Skip to content
EN
RomânăRO EnglishEN DeutschDE FrançaisFR EspañolES ItalianoIT
Check for free
Data processing agreement

Data processing agreement.

Updated on 29.10.2026

This agreement is part of the guruburu Care terms and covers every site we host for you. It is the contract that article 28 of the GDPR (Regulation (EU) 2016/679) asks for, made in electronic form when you accept the terms: there is nothing else to sign.

Who is who

You, the client named on the account, are the controller of the personal data on your sites. We, Vălcăneanțu Alin-Ștefan PFA (tax ID 44410738, F35/197/2024), Timișoara, Romania, are your processor.

If you are yourself a processor for someone else, an agency hosting its clients' sites for example, we are your sub-processor, and you make sure your client has agreed to it.

What we process

  • Purpose: hosting your WordPress sites and caring for them: running them, backing them up, trying and applying updates, watching that they answer, restoring them, moving them to us, support and technical intervention.
  • Nature: storing, copying (backups, the staging copy and the copy where updates are tried), reading for checks and screenshots, sending between our servers, and deleting.
  • Duration: as long as the contract, then until the site is deleted, 30 days after the plan ends, and its backups 7 days after that.
  • Data: whatever your sites hold. Usually names, email and postal addresses, phone numbers, user accounts and password hashes, orders, messages sent through forms, comments, and the IP addresses and browsers of visitors in the server logs.
  • People: your site's visitors, customers, users, subscribers and staff, and anyone your content is about.

Our service is not built for special categories of data, such as health data. If your site holds any, you make sure the measures below are enough for it.

Only on your instructions

We process the data only on your documented instructions: the terms, your plan, and what you do or ask for in the portal, by ticket or by email. We do not use it for anything of our own. We send it outside the EU only as the list of sub-processors below says.

If we think an instruction breaks data protection law, we tell you at once. If EU or Romanian law makes us process the data otherwise, we tell you first, unless that law forbids it.

Confidentiality

Only the people who need access to run the service get it, and they are bound to keep it confidential. Staff look inside a site only for the reasons in "Support and technical intervention" in the terms, and every entry is logged and kept 3 years.

Security

We protect the data with technical and organisational measures that fit the risk (GDPR, art. 32). Today they are:

  • Servers in Germany, with the operating system's security updates installed automatically.
  • Each site runs as its own system user, with its own PHP processes, database and object cache, apart from the other sites.
  • HTTPS on every site and on the portal.
  • Encrypted backups, kept as your plan says, plus a daily copy of the whole server kept 7 days by our server provider.
  • Administrator access to the servers only with SSH keys, and repeated failed logins blocked.
  • Portal passwords stored only as hashes, with optional two step verification; the staff panel only with two step verification.
  • Passwords we make for you shown once and kept encrypted for 7 days at most.
  • Web server logs kept 14 days at most.
  • On Care plans, updates tried on a copy of the site before they reach it.

We may change these measures as long as the protection does not drop.

Sub-processors

You allow us in general to use sub-processors. Today they are:

  • Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany: the servers, in Nuremberg, Germany, and their daily copies. The data stays in the EU.
  • Zoho Corporation B.V., Beneluxlaan 4B, 3527 HT Utrecht, Netherlands: our email (ZeptoMail and Zoho Mail), in its EU data centres; only for data from your site that reaches us by email, in a support request for example.
  • Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA: it forwards the email sent to our addresses; again only for data that reaches us by email.

We email you at least 30 days before we add or replace a sub-processor. You can object within that time for a reasonable reason; if we cannot meet it, you can end the contract before the change.

Each sub-processor is bound by data protection terms that protect the data as this agreement does, and we remain responsible to you for it.

Outside the EU

Your sites and their backups stay in the EU. Zoho's support staff in India may access its EU data centre under the European Commission's standard contractual clauses. Cloudflare, Inc. is certified under the EU-US Data Privacy Framework, with the standard contractual clauses as a fallback.

Helping you

We help you answer the people whose data it is when they ask to see, correct, delete or take their data, mostly through what WordPress and the portal let you do yourself; for anything more, write to us. We also help you with security, data breaches, impact assessments and consulting the authority, as far as our part of the processing allows.

Data breaches

If we learn of a personal data breach on our side that touches your sites, we tell you without undue delay, and within 48 hours at the latest, with what we know: what happened, which sites and data, what we did and what you may need to do. You decide whether to tell the authority and the people concerned, and we give you what we have for it.

At the end

When the contract ends, the site and its backups stay for 30 days, so you can come back or ask us for a copy. Then we delete the site, and its backups 7 days later; they leave our server provider's daily copies within 7 more days. We keep nothing unless EU or Romanian law requires it.

Information and audits

We give you the information you need to show that these duties are met. You, or an independent auditor bound to confidentiality, may audit us once a year, with 30 days' notice and at your cost, without access to other clients' data. We may first answer with documents.

Liability and contact

The liability rules of the terms apply to this agreement as far as the GDPR allows. For anything about data protection, write to hello@guruburu.eu.