Legal
Last updated: September 2026
The terms on which we process personal data on your behalf when we host your website, database or email. Required by Article 28 of the UK GDPR, and it applies to you automatically from the moment your order is accepted.
This agreement forms part of your contract with us under clause 15 of our Terms and Conditions. You do not need to sign a separate copy for it to apply, but if your auditor needs a countersigned PDF, ask us and we will send one.
When we host your website, database or email, that content may contain personal data about your own visitors, customers, members or staff. In respect of that data:
This is different from the personal data we hold about you as our customer, such as your billing details and support tickets. For that we are the controller, and our Privacy Policy applies instead.
In this agreement, “UK GDPR” and “Data Protection Legislation” mean the UK General Data Protection Regulation and the Data Protection Act 2018 as amended from time to time, and “personal data”, “processing”, “data subject”, “controller”, “processor” and “personal data breach” have the meanings given to them there.
The subject matter, duration, nature, purpose, categories of data and categories of data subject are set out in Annex A at the end of this agreement.
In summary: we process whatever personal data you choose to place on the Services, for the sole purpose of providing you with hosting, storage, transmission, backup and support, for as long as you hold the Services with us.
We do not know what personal data your site holds and we do not inspect it. That is deliberate. It also means you are responsible for making sure you have a lawful basis for it, that it is accurate, and that you have told your own data subjects about it.
You warrant that:
You are responsible for the security of anything within your own control, including your account credentials, the application software you install, and the permissions you grant your own staff and clients.
We will:
We will tell you immediately if, in our opinion, an instruction you have given us infringes the Data Protection Legislation.
Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, we implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk. These cover, as appropriate:
Access to personal data is restricted to personnel who need it and who are under a duty of confidentiality.
A fuller description of our measures is available on request for your own records.
You give us general written authorisation to engage sub-processors in the categories set out in Annex A. The current list, naming each one, is available on request.
Where we intend to engage a new sub-processor, or replace an existing one, we will inform you in advance at the address on your account. If you reasonably object on data protection grounds, tell us and we will work with you to find an alternative. If we cannot, you may end the affected Services without penalty and we will refund any sums paid in advance for Services not provided.
We will impose on every sub-processor, by written contract, data protection obligations no less protective than those in this agreement. We remain fully liable to you for the performance of each sub-processor's obligations.
The Services are provided from third-party data centre space in the United Kingdom. Personal data you place on the Services is stored there.
Where a sub-processor processes personal data outside the United Kingdom, we make sure one of the following applies:
A copy of the relevant safeguard is available on request.
We will notify you without undue delay after becoming aware of a personal data breach affecting personal data we process on your behalf, and in good time to allow you to meet your own reporting deadline.
Our notification will describe, so far as we know it: the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, the measures we have taken or propose to take, and a contact point for more information. Where we cannot provide all of it at once we will provide it in phases without further undue delay.
Reporting the breach to the ICO, and telling your own data subjects, is your responsibility as controller. Your deadline is 72 hours from when you become aware. We will give you what you need to meet it, but we cannot report on your behalf.
We keep records of the processing we carry out on your behalf, as required by Article 30(2) of the UK GDPR.
We will make available to you, on request, the information reasonably necessary to demonstrate compliance with our obligations under Article 28. In practice this means our written security description, and completing your own security questionnaire where you have one. For almost every customer this is the whole of it.
Where that is genuinely not sufficient, we will allow for and contribute to an audit as Article 28(3)(h) requires, on reasonable written notice, during normal business hours, no more than once in any twelve month period unless there has been a personal data breach affecting your data or a regulator requires it, subject to confidentiality, without unreasonably disrupting our business, and at your cost.
You may not physically access a shared server or a data centre floor. That is not a matter of preference: doing so would compromise the security and privacy of every other customer on that hardware.
You retain control of the personal data on your Services and can access, correct, export and delete it yourself through your control panel, which is how most requests will be satisfied.
If a data subject contacts us directly about data we process on your behalf, we will not respond to them substantively. We will tell them to contact you and, where we can identify you, tell you without undue delay.
Where you need our help to respond to a request and cannot do it yourself, we will provide reasonable assistance at no charge. Where a request needs substantial work beyond that, we may charge for it at our standard rate, and we will always agree the cost with you in writing before we start rather than presenting you with a bill afterwards.
You are responsible for exporting your data before the Services end. Your control panel provides full backups on demand for exactly this purpose, and we will help if you ask.
When the Services end, we will delete the personal data we process on your behalf within a reasonable period, including from backups as they fall out of the ordinary rotation, unless we are required by law to keep it. We do not commit to a specific timeframe and deleted data cannot be recovered. If you need the data returned rather than deleted, or need certification that it has been deleted, ask us before the Services end.
Please retrieve anything you need before your final day. Once the Services end you should not rely on being able to recover it.
This agreement takes effect when your order is accepted and continues for as long as we process personal data on your behalf.
If there is any conflict between this agreement and the Terms and Conditions, this agreement prevails in relation to the processing of personal data.
Our liability under this agreement is subject to the limitations in clause 12 of the Terms and Conditions, except to the extent those limitations cannot lawfully be applied.
This agreement is governed by the law of England and Wales and the courts of England and Wales have exclusive jurisdiction.
The provision of website, application, database and email hosting services, for the duration of your contract with us.
Storage, hosting, transmission, caching, backup, restoration, deletion, and access by our support staff where you ask us to investigate a problem. We do not analyse, mine or otherwise use the content of your data.
Whatever you choose to place on the Services. Typically this includes the identity, contact, transaction, technical, usage and marketing data of your own website users, form submissions, order records, account records and email correspondence.
Your visitors, customers, members, subscribers, suppliers and staff, and anyone else whose data you place on the Services.
None, unless you tell us in advance that you intend to process it and we confirm the plan is suitable.
We use sub-processors in the following categories:
Backups are held entirely on our own infrastructure and are not passed to a third-party storage provider.
The named list is available on request. Email [email protected] and we will send the current list, naming each supplier and what it processes. We will also tell you before we add or change one, so you can object under clause 6.
Need this countersigned, or need our security documentation? Email [email protected] or raise a ticket in the client area. We will send a signed PDF, and we can complete your own security questionnaire if you have one.
Snappy Host Ltd, Oak House A, Southwell Rd W, Mansfield NG21 0HJ.
Company No. 12659438 · ICO Registration No. ZB032228 · VAT No. GB497861032
Excellent
· 4.8 out of 5 · 84 reviews on
