Legal

Data processing agreement

Legal draft - review before production use.
This page is a practical website draft and not legal advice. It must be reviewed by a qualified professional before production use.
Operator details, register information, VAT ID and responsible person must be inserted before launch.

Purpose

This draft DPA is intended for customers who process personal data on self-managed VPS services provided by Senra Cloud. It must be reviewed and completed before production use.

Roles

The customer is generally the controller for data processed inside the VPS. Senra may act as processor for infrastructure-related processing where it can technically access or process customer data for service delivery.

Subject and duration

Processing relates to hosting, provisioning, maintenance, support, backups if booked, monitoring if booked and abuse/security handling. Duration follows the customer contract and legal retention obligations.

Types of data

Possible data includes customer account data, server identifiers, technical logs, support content and any data the customer stores on the VPS. The final categories must be completed for the production DPA.

Technical and organizational measures

Measures may include access control, account separation, secure credential handling, encrypted transport, logging, provider-side security controls and abuse response processes. Exact measures must be documented.

Sub-processors

Potential sub-processors include Cloudflare, WHMCS hosting/provider stack, upstream cloud infrastructure providers, payment providers, monitoring providers and accounting tools. The final list must be published and maintained.

Deletion and return

After contract end, customer data is deleted or returned according to the final terms, technical feasibility and legal retention duties.