Data Processing Addendum

1.Roles of the parties

For personal data processed by ModHost on the Customer's behalf in the course of providing the Service — for example, data relating to the Customer's website visitors, end users, or recipients of email sent through the Customer's hosted services — the Customer is the Controller and ModHost is the Processor.

For personal data processed by ModHost in its own right — for example, the Customer's own account, billing, and contact data — ModHost is a Controller, and that processing is governed by the Privacy Policy at modhost.com/privacy, not this DPA.

2.Subject matter and details of processing

Subject matter. Processing of personal data by ModHost as necessary to provide the hosting and related services described in the Terms of Service.

Nature and purpose. Hosting, storage, transmission, backup, security monitoring, and incidental processing necessary to operate the Service.

Duration. For as long as ModHost provides the Service to the Customer, and for any retention period required afterward as described in the Privacy Policy.

Categories of data subjects. Visitors to and users of the Customer's hosted websites, recipients of communications sent through the Customer's hosted email, and any other natural persons whose data the Customer processes through the Service.

Categories of personal data. Determined by the Customer. Typically may include names, email addresses, postal addresses, phone numbers, IP addresses, account credentials, transaction records, communications, and any other categories the Customer chooses to process. The Customer is responsible for ensuring that any sensitive or special-category data processed through the Service is appropriate for hosting services and complies with applicable law.

3.Controller's instructions

ModHost processes personal data only on the documented instructions of the Customer, as set out in:

• The Terms of Service
• This DPA
• The configuration choices the Customer makes within the Service
• Any further written instructions the Customer provides

If ModHost is required by applicable law to process personal data beyond the Customer's instructions, ModHost will inform the Customer of that requirement before processing, unless the law prohibits such notification on important grounds of public interest.

4.ModHost's obligations as Processor

ModHost will:

Process only as instructed. Process personal data only as described in Section 3.

Maintain confidentiality. Ensure that any person authorized by ModHost to process personal data is bound by an obligation of confidentiality.

Maintain security. Implement appropriate technical and organizational measures to protect personal data, as described in Annex 2.

Assist the Customer. Provide reasonable assistance, taking into account the nature of the processing and the information available to ModHost, in helping the Customer:

• Respond to requests from data subjects exercising their rights under applicable data protection law
• Meet its obligations regarding security, breach notification, data protection impact assessments, and prior consultation with supervisory authorities

ModHost may charge a reasonable fee for assistance that is beyond what is included in the Service and that requires significant time or resources, with the Customer's prior agreement.

Notify of unlawful instructions. Notify the Customer if, in ModHost's opinion, an instruction from the Customer infringes applicable data protection law. ModHost is not obligated to act on instructions that it reasonably believes to be unlawful.

5.Sub-processors

General authorization. The Customer provides general authorization for ModHost to engage sub-processors to assist in providing the Service. ModHost remains responsible for the acts and omissions of its sub-processors as if they were its own.

Current sub-processors. The current list of sub-processors is set out in Annex 1 of this DPA and is available at modhost.com/sub-processors. The current list includes:

• US-based datacenter operators providing physical infrastructure and connectivity
• Cloudflare, Inc., for CDN, caching, and security services where the Customer's site is configured to use these features

Changes to sub-processors. ModHost will notify Customers of any new sub-processor at least 30 days before the new sub-processor begins processing personal data on the Customer's behalf. Notification will be made by email to the address on the account and by updating the published sub-processor list.

Customer's right to object. Within 30 days of notification, the Customer may object to a new sub-processor on reasonable, documented data protection grounds. If the Customer objects, ModHost will work in good faith to resolve the objection. If no resolution is reached, the Customer may terminate the affected Service, and ModHost will refund prepaid fees for service periods after the termination date.

Sub-processor obligations. ModHost will impose data protection obligations on its sub-processors that are equivalent to those set out in this DPA.

6.International transfers

ModHost is based in Georgia and operates infrastructure in the United States. Sub-processors may also be located outside the European Economic Area, the United Kingdom, or other jurisdictions with data protection rules.

Where personal data is transferred from a jurisdiction with applicable data protection rules to a jurisdiction without an adequacy decision, the Standard Contractual Clauses approved by the European Commission (and the equivalent UK International Data Transfer Addendum where applicable) are incorporated by reference into this DPA. Module 3 (processor to processor) applies to transfers between ModHost and its sub-processors. Where the Customer is itself the Controller and is established outside the EEA but transferring to ModHost as Processor under EU rules, Module 4 (processor to controller) or, where appropriate, Module 2 (controller to processor) applies.

By accepting this DPA, the parties agree to be bound by the applicable SCC modules with the following choices:

• Optional docking clause: does not apply
• Sub-processor authorization: general authorization, with the notification mechanism in Section 5 of this DPA
• Governing law for SCCs: law of Georgia where compatible with the SCCs; otherwise the law specified by the SCCs
• Forum: Tbilisi, Georgia, where compatible with the SCCs

7.Data subject requests

If ModHost receives a request from a data subject seeking to exercise rights under applicable data protection law in relation to personal data processed on behalf of the Customer, ModHost will:

• Promptly forward the request to the Customer
• Not respond to the request directly except to confirm receipt and that the request will be forwarded to the Controller
• Reasonably assist the Customer in responding to the request, as described in Section 4

8.Security

ModHost implements appropriate technical and organizational measures to protect personal data, as set out in Annex 2.

ModHost reviews and updates these measures periodically to address evolving risks and best practices. Any changes will maintain a level of protection no less than that described in Annex 2.

9.Personal data breaches

If ModHost becomes aware of a personal data breach affecting personal data processed on the Customer's behalf, ModHost will:

• Notify the affected Customer without undue delay, and in any event within 48 hours of becoming aware of the breach
• Provide information reasonably necessary for the Customer to meet its own obligations under applicable data protection law, including the nature of the breach, the categories and approximate number of data subjects affected, the likely consequences, and the measures taken or proposed in response
• Take reasonable steps to mitigate and remediate the breach

ModHost's notification is not, in itself, an acknowledgment of fault or liability.

10.Audits

ModHost will make available to the Customer information reasonably necessary to demonstrate compliance with this DPA, in response to written requests submitted to privacy@modhost.com.

Where the Customer reasonably believes that the information provided is insufficient to demonstrate compliance, the parties will discuss in good faith the scope of any further audit. Audits will be conducted no more frequently than once per year (unless triggered by a confirmed breach or a regulator's request), with at least 30 days' written notice, during business hours, in a manner that does not unreasonably disrupt ModHost's operations. The Customer bears its own costs for such audits.

Physical site audits are not generally available; audit assistance is provided through information requests, documentation, and where appropriate written responses to specific questions.

11.Return and deletion of personal data

Upon termination of the Service, or earlier at the Customer's written request:

• ModHost will, at the Customer's choice, delete or return the personal data processed on the Customer's behalf
• Backup copies that include personal data will be deleted in accordance with the standard backup retention schedule (currently 30 days, as described in our Service Commitments)
• ModHost may retain personal data to the extent required by applicable law, in which case it will continue to apply this DPA to that data

Self-service data export is available through the customer area for active accounts.

12.Liability

Each party's liability under this DPA is subject to the limitations of liability set out in the Terms of Service.

Nothing in this DPA excludes or limits a party's liability for matters that cannot, under applicable law, be excluded or limited.

13.Order of precedence

If there is any conflict between this DPA and the Terms of Service, this DPA prevails for matters relating to the processing of personal data on behalf of the Customer. If there is any conflict between this DPA and the Standard Contractual Clauses, the Standard Contractual Clauses prevail to the extent required by applicable law.

14.Term and survival

This DPA applies for as long as ModHost processes personal data on the Customer's behalf. The obligations relating to confidentiality, security, return or deletion of data, and liability survive termination for any period during which personal data remains in ModHost's possession.

15.Changes to this DPA

ModHost may update this DPA from time to time, including to reflect changes in applicable law, sub-processors, or operational practices. Material changes will be communicated by email at least 30 days before they take effect. The current version is always available at modhost.com/dpa.

16.Contact

For DPA questions and data protection matters: privacy@modhost.com

Annex 1 — Sub-processors

The current list of sub-processors engaged by ModHost to process personal data on behalf of Customers:

The current list is also available at modhost.com/sub-processors. Changes are notified in accordance with Section 5 of this DPA.

Annex 2 — Technical and organizational measures

ModHost implements the following measures to protect personal data:

Access control. Administrative access to systems processing personal data is restricted to authorized personnel on a need-to-know basis. Strong authentication is required.

Encryption in transit. TLS encryption is used for all customer-facing services and administrative interfaces.

Network segmentation. Public-facing services are segmented from internal administrative systems. Firewall rules restrict traffic to necessary services.

Authentication. Passwords are stored as cryptographic hashes. Two-factor authentication is supported where the Customer enables it.

Patch management. Operating systems, hosting platform components, and security-relevant software are kept current with security updates.

Monitoring. Continuous monitoring of infrastructure for unusual activity, failed authentication attempts, and signs of compromise.

Anti-spam and anti-abuse. Server-side filtering systems address outbound abuse and inbound threats.

Backups. Daily backups to two separate datacenter locations, with 30-day retention, supporting both incident recovery and customer self-service restores.

Incident response. Documented procedures for investigating, containing, and notifying affected parties in the event of a security incident.

Physical security. Servers are housed in datacenters with physical access controls, surveillance, and environmental safeguards maintained by the datacenter operators.

Personnel. ModHost is operated by a small team with relevant operational and security experience. Anyone authorized to process personal data is bound by an obligation of confidentiality.

These measures are reviewed periodically and updated as appropriate. The level of protection will not be reduced.