Data Processing Addendum

Return to Legal

Last updated: August 25, 2026

This Data Processing Addendum (the “DPA”) forms part of the agreement between you (“you,” the “Client,” or the “Controller”) and Solution Hippo, LLC (“SolutionHippo,” “we,” “us,” or the “Processor”) for the managed WordPress hosting and related services described in our Terms of Service (the “Agreement”). It records how we process personal data contained in the websites we host for you. Where this DPA conflicts with the rest of the Agreement on the subject of data protection, this DPA controls. All other provisions of the Agreement, including its limitations of liability, remain in force and apply to this DPA.

This DPA applies only where, and to the extent that, we process Client Personal Data on your behalf and a Data Protection Law applies to that processing. It reflects our role as a processor and is intended to be read together with our Privacy Policy, which describes the same relationship in plain language.

1. Definitions

Terms defined in the Agreement have the same meaning here. In addition:

  • “Data Protection Laws” means all laws that apply to the processing of personal data under this DPA, including the EU General Data Protection Regulation 2016/679 (“GDPR”), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and United States state privacy laws such as the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA/CPRA”).
  • “Controller,” “Processor,” “Data Subject,” “Processing,” “Personal Data,” and “Personal Data Breach” have the meanings given to them (or to their closest equivalents, such as “business,” “service provider,” and “consumer” under the CCPA/CPRA) in the Data Protection Laws.
  • “Client Personal Data” means Personal Data that we process on your behalf in providing the Services — primarily the Personal Data contained in, or generated by, the website or websites we host for you.
  • “Subprocessor” means any third party we engage to process Client Personal Data in support of the Services.

2. Roles of the Parties

For the Client Personal Data contained in your hosted sites, you are the Controller and we are the Processor (or, where you are yourself acting as a processor for your own customers, we act as your Subprocessor). You decide what Personal Data goes into your site and why; we process it only to host, secure, back up, and support that site for you. Each party is responsible for complying with the obligations that apply to it under the Data Protection Laws. Separately, we act as an independent Controller for the limited account and billing data we collect directly from you to run our business, as described in our Privacy Policy; that processing is not governed by this DPA.

3. Details of the Processing

  • Subject matter: our provision of managed WordPress hosting and related support services to you.
  • Duration: for as long as we host your site under the Agreement, plus the limited period during which residual copies age out of our backups as described below.
  • Nature and purpose: storing and serving your website; performing backups, security monitoring, malware mitigation, performance tuning, updates, and technical support; and other operations necessary to deliver the Services.
  • Categories of Data Subjects: the individuals whose Personal Data you place in or collect through your site — typically your visitors, customers, subscribers, form submitters, and account holders.
  • Categories of Personal Data: whatever your site stores or processes. This commonly includes names, email addresses, postal addresses, telephone numbers, order and account details, support messages, and technical data such as IP addresses and server log entries. You control what your site collects; we do not require, and do not ask you to route through us, any special categories of Personal Data, and you agree not to use the Services to process special-category data unless you have first put appropriate safeguards in place.

4. Our Obligations as Processor

When we process Client Personal Data on your behalf, we will:

  • Process only on your instructions. We process Client Personal Data only to provide and support the Services and on your documented instructions, which include the Agreement, this DPA, and your ordinary use and configuration of the Services. We will tell you if we believe an instruction infringes a Data Protection Law, and we will not use Client Personal Data for our own purposes, sell it, or share it except as permitted here.
  • Keep it confidential. We limit access to Client Personal Data to personnel who need it to deliver the Services, and those personnel are bound by appropriate confidentiality obligations.
  • Secure it. We maintain the technical and organizational measures described in Section 5.
  • Help you meet your obligations. Taking into account the nature of the processing and the information available to us, we will provide reasonable assistance with your obligations to respond to Data Subject requests, to carry out data protection impact assessments and prior consultations, and to notify and communicate Personal Data Breaches.
  • Support your compliance and audits. We will make available information reasonably necessary to demonstrate our compliance with this DPA, as described in Section 9.
  • Return or delete the data at the end of the Services, as described in Section 8.

5. Security Measures

We maintain security measures appropriate to the risk, including: encryption of data in transit and encryption of backups at rest; access controls and least-privilege administration; network firewalling and a web application firewall at the security edge; continuous monitoring, intrusion detection, and automated recovery; regular patching and hardening of the hosting platform; and redundant, off-site backups. We review these measures as our platform evolves and may update them, provided that the level of protection is not materially reduced.

6. Subprocessors

You give us general authorization to engage Subprocessors to help deliver the Services. Each Subprocessor is bound by a written contract that imposes data-protection obligations no less protective than those in this DPA and permits it to use Client Personal Data only to provide services to us. We remain responsible to you for our Subprocessors’ performance of those obligations. Our current Subprocessors are:

  • Cloudflare — content delivery, DNS, and web application firewall / security edge.
  • Managed server infrastructure — server provisioning and management tooling for the hosting platform.
  • Stripe — payment processing for account billing.
  • SendGrid — delivery of transactional and account email.
  • Encrypted, immutable off-site backup storage — off-site storage of website backups, held redundantly across multiple independent providers.

Before we add or replace a Subprocessor that processes Client Personal Data, we will give you reasonable prior notice by updating this list and, where you have asked us to, by email. You may object on reasonable data-protection grounds within fourteen (14) days of that notice. If you do, we will work with you in good faith to address the concern; if we cannot, you may terminate the affected Services as your remedy, without penalty, for the unused portion of any prepaid term.

7. International Transfers

We and some of our Subprocessors are located in, or process data in, the United States, so providing the Services may involve transferring Client Personal Data across borders. Where Client Personal Data protected by EU, UK, or Swiss law is transferred to a country that has not been recognized as providing an adequate level of protection, that transfer is made under an appropriate safeguard, such as the European Commission’s Standard Contractual Clauses (together with the UK International Data Transfer Addendum where relevant) or another lawful transfer mechanism, which are incorporated into this DPA by reference to the extent they apply.

8. Personal Data Breach, Return, and Deletion

Breach notification. If we become aware of a Personal Data Breach affecting Client Personal Data, we will notify you without undue delay and provide the information reasonably available to us to help you meet your own notification obligations. Because you are the Controller, any notification to a supervisory authority or to affected individuals is your responsibility, with our reasonable assistance.

Return and deletion. When the Services end, you may export or ask us to provide a copy of your site and its data for a reasonable period. After that, we remove Client Personal Data from our active systems. Residual copies held in our encrypted backups are retained on a rolling ninety (90) day schedule and are permanently deleted as they age past ninety (90) days, unless a longer period is required by law. While a copy remains in backup, it stays protected by this DPA and is not restored or used for any other purpose.

9. Demonstrating Compliance and Audits

On your reasonable written request, and no more than once a year unless a Data Protection Law or a supervisory authority requires otherwise, we will make available information reasonably necessary to demonstrate our compliance with this DPA. Any audit is conducted on reasonable prior notice, during business hours, in a way that does not compromise the security or privacy of other clients, and subject to confidentiality. We may satisfy an audit request by providing existing documentation, such as security summaries or third-party attestations, where these reasonably address your inquiry.

10. General

This DPA takes effect for as long as we process Client Personal Data on your behalf. We may update it to reflect changes in the Services, our Subprocessors, or the law; we will post the revised version here and update the date at the top, and material changes will be handled as described in Section 6 or the Agreement. Each party’s total liability arising out of or related to this DPA is subject to the limitations of liability set out in the Agreement. This DPA is governed by the same law and subject to the same dispute-resolution terms as the Agreement. Questions about this DPA, or requests relating to it, can be sent to support@solutionhippo.com.