (Art. 28(2) and (4))
The Customer gives general permission for us to use the sub-processors below. We give at least 30 days' notice in the app or by email before adding or replacing one, and the Customer may object. If we can't resolve an objection, the Customer may close its account and export its data. We place the same data protection duties on each sub-processor by contract and stay responsible for them.
| Sub-processor | Service | Location | Status |
|---|---|---|---|
| Hetzner Online GmbH | Servers, hosting, databases, object storage, backups | Germany and Finland (EU) | In use |
| Hetzner Online GmbH | Email hosting and sending | Germany/Finland (EU) | In use |
| Cloudflare, Inc. | DNS, CDN, TLS and network security (where used for a Customer's domain) | Global edge network; USA company | In use for DNS and proxy (CDN/TLS/network security) only |
| Stripe Payments Europe Ltd / Stripe, Inc. | Billing and payments | Ireland / USA | Independent controller for payment processing, not a sub-processor |
| xAI (Grok) | AI assistant features (help, diagnosis, drafting fixes) | USA endpoint | Planned. Used only if the Customer uses AI features. Data sharing is switched off: Customer data is not used to train or improve xAI models and is not shared. Only the minimum context is sent, with personal details redacted where possible |
| Personnel under confidentiality | Support, development and operations work | EU, UK, South Africa and USA, remote access only under the transfer safeguards in section 7 | In use, under written confidentiality |
Only the services listed above are live; no other third-party integration processes Customer data.
7. International transfers
Hosting, storage, backups and email are in the EU (Germany/Finland). Hallridge Holdings LLC is a US company. Any access from outside the EU/UK/South Africa, and any transfer to a sub-processor outside them (Cloudflare, Stripe, xAI), will be covered by an approved safeguard: the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, the EU-US Data Privacy Framework where the recipient is certified, or a binding agreement under POPIA s72. Safeguard used: the EU Standard Contractual Clauses (2021/914, Module 2/3 as applicable) plus the UK International Data Transfer Addendum (IDTA) issued by the ICO.
8. Help with data-subject requests (Art. 28(3)(e))
If a person asks us directly about data on a Customer's site, we pass the request to the Customer and do not answer it ourselves. The Customer controls its own site data (files, databases, mailboxes), and we help where reasonable, for example with a restore or an export.
9. Breaches (Art. 28(3)(f), Art. 33; POPIA s22)
If we become aware of a breach affecting Customer data, we tell the Customer without undue delay and in any case within 72 hours, aiming for 24 hours. We say what happened, what data is affected, what we are doing and who to contact, and we help the Customer with any notices, which the Customer decides on.
10. Other help
We help with data protection impact assessments and consultations with regulators, as far as our role allows.
11. Return, export and deletion (Art. 28(3)(g))
- Export at any time: the Customer can download its files, databases and backups while its account is open.
- No silent deletion: we will not delete a Customer's servers or data, including after cancellation or non-payment, without first giving at least 30 days' written notice to the account owner so the Customer can export. Billing never switches production off or deletes data without a human decision (see Main Terms).
- After that period we delete the data from live systems, and from backups as they roll off (backups are daily and kept for 14 days).
- We keep data longer only where the law requires it, and we keep it confidential.
12. Retention
Customer site data is kept for as long as the Customer keeps it on Uzaily. Monitoring metrics are kept for 90 days in rolled-up form and redacted log extracts for 30 days. Audit and acceptance logs are kept for the life of the account plus 6 years.
13. Audits (Art. 28(3)(h))
We make available the information needed to show compliance. The Customer, or an auditor it appoints under confidentiality, may audit us with reasonable notice, at most once a year unless a breach or a regulator requires more. We may answer first with documents.
14. UK GDPR
For UK Customers, references to the GDPR mean the UK GDPR and the Data Protection Act 2018. The UK International Data Transfer Addendum to the EU SCCs (IDTA, ICO version B1.0) applies.
15. Liability
Liability under this DPA is subject to the limits in the Main Terms.
16. Changes
We may update this DPA. A new version is shown in the app and must be accepted again. Each version is stored with its text and a SHA-256 fingerprint.
17. Governing law
This DPA is governed by the laws of the State of Wyoming, USA, and the state and federal courts in Wyoming have jurisdiction, without limiting any mandatory data-protection rights a Customer or data subject has locally.
Acceptance text (for the tick box)
☐ I confirm I am authorised to act for my business, and I accept the Uzaily Data Processing Agreement, Version 1.0, between my business and Hallridge Holdings LLC.
Button: Accept DPA v1.0
Small print: We record your name, email, the date and time, your IP address and browser, and the version you accepted. You can download a copy at any time.