Data processing agreement (DPA)

English and Romanian are the original versions; the versions in other languages are translations provided for convenience, and if they differ, the English version prevails.

Version 2026-10-20.

1. Parties and scope

This agreement is concluded between the hosting customer (the controller) and Casapu Cristian-Costinel Întreprindere Individuală, trading as MediaLab Works, Trade Register no. F16/641/2020, tax ID (CUI) 43060600, registered office in Ciupercenii Vechi, mun. Calafat, jud. Dolj, Romania (the processor, "we"). It applies to the personal data that the customer, or the visitors and users of the customer's services, store or process in a hosting account: websites, applications, databases, mailboxes, files and backups ("hosted data"). It is part of the Terms and is accepted when the hosting is ordered.

The data we process as controller for our own purposes (your customer account, billing, support, the security of our systems) is described in the Privacy policy, not here.

2. Details of the processing

• Subject matter and nature: storage, hosting, making available on the internet, transmission (web and e-mail), backup and restore of the hosted data, and the technical operations needed for that (logs, monitoring, security).
• Purpose: providing the hosting service ordered by the customer.
• Duration: while the hosting account exists, plus the deletion periods in section 9.
• Categories of data subjects: as decided by the customer, typically the visitors, users, customers, employees and correspondents of the customer's websites and mailboxes.
• Categories of personal data: as decided by the customer, typically identification and contact data, account data, the content of messages and files, and technical data (IP addresses and request details in the web server logs). Special categories of data (art. 9 GDPR) and data about criminal convictions are processed only if the customer chooses to store them; the customer is responsible for having a legal basis and for any additional safeguards.

3. Instructions

We process the hosted data only on the customer's documented instructions, which are: the Terms, this agreement, and the actions the customer takes in their account and in the hosted software. We do not access the content of the hosted data, except when it is needed to provide the service, for support requested by the customer, to restore a backup at the customer's request, to protect the security of the server, or to comply with the law or an order of an authority (in that case we inform the customer, unless the law forbids it). We do not use the hosted data for our own purposes, do not sell it and do not analyze it for advertising. If we believe an instruction infringes the GDPR, we tell the customer.

4. Confidentiality

Only the persons who operate the service have access to the server, and they are bound by confidentiality. MediaLab Works is a sole proprietorship: today that person is its owner.

5. Security measures (art. 32 GDPR)

• Location: the hosted data, its backups and the mailboxes are stored on our own servers in Romania, in the EU.
• Isolation: one Linux user per customer, with resource limits; websites in rootless containers, without access to other accounts or to the local network; databases with a separate user per customer, not reachable from the internet.
• Access: two-factor authentication for our admin panel, the root agent of the server limited to a fixed list of operations; customer access over SFTP / SSH (keys from the Standard plan).
• Encryption in transit: HTTPS with free certificates for every site, SFTP / SSH, and TLS for e-mail.
• Backups: daily, encrypted (restic), on a separate disk in the same server, kept according to the plan. They are not stored in a second location.
• Monitoring and updates: availability monitoring, operating system and container image updates, logs of administrative operations without secrets; web server logs are kept 14 days.
• Passwords shown to the customer once and stored by us only as hashes, or not at all.

The customer is responsible for the security of what they install and configure (applications, plugins, passwords, access given to others).

6. Subprocessors

The customer gives a general authorization for the subprocessors below. We inform the customer by e-mail at least 30 days before adding or replacing a subprocessor; the customer may object for a reasonable reason, and if we cannot address the objection, the customer may cancel the hosting with a refund of the unused prepaid period.

Stripe (Stripe Payments Europe, Ltd.) processes the payments for the hosting as a separate controller for the payment data; it does not receive the hosted data. See the Privacy policy.

7. Assistance to the customer

Taking into account the nature of the processing, we help the customer to:

• answer requests from data subjects (access, rectification, erasure, portability …): the customer can find, export, change or delete the hosted data themselves, from the account, over SFTP / SSH and in the databases; if a data subject writes to us directly, we forward the request to the customer without undue delay;
• meet their obligations on security, breach notification, data protection impact assessments and prior consultation (art. 32–36 GDPR), with the information we have.

8. Personal data breaches

We notify the customer without undue delay, and in any case within 72 hours after becoming aware of a personal data breach affecting the hosted data, by e-mail to the account address. The notification describes, as far as known: the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences, the measures taken or proposed, and a contact point. Information we do not have yet is sent as soon as we have it. The customer, as controller, decides on notifying the supervisory authority and the data subjects.

9. Return and deletion at the end

• While the account is active, the customer can download all hosted data at any time (SFTP / SSH, database exports, IMAP for mailboxes).
• After the end of the subscription the account is suspended and deleted 30 days later, together with the websites, databases, mailboxes and DNS zones. The final backup is kept for those 30 days and then deleted. Older daily backups are deleted together with the account.
• After money back or a termination for breach, the same periods apply, unless the customer asks for earlier deletion.
• We keep a copy only where the law requires it.

10. Information and audits

We make available to the customer the information needed to demonstrate compliance with art. 28 GDPR (this agreement, the description of the measures, answers to reasonable questions). Audits, including inspections, by the customer or an auditor bound by confidentiality are allowed once per year or after a breach, with at least 30 days' notice, during working hours, without access to other customers' data and at the customer's cost.

11. Liability and precedence

Liability is governed by the Terms and by art. 82 GDPR. In case of conflict about the processing of hosted data, this agreement prevails over the Terms. Romanian law applies.