Data Processing Addendum

Last updated: October 27th, 2026

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between you (“Customer,” and where you are a controller, “Controller”) and Shiloh, LLC, doing business as Last Hour Hosting (“Last Hour Hosting,” “we,” “us,” and where we process personal data on your behalf, “Processor”).

It applies automatically, without signature, whenever we process personal data on your behalf as part of the Services. No one needs to countersign it for it to bind us. If you need a signed copy for your records, email legal@lasthourhosting.org and we will send one.

If there is a conflict between this DPA and the Terms of Service, this DPA controls on matters of data protection. If there is a conflict between this DPA and a separately signed agreement between us, the signed agreement controls.

1. Definitions

Terms used but not defined here have the meanings given in the GDPR (Regulation (EU) 2016/679), including “personal data,” “processing,” “controller,” “processor,” “data subject,” “personal data breach,” and “supervisory authority.” “Data Protection Law” means the GDPR, the UK GDPR, the UK Data Protection Act 2018, and any other data protection law that applies to the processing described here, including the CCPA/CPRA where it applies to a service provider.

2. Scope of the processing

Subject matter	The provision of the Services described in your order and the Terms of Service.
Duration	The term of your subscription, plus the deletion period in section 11.
Nature and purpose	Hosting, storing, transmitting, backing up, securing, and supporting the data you place in the Services.
Types of personal data	Whatever you choose to store: typically names, email addresses, postal addresses, phone numbers, account identifiers, order and invoice data, support correspondence, IP addresses, and any other data in the applications you run.
Categories of data subject	Your customers, your users, your employees, your suppliers, and your site visitors.
Special categories	None intended. You must not store special-category data or PHI unless a separate written agreement covers it (see HIPAA).
Frequency	Continuous, for the term of the subscription.

3. Our obligations as Processor

We will:

• Process only on your instructions. We process personal data only to provide the Services and as you instruct us in the Terms of Service, your configuration of the Services, and your support requests, unless a law requires otherwise — and if a law requires it, we will tell you before processing unless that law forbids us to.
• Keep it confidential. Everyone we authorize to process personal data is under a written obligation of confidentiality that survives the end of their engagement.
• Secure it. We implement the measures in Annex II.
• Help you with data-subject requests. If someone asks you to access, correct, delete, restrict, or port their data, and you cannot do it yourself through the Services, we will help you respond, at no additional charge for reasonable requests.
• Help with DPIAs and prior consultations. We will provide the information you reasonably need for a data protection impact assessment or a consultation with a supervisory authority about the Services.
• Tell you about breaches. As described in section 7.
• Delete or return on exit. As described in section 11.
• Allow audits. As described in section 10.

4. Your obligations as Controller

You will:

• make sure you have a lawful basis for the processing, and that you have given data subjects the notices the law requires;
• give us only the personal data the Services actually need;
• not ask us to do anything unlawful, and not instruct us to process data in a way that breaches Data Protection Law;
• tell us promptly if an instruction would breach Data Protection Law — we will pause and ask rather than guess;
• keep your own account credentials secure and manage your own users' access;
• handle data-subject requests that you can handle yourself, using the tools in the Services.

5. Subprocessors

You give us general written authorization to engage subprocessors to process personal data, subject to the following:

• we list every subprocessor that processes personal data, with its purpose and location, at /subprocessors;
• we impose data-protection obligations on each subprocessor that are no less protective than this DPA, by written contract;
• we remain fully liable to you for a subprocessor's performance, as if we were performing the processing ourselves;
• we give you at least 30 days' notice by email and by updating the subprocessor page before adding or replacing a subprocessor that processes personal data;
• you may object to a new subprocessor on reasonable data-protection grounds within 30 days. If we cannot resolve your objection, you may terminate the affected Service and we will refund the unused portion of any prepaid fee.

6. International transfers

Where we transfer personal data from the EEA, the UK, or Switzerland to a country without an adequacy decision, we rely on:

• the European Commission's Standard Contractual Clauses (decision 2021/914), module 2 (controller to processor) where you are a controller, and module 3 (processor to processor) where you are a processor. Annexes I to III of the clauses are completed by sections 2, 5, 7, and Annex II of this DPA.
• the UK International Data Transfer Addendum to those clauses for UK data, with Table 1 completed by this DPA and Table 2 by the optional clauses in section 13.
• the EU-US Data Privacy Framework or the Swiss-US framework where a subprocessor is certified under it.

Government access. We have completed a transfer impact assessment for each subprocessor listed at /subprocessors. We challenge any request for access to your data that we consider unlawful or overbroad, we notify you unless prohibited, and we publish a transparency summary of the legal requests we receive. We do not give any government direct access to customer data and we do not build backdoors.

A copy of the executed clauses is available on request from privacy@lasthourhosting.org.

7. Personal data breaches

We notify you without undue delay, and in any event within 72 hours of becoming aware of a personal data breach affecting your data (within 24 hours where credentials, payment data, or the contents of your services are confirmed compromised). The notification includes, to the extent then known:

• what happened, including the cause if we know it;
• the categories and approximate volume of data and data subjects affected;
• the likely consequences;
• what we have done to contain and remediate it, and what we recommend you do;
• a contact for follow-up, and further updates as the investigation develops.

We do not charge for breach notification. We will not describe an incident in vague terms, and we will not delay telling you in order to complete an investigation.

8. Confidentiality and access

We restrict access to your personal data to staff who need it to provide the Services or to support you, and we log that access. We do not read the contents of your services except: where you ask us to as part of a support request; where it is necessary to investigate a fault, a security incident, or abuse; or where the law compels us. Where the law compels us, we will tell you unless we are prohibited from doing so.

9. Security measures (Annex II)

We implement and maintain the following, and we review them at least annually:

• Encryption in transit using TLS 1.2 or better on every service and API, with HSTS on the customer portal.
• Encryption at rest for backups and for database volumes holding account data.
• Access control: individual named accounts, least privilege, mandatory MFA for administrative access, no shared credentials, and access reviewed when someone leaves.
• Logging and monitoring: authentication logs retained 90 days, audit logs retained 13 months, and alerting on anomalous administrative activity.
• Vulnerability management: a defined patch cadence, tracked advisories for the software we run, and a published disclosure process at /security-policy.
• Resilience: tested restores, redundant upstream networking, and a documented incident response procedure.
• Physical: data centre access controlled by our infrastructure providers.
• People: background checks where lawful, confidentiality agreements, and annual security training for staff with production access.

Your own obligations. We secure the platform. You secure what you run on it: your application, your plugins, your users' passwords, your API keys, and your own configuration. A DPA does not transfer that responsibility.

10. Audits and information

We will answer a reasonable written security questionnaire once a year at no charge, and we will provide the documentation we maintain about our security programme. If you need an on-site audit, we will accommodate one on at least 30 days' notice, no more than once a year, at your cost, during business hours, under confidentiality, and in a way that does not expose other customers' data. We may satisfy an audit obligation by providing an independent report instead where one exists.

11. Return and deletion

During your subscription you can export your data from the portal at any time. After termination:

• we keep your data available for 30 days so you can export it or reactivate;
• we then delete or irreversibly de-identify it, including copies in backups within 30 days of the main deletion (backup rotation means a copy may exist briefly, but it is not restored except for disaster recovery and is deleted on rotation);
• we keep records we are legally required to keep (for example invoices, for tax) in a restricted form, and we tell you what we kept and why if you ask;
• on request we confirm deletion in writing.

If you need the data returned in a specific format, ask before your 30-day window closes and we will help.

12. CCPA/CPRA terms

Where the CCPA applies and you are a business, we act as your service provider. We will not sell or share personal information processed under this DPA, will not retain, use, or disclose it outside the business purpose of providing the Services or as the CCPA permits, will not combine it with personal information from another source except as the CCPA permits, and will comply with your instructions as a business. We confirm that we understand and will comply with the restrictions in 11 CCR § 7051(a).

13. Optional clauses and liability

Where the Standard Contractual Clauses apply: the optional docking clause (clause 7) does not apply; arbitration (clause 11(a)) does not apply and disputes are resolved under section 29 of the Terms of Service; the parties agree that clause 8.5 does not require the data exporter to conduct a separate audit where we provide an independent report. Our liability under this DPA is subject to the limitation of liability in the Terms of Service, except where Data Protection Law does not permit that limitation.

14. Order of precedence and changes

This DPA prevails over the Terms of Service on data-protection matters. We may update it to reflect a change in law or a new subprocessor; we will post the new version here, update the date, and email account holders at least 30 days before a change that reduces your protections.

15. Contact

Privacy and DPA questions: privacy@lasthourhosting.org. Legal: legal@lasthourhosting.org.