Data Processing Agreement

Effective date: 2026-06-07  ·  Permanent archive link

This Data Processing Agreement ("DPA") forms part of the Terms of Service between PanelDNS (the "Processor") and the reseller (the "Controller"). It governs the processing of personal data by the Processor on behalf of the Controller in connection with the PanelDNS Service.

1. Definitions

• "Personal Data" — any information relating to an identified or identifiable natural person as defined in applicable data protection law.
• "Processing" — any operation performed on Personal Data, including collection, storage, retrieval, modification, disclosure, or deletion.
• "Data Protection Law" — includes the EU General Data Protection Regulation (GDPR) 2016/679 and any national implementing legislation, and equivalent laws in other applicable jurisdictions.
• "Sub-processor" — any third party engaged by the Processor to process Personal Data on behalf of the Controller.

2. Scope of Processing

The Processor processes Personal Data solely to the extent necessary to provide the Service as described in the Terms of Service. The subject-matter, nature, purpose, and duration of processing, and the types of data processed, are described in Annex A.

3. Controller Obligations

The Controller warrants that:

• It has a valid legal basis for providing Personal Data to the Processor
• It has provided data subjects with an appropriate privacy notice
• It has authority to enter into this DPA on behalf of all relevant entities in its group

4. Processor Obligations

The Processor shall:

• Process Personal Data only on documented instructions from the Controller
• Ensure that persons authorised to process Personal Data are bound by confidentiality obligations
• Implement appropriate technical and organisational security measures
• Assist the Controller in responding to data subject rights requests
• Delete or return all Personal Data to the Controller upon termination of the Service
• Make available to the Controller all information necessary to demonstrate compliance with this DPA

5. Sub-processors

The Controller grants general authorisation for the Processor to engage sub-processors. The current list of approved sub-processors is maintained at /legal/sub-processors. The Processor shall notify the Controller of any intended change to the list, giving the Controller the opportunity to object within 30 days.

6. Security Measures

The Processor maintains the following security measures (at minimum):

• Encryption of Personal Data in transit (TLS 1.2+) and at rest (AES-256)
• Access controls limiting Personal Data access to authorised personnel
• Regular penetration testing and vulnerability scanning
• Incident response procedures including notification timelines
• Regular backups with tested restore procedures

7. Data Breach Notification

In the event of a Personal Data breach, the Processor shall notify the Controller without undue delay and in any event within 72 hours of becoming aware of the breach. Notification shall include the nature of the breach, categories and approximate number of data subjects concerned, and measures taken to address the breach.

8. Data Subject Rights

The Processor shall promptly notify the Controller of any data subject rights request it receives relating to the Controller's Personal Data and shall provide reasonable assistance to the Controller in fulfilling such requests.

9. International Transfers

Where the Processor transfers Personal Data outside the European Economic Area or another jurisdiction with an adequacy decision, it does so on the basis of the EU Standard Contractual Clauses (Commission Implementing Decision 2021/914) or equivalent approved mechanism.

10. Audit Rights

The Controller may audit the Processor's compliance with this DPA no more than once per year, with 30 days' prior written notice. The Controller must treat any information obtained in such audit as confidential.

11. Term and Termination

This DPA is coterminous with the Terms of Service. Upon termination, the Processor shall, at the Controller's choice, delete or return all Personal Data and delete existing copies, except where applicable law requires retention.

Annex A — Processing Details