Data processing agreements
If you handle other people’s personal data on servers you run with us, the law expects a clear chain of responsibility. A data processing agreement writes that chain down — and establishes who we are in it.
When personal data is involved, data-protection law wants the responsibilities named, not assumed. A Data Processing Agreement is the document that does that between two parties. If your service handles personal data, you will likely need one — both from your customers to you, and from you to us.
The chain of roles
- Controller — decides why and how data is processed. Usually your customer, or you for your own users.
- Processor — handles data on the controller’s instructions. Often you, running the service.
- Sub-processor — a processor’s processor. This is where we typically sit, providing the infrastructure.
Where we fit
For most hosting, we are a sub-processor: we provide the servers and network; you run the application and decide what data it holds. We do not look inside your data or decide what you do with it — see GDPR: who is responsible for what. The DPA makes that boundary explicit.
When you need one with us
If your service processes personal data and you need to show your own customers a complete chain, ask us for a DPA covering our role. It documents what we do with the data entrusted to our layer — which, for unmanaged dedicated servers, is deliberately very little.
What it typically covers
The scope of processing, security measures, how sub-processors are handled, assistance with data-subject requests, and what happens to data when the service ends — see cancelling, and what happens to your data. It is a clarity document, not a trap.
Putting it in place
Ask through support and tell us the shape of your service — whether we are a sub-processor and what you need to show your own controllers. We will put the agreement in place; for anything bespoke, a confidentiality agreement can sit alongside it.
Still stuck? Mail support@novogara.com — an engineer answers, at any hour. Back to the knowledge base