How to Request a GDPR Data Processing Agreement (DPA)

If your business stores personal data on a BearHost server and you are in the EU, UK or Switzerland, your auditors will expect a written Data Processing Agreement with your hosting provider. We provide one, signed, usually the same business day.

What the DPA covers

• Our obligations as your processor under Article 28 GDPR: acting on your instructions, confidentiality, security measures, assistance with data-subject requests, breach notification within 48 hours, deletion at the end of service, audit rights.
• The physical location of your data: our hypervisors in Eygelshoven (Netherlands) and Paris (France).
• Our sub-processors and the legal basis for any transfer outside the EEA.
• The EU Standard Contractual Clauses (Commission Decision 2021/914, Module Two) incorporated by reference, since Bearhosting LLC is a US-established company, governed by the law of the Netherlands.

The full picture, including an Article 28 checklist and our security measures, is on the GDPR and data processing page.

How to request it

1. Open the GDPR page and click Request your DPA. It opens a pre-filled support ticket in your client area (log in first if asked).
2. Add your company's legal name, registered address and country, and the name and title of the person who will sign.
3. We return the agreement signed for Bearhosting LLC on the ticket, as a PDF.
4. Countersign it and return it on the same ticket. It is in force from that date.

Need a clause adjusted for your sector? Mention it in the request; reasonable changes are made at no cost.

Good to know

• Your servers are unmanaged: we hold no operating-system credentials and never log in to them. Our access stops at the hypervisor and is logged.
• Disks are not encrypted at rest at the hypervisor level today. If you process sensitive data, enable encryption inside the server (LUKS on Linux, BitLocker on Windows) so you hold the keys.
• The optional backup add-on stores backups in the United States by default. Ask for the EU region on the same ticket before enabling it if your data must stay in the EEA.