Data Processing Agreement (Hosted plans)

This Data Processing Agreement ("DPA") forms part of the Hosted Terms between you (the "Controller") and Silux Control UK Ltd T/A Silux Media, company number <SET IN ADMIN>, Prospect House, Staveley, Chesterfield, S43 3QE, United Kingdom (the "Processor"). It applies where we process personal data on your behalf when hosting your Silux Media server, and meets the requirements of Article 28 UK GDPR (and EU GDPR where it applies).

1. Subject matter, duration, nature and purpose

Subject matter: hosting, transcoding and streaming your media library, and managing the users you invite.
Duration: the term of your hosted plan plus the 30-day download period and deletion period in the Hosted Terms.
Nature and purpose: storage, processing and transmission needed to provide the Service.
Personal data: names and email addresses of users you invite, viewing activity (what was played, when, from which device), and any personal data contained in Your Content (for example home videos).
Data subjects: you, the people you invite, and people who appear in Your Content.

2. Our obligations

We will:

process the personal data only on your documented instructions, which are these terms and your use of the Service's settings, unless the law requires otherwise (we'll tell you first where allowed);
ensure everyone authorised to process the data is bound by confidentiality;
implement appropriate technical and organisational security measures (section 4);
use sub-processors only as set out in section 3;
help you respond to data subject requests, taking into account the nature of the processing;
help you meet your security, breach-notification, impact-assessment and consultation obligations;
at the end of the Service, delete or return the personal data as described in the Hosted Terms, unless the law requires us to keep it;
make available the information needed to show compliance with this DPA and allow for reasonable audits (normally by providing our security documentation and certifications, and on-site audits at most once a year with 30 days' notice, at your cost).

3. Sub-processors

You authorise these sub-processors:

our hosting provider (UK/EU data centres);
our email delivery provider;
Stripe (payments only — no media data).

We will give at least 30 days' notice of any new sub-processor, and you may object on reasonable data-protection grounds. We remain responsible for our sub-processors.

4. Security measures

Encryption in transit (TLS) and at rest.
Access to production systems is limited to authorised staff with multi-factor authentication.
Least-privilege access controls, audit logging and regular security updates.
Backups with tested restore.
Network segregation between customers.

5. Personal data breaches

We will notify you without undue delay, and in any event within 48 hours of becoming aware of a personal data breach affecting your data. The notice will contain the information you need to meet your own notification obligations.

6. International transfers

We will not transfer the personal data outside the UK/EEA without appropriate safeguards (adequacy regulations, the UK International Data Transfer Agreement, or EU Standard Contractual Clauses with the UK Addendum).

7. Liability and precedence

Liability under this DPA is subject to the limitations in the Hosted Terms, except where the law does not allow it. If this DPA conflicts with the Hosted Terms on data protection, this DPA prevails.

Contact

Data protection queries: info@siluxmedia.com