How we process the personal data in your workspace on your behalf. This addendum forms part of our Terms of Service and applies to every customer automatically; nothing needs to be signed.
Last updated: October 2, 2026
This Data Processing Addendum (“DPA”) forms part of the Terms of Service between Hostings House Solutions, LLC (“we”, “us” or “our”) and the customer that owns an Operentra workspace (“you”). It applies to personal data contained in Customer Data that we process on your behalf when providing the Service (“Personal Data”), wherever data protection law applies to that processing, including the EU and UK General Data Protection Regulations and US state privacy laws. For that processing you are the controller (or, under US state laws, the “business”) and we are your processor (or “service provider”). If this DPA and the Terms conflict on the protection of Personal Data, this DPA prevails.
We process Personal Data only on your documented instructions. Those instructions are the Terms, this DPA, and the way you configure and use the Service. If the law requires us to process Personal Data otherwise, we will tell you first unless the law forbids it. We will tell you if we believe an instruction breaks data protection law. We do not sell Personal Data, use it for our own purposes beyond providing the Service, or combine it with personal data we receive from other sources, except as the Terms allow (including the personal account described in the note to section 9 of the Terms).
Everyone we authorize to process Personal Data is bound by an obligation of confidentiality. Our staff access a workspace only to provide support you ask for, to investigate a problem, or to keep the Service secure and lawful, and we log that access.
We maintain technical and organizational measures appropriate to the risk, and we review them as the Service changes. They include:
You authorize us to use the sub-processors listed below. We bind each of them to data protection obligations no less protective than this DPA, and we remain responsible for their performance. We will update this list at least 30 days before a new sub-processor begins processing Personal Data. You may object on reasonable data protection grounds within that period; if we cannot address your objection, you may end the affected Service and receive a refund of fees prepaid for the period after it ends.
| Sub-processor | Purpose | Location |
|---|---|---|
| DigitalOcean, LLC | Application hosting, database and file storage | United States |
| Backblaze, Inc. | Storage of encrypted backups | United States |
| Mumara (a Hostings House company) | Delivery of emails sent by the Service, from Hostings House mail servers | United States |
| Anthropic, PBC | AI features such as Performance scoring, when switched on | United States |
Integrations that you connect, such as an SMS provider account, biometric devices or calendars, act on your behalf under your own agreements with them; they are not our sub-processors.
The Service lets your administrators access, correct, export and erase Personal Data, which is how most requests from individuals are answered. If an individual contacts us directly about Personal Data in your workspace, we will refer them to you. Taking into account the nature of the processing and the information available to us, we will give you reasonable help with data protection impact assessments, consultations with supervisory authorities, and your security obligations.
We will notify you without undue delay, and in any case within 72 hours, after becoming aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data. We will tell you what we know about its nature, likely consequences and the measures taken or proposed, and update you as we learn more. Notifying you is not an admission of fault.
We and our sub-processors process Personal Data in the United States. Where data protection law requires a transfer mechanism for Personal Data leaving the European Economic Area, the United Kingdom or Switzerland, the European Commission's Standard Contractual Clauses (Module 2, controller to processor, and Module 3 where you are yourself a processor) are incorporated into this DPA by reference, with the UK International Data Transfer Addendum and the Swiss adaptations where they apply. For those Clauses, you are the data exporter, we are the data importer, the optional docking clause and Clause 9(a) option 2 apply, the governing law and courts are those of Ireland, and the details of the processing are those in section 2.
You can export your workspace's records at any time while it is active or read-only. When your subscription ends, we keep Personal Data for the period set out in section 9 of the Terms and then delete it, including from backups within the period stated there, unless the law requires us to keep it.
On request, we will make available the information reasonably necessary to demonstrate compliance with this DPA, including written answers to security questionnaires. Where that information is not enough, or a supervisory authority requires it, you may audit our compliance, at your cost, with at least 30 days' notice, during business hours, no more than once a year, and under confidentiality obligations.
Each party's liability under this DPA is subject to the limitations in the Terms, to the extent the law permits. This DPA lasts for as long as we process Personal Data on your behalf.
Ask us about this addendum, our security or our sub-processors.