Data Processing Agreement (DPA)
Last Updated: August 10, 2026
The English version of this document is the legally binding version.
This Data Processing Agreement applies between OKLAKO S.R.L. (IDNO 1015600036593), registered office in Chișinău, Republic of Moldova, operating the HYTHOST services ("HYTHOST", the "Processor") and the client identified in the applicable service order (the "Client", the "Controller"), and governs the processing of personal data that the Client stores or processes on HYTHOST services.
How this DPA applies. As stated in Section 1.5 of the Terms of Service, this DPA is automatically incorporated into the agreement between the Client and HYTHOST for any service on which the Client processes personal data of other individuals — no separate signature is needed. A countersigned copy for the Client's own compliance records is available on request through the support ticket system.
1. Definitions and Roles
1.1. "Personal data", "processing", "controller", "processor", "data subject", "personal data breach", and "supervisory authority" have the meanings given in Regulation (EU) 2016/679 ("GDPR") and, for clients in the Republic of Moldova, the equivalent terms of Law No. 195/2024 on personal data protection.
1.2. For personal data that the Client uploads to, stores on, or processes through its services (for example data of its players, users, customers, or community members — the "Client Data"), the Client is the controller and HYTHOST is the processor. HYTHOST remains an independent controller for the data it processes for its own purposes (account, billing, support, security, abuse handling), as described in the Privacy Policy.
2. Subject Matter, Duration, Nature, and Purpose
2.1. Subject matter: provision of hosting infrastructure and related services (game servers, VPS, dedicated servers, web hosting, backups, support) on which the Client processes Client Data.
2.2. Duration: the term of the applicable service, until deletion of Client Data under Section 8.
2.3. Nature and purpose: storage, hosting, transmission, backup, and technical processing strictly as needed to provide the ordered services; HYTHOST does not access Client Data except as needed for service delivery, support requested by the Client, security, or legal compliance.
2.4. Types of personal data and categories of data subjects: determined by the Client. Typically: usernames, display names, email addresses, IP addresses, chat messages, gameplay or application data of the Client's users, customers, players, or community members. The Client must not use the services to process special categories of data (such as health or biometric data) or data subject to sector-specific regulation without HYTHOST's prior written agreement.
3. Instructions
3.1. HYTHOST processes Client Data only on the Client's documented instructions, including with regard to international transfers, unless required to do otherwise by applicable law; in that case HYTHOST informs the Client before processing, unless the law prohibits it. The service order, service configuration, control panel actions, support requests, the Terms of Service, and this DPA constitute the Client's documented instructions.
3.2. HYTHOST informs the Client if, in its opinion, an instruction infringes applicable data protection law.
4. Confidentiality and Security
4.1. HYTHOST ensures that persons authorized to process Client Data are bound by confidentiality obligations.
4.2. HYTHOST implements appropriate technical and organizational measures under GDPR Article 32, taking into account the nature of the services, including: access controls and authentication, network protection and anti-DDoS measures, logging and monitoring, isolation between client services, backups where included in the service, and security review processes. The Client remains responsible for the security of the software, configurations, and access credentials it manages on the service (shared responsibility).
5. Sub-processors
5.1. The Client gives general authorization for HYTHOST to use sub-processors for infrastructure, connectivity, and operations. The current categories and named providers are listed in Section 7 of the Privacy Policy (datacenters, upstream network and anti-DDoS providers, and — where the Client's service or the Client's use involves them — email delivery and payment providers). Game servers and their control panel run on infrastructure operated by HYTHOST itself.
5.2. HYTHOST will inform Clients of intended changes concerning the addition or replacement of sub-processors that process Client Data, by updating the published list and, for material changes, by client-area or email notice, giving the Client the opportunity to object on reasonable data protection grounds before the change applies to its services.
5.3. HYTHOST imposes data protection obligations on sub-processors that are equivalent to those in this DPA and remains liable to the Client for their performance as required by applicable law.
6. Assistance
6.1. Taking into account the nature of the processing, HYTHOST assists the Client with appropriate technical and organizational measures, insofar as this is possible, in responding to data subject requests concerning Client Data (access, rectification, erasure, restriction, portability, objection). If a data subject contacts HYTHOST directly about Client Data, HYTHOST will refer the request to the Client without undue delay.
6.2. HYTHOST assists the Client in ensuring compliance with its obligations regarding security, breach notification, data protection impact assessments, and prior consultation, taking into account the nature of the processing and the information available to HYTHOST.
7. Personal Data Breach
HYTHOST notifies the Client without undue delay after becoming aware of a personal data breach affecting Client Data, and provides the information reasonably available to it (nature of the breach, categories and approximate number of data subjects and records concerned, likely consequences, measures taken or proposed). Notifying the competent supervisory authority and the data subjects is the Client's responsibility as controller.
8. Deletion and Return
At the end of the service, HYTHOST deletes Client Data in accordance with Section 8.4 of the Terms of Service: termination removes the service and all data on it immediately and irreversibly, so no separate deletion step or deletion certificate is needed. Because deletion is immediate, the Client must export Client Data before the service is suspended or terminated, using the service's standard tools (file access, backups, database export); HYTHOST provides reasonable assistance on request. Where applicable law requires HYTHOST to retain specific data longer, that data is retained only for that purpose.
9. International Transfers
9.1. Client Data is hosted on HYTHOST infrastructure in the Republic of Moldova unless the service description states a different location.
9.2. For Clients subject to the GDPR: the Republic of Moldova is a third country without an adequacy decision of the European Commission. For such Clients, the parties agree that the transfer of Client Data to HYTHOST is governed by the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914), Module Two (controller to processor), which are incorporated into this DPA by reference, with the Client as data exporter and OKLAKO S.R.L. as data importer, the annexes being completed by the information in this DPA (Sections 2, 4, and 5). In case of conflict between this DPA and the Standard Contractual Clauses, the Clauses prevail.
9.3. HYTHOST engages sub-processors located outside the Client's jurisdiction only with safeguards required by applicable law, as described in Section 8 of the Privacy Policy.
10. Audits
HYTHOST makes available to the Client the information reasonably necessary to demonstrate compliance with this DPA and, where required by applicable law, allows for and contributes to audits conducted by the Client or an auditor mandated by the Client, under reasonable notice, at the Client's cost, no more than once per year unless a supervisory authority requires otherwise or a personal data breach has occurred, and without access to data or systems of other clients. Audit requests are submitted through the support ticket system.
11. Liability, Law, and Jurisdiction
11.1. The liability provisions of the Terms of Service apply to this DPA, except where applicable data protection law provides otherwise.
11.2. This DPA is governed by the laws of the Republic of Moldova and disputes are resolved as set out in the Terms of Service. The GDPR is the material standard of reference for Clients subject to it; for Clients in the Republic of Moldova, Law No. 195/2024 (in force as of August 23, 2026) applies equivalently. Where the Standard Contractual Clauses apply under Section 9.2, their governing-law and jurisdiction rules prevail for the matters they cover.
12. Contact
DPA requests (signed copy, sub-processor information, audit requests, transfer safeguards): open a support ticket in the client area or email [email protected].
