Effective Date: 11.11.2026
This Data Processing Agreement (“DPA”) forms part of the Terms and Conditions concluded between NexonHost S.R.L. (hereinafter “NexonHost” or the “Processor”) and its client (the “Customer” or the “Controller”). It applies whenever NexonHost processes personal data on behalf of the Customer in the course of providing the services, and it sets out the terms required by Article 28(3) of Regulation (EU) 2016/679 (GDPR).
1. Definitions
Terms such as “personal data”, “processing”, “controller”, “processor”, “sub-processor”, “data subject” and “personal data breach” have the meaning given to them in the GDPR. “Customer Data” means the personal data that the Customer, or its own users, uploads, stores, transmits or otherwise processes using the services. “Terms and Conditions” means the NexonHost Terms of Service.
2. Subject matter and duration
2.1. The subject matter of the processing is the provision of the hosting and infrastructure services ordered by the Customer, as described in the Terms and Conditions.
2.2. The processing lasts for as long as the services are provided and, after that, until the Customer Data is deleted in accordance with section 10 of this DPA.
3. Nature and purpose of the processing
3.1. NexonHost stores and hosts Customer Data on its infrastructure and transmits it over its network, only to the extent necessary to provide the services ordered by the Customer.
3.2. NexonHost does not access, analyze or use the content of Customer Data, except where this is necessary to:➣ provide technical support or managed services requested by the Customer;➣ prevent or respond to a security incident or an abuse of the services;➣ comply with a legal obligation or a binding order of a competent authority.
4. Types of personal data and categories of data subjects
4.1. The types of personal data and the categories of data subjects are determined solely by the Customer, through what it chooses to store and process using the services. They may include, for example, identification and contact data, account data, the content of communications and technical data relating to the Customer’s own clients, employees, website visitors or other users.
4.2. NexonHost has no knowledge of the Customer Data it hosts. Where the Customer processes special categories of personal data (Article 9 GDPR) or data relating to criminal convictions and offences (Article 10 GDPR), the Customer is responsible for implementing the additional measures required, such as encryption.
5. Obligations of the Customer
The Customer, as Controller:➣ is responsible for the lawfulness of the processing of Customer Data, including the legal basis for processing and the information provided to data subjects;➣ is solely responsible for the security of the operating systems, applications, accounts and data that it manages itself, including on unmanaged servers, and for its own backups;➣ gives its instructions to NexonHost in accordance with the GDPR.
6. Obligations of NexonHost
6.1. Instructions. NexonHost processes Customer Data only on the documented instructions of the Customer, including with regard to transfers to third countries, unless required to do so by Union or Member State law; in that case, NexonHost informs the Customer of that legal requirement before processing, unless the law prohibits such information. The Terms and Conditions, this DPA, and the Customer’s configuration and use of the services constitute the Customer’s documented instructions. NexonHost immediately informs the Customer if, in its opinion, an instruction infringes the GDPR or other data protection provisions.
6.2. Confidentiality. NexonHost ensures that persons authorized to process Customer Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
6.3. Security. NexonHost implements the technical and organizational measures required by Article 32 GDPR, described in section 13 of this DPA.
6.4. Data subject requests. Taking into account the nature of the processing, NexonHost assists the Customer, by appropriate technical and organizational measures and insofar as this is possible, in responding to requests from data subjects to exercise their rights. As the Customer has direct access to Customer Data through the services, it is generally able to respond to such requests itself. If NexonHost receives a request directly from a data subject concerning Customer Data, it forwards the request to the Customer without undue delay and does not respond to it itself.
6.5. Other assistance. NexonHost assists the Customer in ensuring compliance with Articles 32 to 36 GDPR (security of processing, notification of personal data breaches, data protection impact assessments and prior consultation), taking into account the nature of the processing and the information available to NexonHost.
6.6. Records. NexonHost keeps a record of the categories of processing activities carried out on behalf of its customers, in accordance with Article 30(2) GDPR.
7. Sub-processors
7.1. The Customer gives NexonHost a general written authorization to engage sub-processors, such as data center operators and network and infrastructure providers, where this is necessary to provide the services. The current list of sub-processors is available on request at [email protected].
7.2. NexonHost informs the Customer of any intended addition or replacement of a sub-processor at least 15 days in advance, by e-mail or by a notice on the Website. The Customer may object to the change, on reasonable grounds relating to data protection, within that period. If the parties cannot resolve the objection, the Customer may terminate the affected service before the change takes effect.
7.3. NexonHost imposes on each sub-processor, by contract, the same data protection obligations as those set out in this DPA, in particular sufficient guarantees to implement appropriate technical and organizational measures. NexonHost remains fully liable to the Customer for the performance of each sub-processor’s obligations.
8. Location of the data and transfers outside the EEA
8.1. Customer Data is stored in the data center location chosen by the Customer when ordering the service. NexonHost does not move Customer Data to another location without the Customer’s instruction.
8.2. Where the Customer chooses a location outside the European Economic Area (EEA), or where a transfer is otherwise necessary to provide the services, NexonHost ensures that the transfer complies with Chapter V GDPR, for example on the basis of an adequacy decision of the European Commission or of the Standard Contractual Clauses adopted by the European Commission.
9. Personal data breaches
9.1. NexonHost notifies the Customer without undue delay, and where feasible within 48 hours, after becoming aware of a personal data breach affecting Customer Data on the infrastructure under its control.
9.2. The notification describes, to the extent the information is available: the nature of the breach, including where possible the categories and approximate number of data subjects and records concerned; the likely consequences; and the measures taken or proposed to address the breach and mitigate its effects. Where not all information is available at once, it is provided in phases without undue further delay.
9.3. NexonHost is not responsible for breaches of operating systems, applications or accounts that the Customer manages itself, but assists the Customer as set out in 6.5.
10. Deletion or return of Customer Data
10.1. The Customer can retrieve Customer Data at any time while the services are active. It is the Customer’s responsibility to retrieve the data before the services end, are cancelled or expire.
10.2. After the services end, NexonHost deletes the Customer Data in accordance with section 10 of the Terms and Conditions, unless Union or Member State law requires it to be stored. Storage media that held Customer Data are securely wiped before being assigned to another client, or physically destroyed.
11. Audits and information
11.1. NexonHost makes available to the Customer all information necessary to demonstrate compliance with Article 28 GDPR and this DPA.
11.2. NexonHost allows for and contributes to audits, including inspections, conducted by the Customer or by an independent auditor mandated by the Customer and bound by confidentiality, under the following conditions:➣ the Customer sends a written request at least 30 days in advance;➣ audits take place at most once every 12 months, unless a personal data breach has occurred or a supervisory authority requires it;➣ audits take place during normal business hours, without disrupting the services or compromising the security of the infrastructure, and without access to the data of other clients;➣ the costs of the audit are borne by the Customer.
11.3. NexonHost may first answer the request by providing documentation; an on-site inspection takes place only if that documentation is not sufficient to demonstrate compliance.
12. Liability, precedence and applicable law
12.1. The liability of each party under this DPA is governed by section 13 of the Terms and Conditions, without prejudice to Article 82 GDPR.
12.2. In the event of a conflict between this DPA and the Terms and Conditions regarding the protection of personal data, this DPA prevails.
12.3. This DPA is governed by Romanian law. It remains in force for as long as NexonHost processes Customer Data on behalf of the Customer, and it may be amended in accordance with section 5 of the Terms and Conditions.
13. Technical and organizational security measures
NexonHost implements the following measures, as applicable to the service ordered:
- physical security: servers are hosted in professionally operated data centers with controlled physical access;
- access control: access to the infrastructure is limited to authorized personnel, using individual accounts and strong authentication;
- separation: dedicated servers are allocated to a single client, and virtual servers are isolated from one another through virtualization;
- network security: firewalls, DDoS mitigation and monitoring of security events;
- encryption of communications with the client area and management interfaces;
- confidentiality commitments for staff and contractors with access to Customer Data;
- secure wiping or physical destruction of storage media before reuse or disposal;
- procedures for detecting, handling and notifying security incidents.
For unmanaged services, the Customer remains responsible for securing its own operating systems and applications, for encrypting Customer Data where appropriate and for keeping its own backups.