DATA PROCESSING ADDENDUM & GDPR COMPLIANCE SCHEDULE

Effective Date: 6 November 2026

Between:

1. CLOUDSERVE SOLUTIONS LTD (“CloudServe”, “Data Processor”, “we”, “us”)
2. The Client (“Customer”, “Data Controller”, “you”)

This Data Processing Addendum (“DPA”) supplements Section 7 of the CloudServe Master Terms and Conditions and applies when CloudServe processes personal data on the Client's behalf under an accepted order. It does not replace CloudServe's separate Privacy Notice for account, billing, payment and security data for which CloudServe determines the purposes and means of processing.

1. Structure, Status, and Scope

1.1 Legislative Framework

This DPA is drafted in accordance with:

• The UK General Data Protection Regulation (UK GDPR) as amended, including by the Data (Use and Access) Act 2025.
• The Data Protection Act 2018 (DPA 2018).
• Applicable privacy laws in the United Kingdom governing electronic communications (PECR).

1.2 Dual Role Designation

• CloudServe as Data Processor: Applies to personal data that you or your authorised users store in a hosted product or provide for services covered by your order, insofar as CloudServe processes it on your documented instructions. You remain the Data Controller.
• CloudServe as Independent Data Controller: Applies to CloudServe's own customer relationship, account administration, billing, payment, fraud prevention and service security records. The parties' roles depend on the particular processing purpose; a payment provider may also act as its own controller under its separate notice.

2. Processing Obligations (Article 28 UK GDPR)

2.1 Scope of Instructions

CloudServe shall process personal data solely on documented, reasonable instructions from the Data Controller, including with respect to transfers outside the UK, unless required to do so by applicable UK statutory law. In such cases, CloudServe will inform you of that legal requirement before processing, unless prohibited by law on public interest grounds.

The accepted order, the use and configuration of the service by your authorised administrators, and written support requests are documented instructions to the extent they are consistent with this DPA. CloudServe will promptly tell you if, in its opinion, an instruction infringes applicable data protection law and may pause that instruction while the issue is resolved.

You are responsible for deciding the lawful purposes and basis for your use of the hosted product, providing required notices to your users, handling their rights requests and giving lawful documented instructions. You may amend or withdraw an instruction by an authorised written request, subject to the technical and contractual limits of the service and applicable law.

2.2 Confidentiality

CloudServe ensures that personnel authorised to process personal data are committed to confidentiality or are under an appropriate statutory obligation of confidentiality. Sub-processors are separately bound under Section 3.

2.3 Technical and Organizational Measures (TOMs)

CloudServe shall implement and maintain appropriate technical and organisational measures proportionate to the risk, including access controls, authentication, encrypted transport where supported by the service, logical tenant separation, patching, logging and backup or recovery measures described in the applicable order. CloudServe will review and update these measures as risks and technology change. Any specific recovery objective, certification, encryption standard or monitoring frequency applies only when stated in the applicable service description.

3. Sub-Processors

3.1 Prior General Authorization

You grant general written authorization for CloudServe to engage third-party sub-processors to deliver core hosting, payment automation, and licensing services.

3.2 Authorized Core Sub-Processors

The relevant categories of suppliers depend on the service selected. CloudServe will maintain an up-to-date list of processors used for Client-controlled hosted data and make it available to you on request. Hosting or infrastructure providers may process hosted files, database records, logs and backups to provide the ordered service. Brevo may process contact information for verification or service email where enabled. GoCardless handles Direct Debit information for CloudServe's own billing purposes; it is not automatically a sub-processor for Client-controlled Hub records. Any separately offered card payment provider will be identified in the relevant order or checkout. The applicable supplier's processing role, location and transfer safeguard must be confirmed for the particular service and data flow.

CloudServe shall enter into a written contract with each sub-processor that imposes data protection obligations offering an equivalent level of protection to this DPA. CloudServe remains responsible to the Client for that sub-processor's performance of its obligations under this DPA.

3.3 Changes to Sub-Processors

CloudServe will notify you at least fourteen (14) calendar days before appointing or replacing a sub-processor for Client-controlled data, where practicable, and provide an opportunity to object on reasonable data-protection grounds before that supplier begins processing your data. If an objection cannot be resolved, the parties will discuss an alternative; you may terminate the affected service before the new supplier begins processing, without an early termination charge for that service.

4. Data Subject Rights & Regulatory Cooperation

4.1 Data Subject Access Requests (DSARs)

• CloudServe will direct Data Subject requests relating to Client-controlled data to you, unless legally required to respond itself.
• CloudServe will notify you within three (3) business days of receiving any such request and will provide reasonable technical assistance to help you fulfill your legal obligations under Chapter III of the UK GDPR.
• Any reasonable fee for assistance beyond the included service tools will be agreed in advance and will not remove CloudServe's obligations under applicable law.

4.2 Data Protection Impact Assessments (DPIAs)

CloudServe will provide reasonable assistance with data protection impact assessments and prior consultations with the Information Commissioner’s Office (ICO) where required by Articles 35 and 36 of the UK GDPR, limited to information directly within CloudServe's control.

5. Security Incidents and Personal Data Breach Notification

5.1 Breach Detection and Escalation

In the event CloudServe becomes aware of a personal data breach affecting Client-controlled data, CloudServe will:

1. Notify you in writing without undue delay, using the contact details you provided. CloudServe will not wait for a complete investigation before giving an initial notice.
2. Provide details regarding the nature of the breach, affected data categories, estimated volume of impacted records, and likely operational consequences.
3. Detail immediate containment and remediation measures taken or planned to mitigate potential adverse effects.

5.2 Regulatory Filings

As Controller, you assess any duty to notify the Information Commissioner or affected individuals. CloudServe will provide information and reasonable assistance for your assessment and notifications. The statutory 72-hour reporting period, where applicable, runs from the Controller becoming aware of a reportable breach; this DPA does not extend that period.

6. International Data Transfers

The location of production hosting and any onward transfer must be specified in the applicable order or service description. If processing outside the UK requires a transfer mechanism under UK law:

• CloudServe will rely on applicable UK adequacy regulations; or
• CloudServe will put in place an appropriate UK International Data Transfer Agreement (IDTA) or UK Addendum to the EU Standard Contractual Clauses, together with any required transfer risk assessment.

7. Audits, Records, and Compliance Verification

7.1 Compliance Evidence

CloudServe will make available to you, upon written request, all documentation reasonably necessary to demonstrate compliance with Article 28 of the UK GDPR.

7.2 Independent Audits

To inspect infrastructure or systems:

• The parties will agree reasonable notice, scope and security arrangements for audits and inspections, taking account of multi-tenant environments and confidentiality obligations.
• Audit evidence may be supplied first by current independent assurance reports or written responses where these meet the Controller's reasonable needs. The Controller may still carry out or mandate an inspection where necessary to demonstrate compliance with Article 28.
• The parties will agree any reasonable allocation of additional audit costs in advance. No annual frequency or notice limit removes a statutory audit or inspection right.

8. Term, Data Return, and Secure Deletion

8.1 Cessation of Services

Upon termination of hosting, software licensing, or custom services:

• At your choice, CloudServe will return or delete Client-controlled personal data at the end of the service, unless UK law requires storage. For a managed SiteTools product, the accepted order instructs CloudServe to apply the 92-day recovery and export process described below unless you give a different lawful written instruction before removal.
• A reasonable export in a commonly used format will be provided where technically feasible. Unpaid invoices do not remove your rights over Client-controlled personal data. Additional migration work outside the agreed export may be separately charged if agreed in advance.
• The standard SiteTools recovery window runs for 92 days from cancellation taking effect or suspension. During that window, the service may be reactivated after payment and account eligibility checks. Before planned removal, CloudServe prepares an encrypted database export, offers it to the verified company administrator through a protected Management download, and sends the archive password separately. This automatic export covers the product database; contact CloudServe before removal for uploaded files or another available format. A failed backup, failed handoff, identity mismatch or legal hold pauses removal for review.

8.2 Deletion of Remaining Copies

After the recovery window and export handoff, CloudServe removes the managed product's Plesk site and database through an installation-specific process. A Management-held encrypted database export is isolated from routine use and retained for up to 12 months from its creation for customer recovery or a further export request. You may request earlier deletion after the product has been removed or restored, subject to a documented legal hold. At expiry, the export is deleted unless applicable law requires retention. Other disaster-recovery copies follow their documented rotation. CloudServe's own controller records are covered by its Privacy Notice.

9. Appendix: Scope and Nature of Processing

• Subject Matter: The provision of web/application hosting, DNS administration, custom software deployment, licensing verification, and recurring billing automation.
• Duration: The active service contract and any documented transition, return or deletion period described in the applicable order or service description.
• Nature and Purpose: Storage, database retrieval, server execution, secure routing, and platform maintenance required to deliver the services ordered by the Client.
• Categories of Data Subjects: Client employees, contractors, registered users, and end-consumers visiting or utilizing the websites, software, and applications hosted or developed by CloudServe.
• Categories of Personal Data: Names, email addresses, phone numbers, delivery addresses, login usernames, hashed credentials, IP addresses, session identifiers, transaction histories, and user-generated database records.
• Special Categories of Data: No special-category processing is included by default. If the ordered product will be used for such data, the Client must notify CloudServe before use so the parties can document the categories, lawful basis, additional safeguards and any necessary change to the service description. This paragraph does not itself approve special-category processing.