Română Customer GDPR Data Processing Agreement
Protecting Your Data with Transparency and Compliance
Version 2.0, in force from 20 October 2026.
This Data Processing Agreement ("DPA") forms part of the Terms of Service ("Agreement") between Pidgin Host S.R.L. ("Pidgin Host") and the Customer. It sets out how Pidgin Host processes personal data on behalf of the Customer, as required by Article 28 of the GDPR. Capitalized terms not defined in this DPA have the meanings set forth in the Agreement. The Customer enters into this DPA on behalf of itself and, to the extent required under Data Protection Laws, in the name and on behalf of its Authorized Affiliates.
The Customer accepts this DPA by accepting the Terms of Service when it creates an account or places an order. No separate signature is needed. On request to office@pidginhost.com, Pidgin Host sends the Customer a copy of this DPA signed by Pidgin Host.
This DPA is published in Romanian and English. The Romanian version is the reference version: if the two versions differ, the Romanian version prevails. Each new version of this DPA is published on this page with its version number and the date it enters into force.
Related documents: Terms of Service, Privacy Policy and the network and power uptime guarantee (SLA).
The parties agree as follows:
1. Definitions
"Account Data" means data about the Customer and its users that Pidgin Host needs to run the customer relationship: identification and contact details, billing and payment data, support communications, login and security logs, and resource usage metrics.
"Affiliate" means an entity that directly or indirectly Controls, is Controlled by or is under common Control with an entity.
"Authorized Affiliate" means any Customer Affiliate permitted to receive, or otherwise receiving, the benefit of the Services under the Agreement.
"Control" means an ownership, voting or similar interest representing fifty percent or more of the total interests then outstanding of the entity in question. "Controlled" shall be construed accordingly.
"Controller" means an entity that determines the purposes and means of the processing of Personal Data.
"Customer Content" means the data that the Customer or its end users store, process or transmit through the Services, such as the disks, files and databases of cloud servers, volumes, snapshots, S3 buckets, Kubernetes clusters, websites, mailboxes and DNS zones.
"Customer Data" means any data that Pidgin Host and/or its Affiliates process on behalf of the Customer in the course of providing the Services under the Agreement.
"Data Protection Laws" means all data protection and privacy laws and regulations applicable to the processing of Personal Data under the Agreement, including EU Data Protection Law.
"EU Data Protection Law" means Regulation (EU) 2016/679 of the European Parliament and of the Council (the General Data Protection Regulation, "GDPR"), Directive 2002/58/EC concerning privacy and electronic communications, and the national laws that implement or supplement them, including Romanian Law no. 190/2018, in each case as amended, superseded or replaced.
"Personal Data" means any Customer Data relating to an identified or identifiable natural person, to the extent that such information is protected as personal data under Data Protection Laws.
"Processing" has the meaning given to it in the GDPR, and "process", "processes" and "processed" shall be interpreted accordingly.
"Processor" means an entity that processes Personal Data on behalf of the Controller.
"Security Incident" means any breach of security leading to the accidental or unlawful destruction, loss or alteration of, or unauthorized disclosure of or access to, Personal Data.
"Services" means any product or service provided by Pidgin Host to the Customer under the Agreement.
"Sub-processor" means any Processor engaged by Pidgin Host or its Affiliates to assist in providing the Services under the Agreement or this DPA. Sub-processors may include third parties or any Pidgin Host Affiliate.
2. Scope and Applicability of this DPA
2.1 This DPA applies where, and only to the extent that, Pidgin Host processes Personal Data on behalf of the Customer in the course of providing the Services, and such Personal Data is subject to the Data Protection Laws of the European Union, the European Economic Area or their member states, Switzerland or the United Kingdom. The parties agree to comply with this DPA in connection with such Personal Data.
2.2 Role of the Parties. As between Pidgin Host and the Customer, the Customer is the Controller of Personal Data and Pidgin Host processes Personal Data only as a Processor on behalf of the Customer. Section 2.6 sets out the data that Pidgin Host processes as Controller.
2.3 Customer Obligations. The Customer agrees that (i) it shall comply with its obligations as a Controller under Data Protection Laws in respect of its processing of Personal Data and any processing instructions it issues to Pidgin Host; and (ii) it has provided notice and obtained, or shall obtain, all consents and rights necessary under Data Protection Laws for Pidgin Host to process Personal Data and provide the Services under the Agreement and this DPA.
2.4 Pidgin Host Processing of Personal Data. As a Processor, Pidgin Host shall process Personal Data only on the Customer's documented instructions and only to (i) perform the Services in accordance with the Agreement; (ii) take any steps necessary for the performance of the Agreement; and (iii) comply with other reasonable instructions provided by the Customer to the extent they are consistent with the Agreement. This DPA and the Agreement set out the Customer's complete and final instructions; processing outside them requires prior written agreement between the Customer and Pidgin Host.
Pidgin Host shall inform the Customer immediately if, in its opinion, an instruction infringes Data Protection Laws, and may suspend that instruction until the Customer confirms or changes it. Pidgin Host processes Personal Data otherwise only where Union or Member State law requires it; in that case Pidgin Host informs the Customer of that legal requirement before processing, unless that law prohibits such information.
2.5 Nature of the Data. Pidgin Host handles the Customer Data provided by the Customer. Depending on how the Customer uses the Services, Customer Data may contain special categories of data. Customer Data may be subject to the following processing activities: (i) storage and other processing necessary to provide and maintain the Services provided to the Customer; (ii) customer and technical support to the Customer; and (iii) disclosures required by law or otherwise set forth in the Agreement.
Pidgin Host does not access, analyse or use Customer Content for its own purposes, including the development or improvement of the Services, marketing or profiling. Pidgin Host staff access Customer Content only when the Customer asks for it in a support request, when needed to prevent or remedy a Security Incident or an abuse of the Services, or when the law requires it.
2.6 Pidgin Host Data. Pidgin Host processes Account Data as an independent Controller for billing, account management, technical support, security, compliance with legal obligations, development of the Services, and sales and marketing, as described in its Privacy Policy. Account Data never includes Customer Content. Development of the Services relies only on Account Data, such as aggregated resource usage.
2.7 Details of Processing. The subject matter of the processing is the hosting of Customer Content. The processing lasts for the term of the Agreement and ends with the deletion described in Section 7. The Customer determines the types of Personal Data and the categories of data subjects: they are the data the Customer stores in the Services, typically about the Customer's clients, employees and website visitors.
3. Subprocessing
3.1 Authorized Sub-processors. The Customer agrees that Pidgin Host may engage Sub-processors to process Personal Data on the Customer's behalf. Annex A lists the Sub-processors and other recipients currently engaged by Pidgin Host and authorized by the Customer.
3.2 Sub-processor Obligations. Pidgin Host shall (i) enter into a written agreement with each Sub-processor imposing data protection terms that require the Sub-processor to protect Personal Data to the standard required by Data Protection Laws; and (ii) remain responsible for its compliance with this DPA and for any acts or omissions of a Sub-processor that cause Pidgin Host to breach its obligations under this DPA.
3.3 Changes to Sub-processors. Pidgin Host shall give the Customer reasonable advance notice, for which email shall suffice, if it adds or removes Sub-processors.
3.4 Objection to Sub-processors. The Customer may object in writing to the appointment of a new Sub-processor on reasonable grounds relating to data protection, within five (5) calendar days of receiving the notice under Section 3.3. The objection shall explain those grounds. The parties shall then discuss the concerns in good faith with a view to a commercially reasonable resolution. If this is not possible, either party may terminate the Services that Pidgin Host cannot provide without the new Sub-processor.
4. Security
4.1 Security Measures. Pidgin Host shall implement and maintain appropriate technical and organizational measures to protect Personal Data from Security Incidents and to preserve its security and confidentiality, as described in Annex B ("Security Measures").
4.2 Confidentiality of Processing. Pidgin Host shall ensure that any person it authorizes to process Personal Data, including its staff, agents and subcontractors, is under an appropriate contractual or statutory obligation of confidentiality.
4.3 Security Incident Response. Upon becoming aware of a Security Incident, Pidgin Host shall notify the Customer without undue delay and shall provide timely information about the Security Incident as it becomes known or as the Customer reasonably requests.
4.4 Updates to Security Measures. The Security Measures are subject to technical progress and development. Pidgin Host may update or modify them from time to time, provided that such updates and modifications do not degrade the overall security of the Services purchased by the Customer.
5. Security Reports and Audits
5.1 Pidgin Host shall maintain records of its security standards. Upon the Customer's written request, Pidgin Host shall provide, on a confidential basis, audit report summaries and other documentation reasonably required to verify its compliance with this DPA, together with written responses to reasonable requests for information, including information security and audit questionnaires.
5.2 Where this documentation is not sufficient to demonstrate compliance, Pidgin Host shall allow for and contribute to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer, on reasonable prior notice and at the Customer's expense. The Customer may exercise the rights in this Section 5 no more than once per year, unless a Security Incident or a data protection authority requires otherwise.
6. International Transfers
6.1 Pidgin Host stores and processes Customer Content in its own datacenter in Bacu, Giurgiu County, Romania.
6.2 Customer Data leaves the European Economic Area only when the Customer orders a service that requires it, such as the registration of a domain name through a registrar located outside the European Economic Area. Annex A lists these recipients and their location.
Where such a transfer includes Personal Data, Pidgin Host shall comply with Chapter V of the GDPR. Ordering a Service does not waive those requirements.
7. Return or Deletion of Data
7.1 When a Service ends, Pidgin Host deletes the Customer Content of that Service, unless applicable law requires Pidgin Host to retain it. The Customer should export any data it needs before it destroys a resource or ends a Service.
7.2 Cloud servers, volumes, snapshots, S3 buckets and Kubernetes clusters are deleted when the Customer destroys them or when the Service is terminated. Pidgin Host keeps no backup copy of their content, so deleted content cannot be recovered.
7.3 Where a Service includes backups operated by Pidgin Host, the backup copies are deleted at the end of their retention cycle and, until then, are isolated from any further processing.
7.4 Pidgin Host retains the Account Data it needs to meet its legal obligations, such as invoices and accounting records, for the periods required by Romanian law.
8. Cooperation
8.1 To the extent that the Customer is unable to independently access the relevant Personal Data within the Services, Pidgin Host shall, at the Customer's expense and taking into account the nature of the processing, provide reasonable cooperation by appropriate technical and organizational measures to assist the Customer in responding to requests from individuals or data protection authorities relating to the processing of Personal Data under the Agreement. If such a request is made directly to Pidgin Host, Pidgin Host shall not respond to it without the Customer's prior authorization, unless legally compelled to do so. If Pidgin Host is required to respond, it shall promptly notify the Customer and provide a copy of the request, unless legally prohibited from doing so.
8.2 To the extent required under Data Protection Laws, Pidgin Host shall, at the Customer's expense, provide reasonably requested information about its processing of Personal Data under the Agreement, so that the Customer can carry out data protection impact assessments or prior consultations with data protection authorities.
9. Miscellaneous
9.1 Except for the changes made by this DPA, the Agreement remains unchanged and in full force and effect. If there is any conflict between this DPA and the Agreement, this DPA shall prevail to the extent of that conflict.
9.2 This DPA is part of and incorporated into the Agreement, so references to the "Agreement" in the Agreement include this DPA.
9.3 In no event shall any party limit its liability with respect to any individual's data protection rights under this DPA or otherwise.
9.4 This DPA shall be governed by and construed in accordance with the governing law and jurisdiction provisions of the Agreement, unless Data Protection Laws require otherwise.
Annex A - Sub-processors and Other Recipients
Pidgin Host runs the Services on hardware it owns, in its own datacenter in Bacu, Giurgiu County, Romania. No third party hosts the Customer Content of cloud servers, volumes, snapshots, S3 buckets, Kubernetes clusters, web hosting accounts, mailboxes or DNS zones.
A.1 Recipients for specific services
These recipients receive Customer Data only when the Customer orders the service concerned.
| Recipient | Location | Purpose | Data |
|---|---|---|---|
| RoTLD (ICI Bucharest) | Romania | Registration of .ro domain names | Registrant contact details |
| Namecheap | United States | Registration of other domain names; SSL certificates, together with the issuing certificate authority | Registrant and administrative contact details; certificate signing requests |
| NameSilo | United States | Registration of other domain names | Registrant contact details |
| Dynadot | United States | Registration of other domain names | Registrant contact details |
For domain names, the registry of each top-level domain also receives the registrant contact details, as its registration policy requires.
A.2 Recipients of Account Data
Pidgin Host uses these providers as Controller of Account Data (Section 2.6). They do not receive Customer Content.
| Recipient | Location | Purpose | Data |
|---|---|---|---|
| Amazon Web Services EMEA SARL | Frankfurt, Germany | Delivery of account emails, such as notifications and invoices | Email address and message content |
| BAPP | Romania | Accounting and transmission of invoices to e-Factura | Billing details and invoices |
| ANAF | Romania | e-Factura, as required by Romanian law | Invoices |
| Stripe Payments Europe, Limited | Ireland | Saved card for automatic top-up | Email address and payment details |
| PayPal (Europe) S.à r.l. et Cie, S.C.A. | Luxembourg | PayPal payments | Payment details |
| EuPlatesc (Europayment Services S.R.L.) | Romania | Card payments | Name, contact details and payment details |
| LibraPay (Libra Internet Bank S.A.) | Romania | Card payments | Name, contact details and payment details |
| Google Ireland Limited | Ireland | Sign-in with Google, reCAPTCHA on forms, advertising measurement with consent | Name and email address for sign-in; IP address and browser data |
| GitHub, Inc. | United States | Sign-in with GitHub | Name and email address |
Annex B - Security Measures
B.1 Physical security
- Pidgin Host owns and operates its datacenter in Bacu, Giurgiu County, Romania.
- Access to the datacenter is controlled biometrically, and visitors are escorted.
- CCTV and alarm monitoring run 24/7.
- Power is backed by N+1 generators, and connectivity runs through several carriers.
B.2 Isolation of customer resources
- Each cloud server is a KVM virtual machine with its own kernel, isolated from other customers' servers.
- Public network interfaces use source IP filtering to prevent address spoofing.
- The Customer controls a firewall for each public network interface, from the panel or the API.
- Private networks are separated from each other and from other customers' networks.
- Outbound SMTP from cloud servers is blocked by default.
- Access to an S3 bucket requires its access keys, unless the Customer makes content public.
B.3 Customer account security
- Two-factor authentication with an authenticator app (TOTP) or passkeys, with single-use backup codes stored as hashes.
- Account passwords are stored as salted hashes (PBKDF2-SHA256).
- Repeated failed logins block further attempts for a cooling-off period.
- In accounts with several users, each user has a role: administrator, billing or read-only.
- API tokens are read-only or read-write. OAuth access tokens expire after one hour, and refresh tokens change on every use.
B.4 Encryption
- The website, the control panel and the API are served over HTTPS, with HSTS.
- The platform submits account emails to its mail provider over TLS.
- Stored cloud server passwords, S3 secret keys and Kubernetes access credentials are encrypted with a key kept outside the database.
- The disks of cloud servers, volumes, snapshots and S3 buckets are not encrypted at rest by Pidgin Host. The Customer can encrypt data inside its servers.
B.5 Staff access and logging
- Staff access to customer accounts is limited to authorized administrators and is logged.
- Account, resource, service and login activity is logged and kept for 365 days.
- Pidgin Host runs its own error monitoring, and credentials are removed from error reports before they are stored.
B.6 Availability and deletion
- Fast storage volumes are replicated across several storage nodes. Ultra fast storage is local to one server node.
- Pidgin Host does not back up the Customer Content of cloud services. Snapshots, which the Customer takes on demand, are stored on the same storage infrastructure.
- Resources are deleted when the Customer destroys them or when the Service ends, as described in Section 7.