Data Processing Agreement

1. Scope

This DPA applies to all data processing performed by WebHost24 on behalf of the Customer in connection with the WebHost24 hosting services. It supplements the Terms of Service and Privacy Policy and forms an integral part of the agreement between the parties.

2. Roles

WebHost24 acts as the Data Processor (under DPDPA 2023) / Data Processor (under GDPR). The Customer acts as the Data Fiduciary / Data Controller. The categories of data subjects are the Customer's end users; the categories of personal data are limited to email, domain, billing details, and the cookie-consent flag.

3. Sub-processors

WebHost24 engages the following sub-processors:

• Google Analytics (only when PUBLIC_GA4_ID is set; loads after consent-gate).
• Google Tag Manager (only when the GA4 ID is set; same consent-gate).
• WhatsApp Business (Meta Platforms Ireland Ltd) for the support channel.

We notify Customers at least 30 days before adding a new sub-processor. Customers may object to a new sub-processor by terminating the affected service without penalty.

4. Breach notification

We notify affected Customers of any personal-data breach within 72 hours of becoming aware of the breach. The notification includes the categories of data + subjects affected, the likely consequences, and the measures taken or proposed to address the breach.

5. Audit rights

Customers may audit our compliance with this DPA once per calendar year, with at least 30 days' notice, at the Customer's cost. We may satisfy an audit request by providing a current SOC 2 / ISO 27001 report (when available) or an equivalent third-party attestation.

6. Data location + transfers

Customer data is hosted in our data center in Palitana, Gujarat, India. We do not replicate Customer data outside India. Where a Customer is in the EU + requests an EU Standard Contractual Clauses addendum, the addendum governs the cross-border transfer scope.

7. Contact

Email hello@webhost24.inor message us on WhatsApp (+91 96875 72424). We acknowledge DPA-related requests within five Indian business days.