GDPR & Data Protection

1. Our commitment to data protection

ARA is committed to protecting personal data and complying with the EU General Data Protection Regulation (GDPR). We are based in the EU, host in EU data centres, and keep data collection to a minimum.

This page explains how the GDPR applies to our services and how we support your own compliance. For the personal data we collect about you as our customer, please see our Privacy Policy.

2. Controller and processor: who is responsible

Under the GDPR it matters who decides why and how personal data is processed. With our services there are two distinct roles:

Understanding this split is important: we look after the platform and the account data we hold, while you remain responsible for the personal data you choose to run on your server.

3. Data Processing Agreement (DPA)

If you process personal data on our infrastructure, GDPR Article 28 requires a data processing agreement (DPA) between us. We make a DPA available that covers the subject-matter and duration of processing, its nature and purpose, the types of personal data and categories of data subjects, and our obligations as your processor.

To request or sign our DPA, contact us at info@araservers.com. [If you have a standard DPA document, link it here for customers to download.]

4. Sub-processors

To deliver our services we use a limited number of sub-processors. Each is bound by a data processing agreement and processes data only as needed to provide our services:

We keep this list current and will inform customers of material changes to our sub-processors so you can raise any objection. [Keep this list accurate and up to date.]

5. Where your data is processed

We process and store data within the European Union (Germany and Finland). Where any sub-processor would transfer personal data outside the EU/EEA, we rely on appropriate safeguards such as an adequacy decision or the European Commission’s Standard Contractual Clauses. [Confirm this matches your actual providers.]

6. Security measures

We apply appropriate technical and organisational measures to protect personal data, including encrypted connections (HTTPS/TLS) to our website and client area, access controls and authentication, network-level DDoS protection, and physical security at our data-centre providers.

Security inside your own server — its operating system, applications, encryption and backups — is your responsibility under our unmanaged model.

7. Data subject rights

Individuals have rights under the GDPR, including access, rectification, erasure, restriction, portability and objection. Where a request goes depends on who controls the data:

• If it concerns data ARA holds as controller (your account data), contact us and we’ll handle it — see our Privacy Policy.
• If it concerns data held on a customer’s server, the customer is the controller and is responsible for responding. As your processor, we will assist you, so far as reasonably possible, in responding to data subject requests relating to data on your server.

8. Data breaches

We maintain procedures to detect and respond to personal data breaches. If a breach affecting personal data we control is likely to result in a risk to individuals, we will notify the relevant supervisory authority and affected individuals as required by the GDPR.

Where we act as your processor, we will notify you without undue delay after becoming aware of a breach affecting personal data you process on our infrastructure, so that you can meet your own notification obligations as controller.

9. Your responsibilities as a controller

When you process personal data on our infrastructure, you are the controller and remain responsible for:

• having a valid legal basis for your processing;
• providing your own privacy notices to your users;
• configuring and securing your server, applications and access;
• maintaining your own backups and records of processing;
• responding to data subject requests relating to your data.

We provide the infrastructure; lawful use of it is down to you.

10. Complaints & supervisory authority

If you believe we have not handled your personal data properly, please contact us first so we can put it right. You also have the right to lodge a complaint with a data protection supervisory authority.

For a business established in North Rhine-Westphalia this is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW). [Confirm the authority that applies to your registered establishment.]