1. Scope and roles
This DPA applies when Domain Market processes personal data on behalf of a Customer. The Customer is generally the controller and Domain Market the processor. For billing, accounting, security, fraud prevention, account administration and legal obligations, Domain Market acts as an independent controller.
2. Subject matter, nature and duration
Depending on the service, processing may include hosting, storage, transmission, backups, restoration, support, migration, email delivery, contacts, campaigns and analytics. Processing continues for as long as required for the service and the lawful retention period.
3. Categories of data
Processing may concern visitors, online shop customers, users, employees, business partners and newsletter recipients, and may cover contact details, IP addresses, logs, emails and application data that the Customer chooses to process.
4. Customer instructions and obligations
Domain Market processes data only on documented instructions, unless otherwise required by law. The Customer is responsible for the lawful basis, information provided to data subjects, consent where required, accuracy and retention.
5. Confidentiality and security
Authorised personnel access data only when necessary and are bound by confidentiality obligations. Appropriate technical and organisational measures are implemented, including access controls, logical isolation, logging, updates, network protection, backups, WAF and anti-malware tools where included, and incident response.
6. Subprocessors
The Customer gives general authorisation for the use of necessary subprocessors. Domain Market imposes appropriate data protection obligations and makes an up-to-date list of subprocessors available.
7. International transfers
Where a transfer outside the EEA is necessary, a lawful mechanism is used, such as an adequacy decision or Standard Contractual Clauses.
8. Rights, impact assessments and audits
Reasonable assistance is provided with data subject requests, data protection impact assessments and compliance information, taking account of the nature of the processing. Audits must not jeopardise security or other customers’ data.
9. Personal data breaches
Where an incident triggers a notification obligation in Domain Market’s capacity as processor, Domain Market informs the Customer without undue delay after becoming aware of it and provides the relevant information available.
10. End of service
When the service ends, data is deleted or made inaccessible in accordance with the retention policy and legal obligations. The Customer must export any data they need before the service ends.
11. Email Marketing
For contacts, suppression lists, campaigns, analytics and consent records, the Customer remains the controller and is responsible for GDPR and ePrivacy compliance and for evidence of a lawful right to contact recipients.
If provisions conflict on a personal data processing matter, this DPA takes precedence to the extent required by the GDPR.
Company details
AegeanHost Single Member P.C. / Domain Market. Registered office: Parodos Michail Livanou 0, Chios, 82100, Greece.
Current AI service provider
The current external provider of artificial intelligence features is OpenAI. Data used for these features may be processed in the United States of America.