Data Processing Addendum

Version 3.0. Applicability is recorded in the Policy Version History.

1. Scope, parties and processing instructions

This addendum applies when the IT Nut Hosting provider identified under the Terms of Service processes personal data on the customer’s documented instructions through an order that incorporates this version. The provider is either Reyazul Masud Riham, trading as IT Nut Hosting, or Nut Digital LLC, according to that order. Their addresses and contact route appear in the Terms. The customer is the person or organisation identified in the accepted order, acting as controller or as a processor authorised by its controller; IT Nut acts as processor or subprocessor accordingly.

This addendum concerns customer-controlled hosted data. IT Nut’s independently determined account, payment, website, security and legal processing is described in the Privacy Notice. Roles depend on the actual activity. A personal account can involve processing covered by this addendum; a business account is not automatically subject to every country’s privacy law.

The subject matter is delivery of the purchased hosting, email, application, backup or administration service. Processing may include storing, organising, retrieving, transmitting, securing, backing up where purchased, restoring and deleting data as required by the accepted service and instructions. Duration follows the service term and any necessary exit, backup-rotation or lawful-retention period.

Data and individuals depend on what the customer lawfully places in the service. They can include users, employees, customers, subscribers and correspondents, and their contact details, identifiers, communications, transaction or application records. The customer must identify specialised categories, unusually high risks, residency restrictions and any sensitive-data requirements before submitting such data. A standard hosting order is not an assurance that every regulated workload is suitable. The parties must agree any additional measures needed for the actual processing.

The accepted order, documented configuration and authenticated instructions form the processing record. A service-specific signed addendum may supplement or replace identified provisions. Where law requires more detailed processing particulars, named subprocessor approval or a transfer instrument, those records must be completed before the relevant processing. This public addendum does not certify that every customer-specific international-transfer package has already been executed.

2. Instructions, confidentiality and security

We process covered data only on lawful documented instructions, including the agreed service configuration, unless applicable law validly requires otherwise. We inform the customer of a compulsory requirement before processing where legally permitted. A foreign demand does not itself override an applicable international-transfer instrument or the restrictions of the law governing the processing.

We promptly inform the customer if an instruction appears to infringe applicable data-protection law and may pause the affected instruction while it is resolved. The customer remains responsible for its lawful collection, notices, permissions and instructions. We remain responsible for our own processing duties.

Authorised personnel must be bound by confidentiality and limited to access appropriate to their role. We maintain safeguards appropriate to the data, risk and purchased service. Relevant measures include authenticated and protected administrative access, separation of customer accounts, appropriate access restrictions, logging and incident handling. The customer must manage its own users, credentials, permissions, applications and patches within its management scope.

Backup entitlement, exclusions, rotation and recovery follow the Service Scope and Backup Policy and any more specific accepted commitment. A general reference to backups is not a promise that an unmanaged VPS or an account without a backup entitlement has a purchased backup service. Nor does a limitation remove an expressly purchased obligation. Encryption, key management, recovery objectives and specialised audit requirements must be agreed for workloads that require them; we do not claim universal at-rest encryption of all shared backup copies.

We do not materially reduce agreed safeguards during covered processing without an appropriate lawful change process. Further service-specific security information may be supplied through the authenticated support route, subject to justified confidentiality and protection of other customers.

3. Assistance and requests

Taking account of the processing and the information available to us, we assist the customer with applicable rights requests, security duties, impact assessments and regulatory consultations. A request concerning customer-controlled data is referred to the customer where appropriate. We do not independently disclose that data except on authorised instructions or a valid legal requirement.

Routine assistance included in the service is not separately charged. Additional work can require a reasonable, disclosed and accepted quote, except where the law requires otherwise or the work results from our breach. Charges must not obstruct mandatory rights or necessary urgent action. The ordinary optional recovery fee is not imposed on a legally required free return or access request.

4. Subprocessors and the shared support operation

The service-specific processing record must identify the legal entities, functions, locations and data access of approved subprocessors. The same Bangladesh support operation serves both IT Nut businesses. Where it processes hosted data for an LLC order, its relevant role and obligations must be included in that arrangement. Common ownership or common staff does not itself replace a required written processing agreement.

A general list of payment, advertising or registrar recipients in the Privacy Notice is not blanket authorisation for those recipients to process hosted customer data. Independent-controller functions are distinguished from subprocessors acting on instructions. Contact support to obtain and complete the record for a service requiring subprocessor authorisation.

Where the customer provides general written authorisation under the processing record, we notify intended additions or replacements at least 30 days in advance and permit reasonable data-protection objections before the change. This includes a new supplier in an existing category. An urgent replacement follows the legally permissible authorisation and notice process; urgency is not a blanket exemption.

We impose the required written data-protection duties and remain responsible to the customer for approved subprocessors’ performance as applicable law and this addendum require. If a substantiated objection cannot reasonably be resolved, the customer may terminate the affected service and receive the unused prepaid portion. A change must not defeat a mandatory right or required consent.

5. International processing

The selected hosting region does not establish that every backup or support access stays there. Bangladesh support access and any other relevant destinations must be considered in the service’s processing record.

Where required, the parties must complete the valid transfer mechanism, required particulars, assessment and additional safeguards before the covered transfer. EU standard contractual clauses must use the module appropriate to the actual controller/processor or processor/subprocessor relationship and include the necessary party, processing, security, subprocessor, authority and jurisdiction particulars. UK transfers require an applicable completed UK mechanism. Any applicable Bangladesh restrictions and commenced requirements must also be assessed.

This addendum does not purport to execute incomplete standard contractual clauses by reference alone, designate an unappointed representative, or guarantee suitability for a data-localisation requirement. Ask for the service-specific arrangement before supplying data that depends on it. A mandatory transfer instrument prevails over conflicting provisions here or in the general Terms.

6. Personal-data breaches

We notify the customer without undue delay after becoming aware of a personal-data breach affecting covered data, within any shorter applicable requirement. The initial notification includes the known affected service and data, nature and likely effects, action taken and a contact route. We provide missing details in phases as reasonably established. We do not wait for final forensic confirmation to start an awareness-based notification process.

We investigate, contain, preserve necessary evidence and reasonably assist the customer’s lawful notifications. The customer retains its controller duties; our independently applicable duties remain ours. This clause does not create a universal 72-hour period in which we may delay notifying the customer.

7. Compliance information and audits

We provide information necessary to demonstrate compliance with the obligations relevant to this processing. Ordinarily, suitable reports, questionnaires or an independent assessment are used before an on-site inspection. A necessary inspection by a qualified confidential auditor must focus on relevant processing, use reasonable notice, avoid service disruption and protect other customers’ information. It does not authorise unrestricted penetration testing.

Routine audits are ordinarily limited to once annually with 30 days’ notice. These administrative arrangements do not bar a legally required audit or access, a competent authority, a credible material concern or a relevant breach. Reasonable cost allocation is agreed without obstructing mandatory rights. We bear correction costs for our own material non-compliance.

8. Return, deletion and retained copies

At the end of processing, we return or delete covered data at the customer’s choice as applicable law requires, and delete existing copies unless law requires retention. The customer should arrange the export method and timing before termination. A disclosed non-payment deadline does not cancel a mandatory data-return or preservation obligation.

Ordinary export uses the available account, database or service tools, or a separately arranged secure transfer where required. Production deletion occurs at the lawful disclosed termination/deletion point. Backup copies expire through the applicable job’s rotation and orphan-cleanup rules, which can depend on snapshot age rather than time since account deletion. The Service Scope and Backup Policy describes the checked shared-hosting settings and their limits; it does not promise a recoverable copy after termination.

Where immediate removal from a backup is not technically practicable and delayed erasure is legally permitted, retained data must be protected against ordinary use and expire through the appropriate cycle. Any authorised disaster recovery must reapply relevant deletion instructions. Necessary legal-hold copies are restricted and erased when the lawful need ends. We provide a confirmation qualified to the systems and deletion actually completed; we do not certify destruction of a copy that still lawfully remains.

9. Priority, liability and contact

This addendum prevails over the general Terms for covered personal-data processing; a mandatory transfer instrument prevails over both. The Terms’ liability allocation applies only to the extent lawful and consistent with non-waivable data-subject rights and a prevailing instrument. Confidentiality, security, assistance and deletion duties continue while relevant covered data remains in our control.

Use an authenticated client-area ticket or support@itnuthosting.com, marked “Data processing”, to arrange processing particulars, submit instructions or request assistance. An existing executed DPA and accepted transfer instrument keep their rights until validly amended. Publication of this version does not replace them retrospectively.