Version 1.0 · 6 November 2026 · English contractual document
Download the Data Processing Agreement (PDF, English)
Our DPA covers unmanaged VPS hosting provided by ED BACKBONE & CO, trading as EDBB. The English PDF is the contractual document. The explanations below do not amend it. Downloading the PDF alone does not conclude an agreement, and publication of a new version does not automatically replace an agreement you have already accepted.
How to obtain a countersigned DPA
Download the English PDF, complete the customer details and sign it. Email the completed, signed PDF to [email protected]. We will countersign the agreement and return a copy for your records.
Send your signed DPA to [email protected]
Frequently asked questions
Who is my contractual provider?
Your VPS hosting agreement and DPA are with ED BACKBONE & CO, trading as EDBB, registered in Cyprus under Σ 13406. EDBB remains responsible to you for its obligations under the DPA, including those performed by its authorised subprocessor.
Who operates the infrastructure?
EDGBL Ltd., a separate Cyprus company registered under HE 445836, owns and operates the server hardware and virtualisation infrastructure. Its employees perform server administration. EDGBL is expressly named as EDBB’s infrastructure subprocessor in Annex III; accepting the DPA specifically authorises that appointment. Additional or replacement subprocessors and further subprocessing require the prior written authorisation described in clause 7.
Where are my VPS data and exports stored?
VPS data and any ordered QCOW2 export remain on the infrastructure in the country booked for that VPS. They are not relocated to another country without your documented instruction. Your own downloads, backups and network communications may send data elsewhere. Selecting a location does not by itself establish that every aspect of your use complies with GDPR.
Who can access the infrastructure?
Administrative infrastructure access is restricted to authorised employees of EDGBL and EDBB, accessing from Cyprus and other EU Member States. EDGBL employees perform server administration. Access uses multi-factor authentication, IP restrictions and personal SSH keys, is logged, and is revoked centrally when an authorised employee leaves. Neither company’s employees log into customer VPS operating systems, and initial VPS passwords are not retained.
What security responsibilities remain with me?
EDBB and EDGBL are responsible for their respective infrastructure and data protection obligations. You manage the operating system, applications, user accounts, credentials, updates and security configuration inside your VPS. This division of responsibilities does not remove our obligations under the DPA.
Do you keep backups of my VPS?
No routine customer backups or additional VPS replicas are maintained. Keep independent backups and test your restoration process. A QCOW2 export is created only when you expressly order it; the post-termination retention window is not a backup service or recovery guarantee.
Is my VPS content encrypted by the provider?
Provider-managed encryption of VPS content at rest is not included. You decide and implement the encryption and key management appropriate for your use. Ordered QCOW2 exports use HTTPS, a long random filename, and username/password protection. SHA256 checksums verify file integrity; they are not encryption.
When are data deleted?
VPS data are retained for six days after actual termination and then permanently and irrecoverably deleted. The period starts at termination, not at an earlier cancellation request. An ordered QCOW2 export is deleted 30 days after creation; this separate period can extend beyond deletion of the VPS. Download exports and make any recovery request before deletion.
Can I request earlier deletion?
The automated processes do not support manual deletion before the six-day VPS or 30-day export period expires. Review these periods before using the service. Mandatory law and binding orders still apply; clause 10.4 sets out how requirements that cannot be met by the standard process are handled.
What happens after a personal data breach?
EDBB will notify you without undue delay after becoming aware of a personal data breach affecting personal data processed on your behalf, including one involving EDGBL. Notification does not depend on first deciding whether the breach poses a risk to individuals. Support has a 24/7/365 escalation route to a responsible administrator. Keep your security contact and account email current.
Can the DPA be amended for my organisation?
Our DPA reflects the infrastructure, security measures and automated processes used to deliver our VPS services consistently to all customers. We provide it on standard terms and do not negotiate or accept customer-specific amendments, alternative DPA templates or additional contractual commitments. We do not implement individual workflows or changes to system behaviour, including different retention periods or deletion procedures. Please review the agreement before signing to ensure the service meets your organisation’s requirements. Thank you for understanding that this keeps our contractual commitments aligned with how our services operate.
Does signing the DPA make my use of the VPS GDPR compliant?
The DPA sets out contractual data protection duties for the service. It does not certify your applications or guarantee compliance for every use. You remain responsible for your lawful basis, transparency, the data you process, your own security measures and whether the service, location and retention periods suit your requirements.
Is Digital Services Act oversight a GDPR certification?
No. The Digital Services Act and GDPR address different obligations. EDBB’s legal notice describes the Cyprus authority’s assessment of its services under the DSA. That assessment is not a certification of this DPA or of your own GDPR compliance.
Contact and company details
For signed agreements, data protection requests and incident reports, contact [email protected]. ED BACKBONE & CO, trading as EDBB · Registration Σ 13406 · VAT CY60078094P · Spyrou Kyprianou Avenue 22, Pippiros Court, 3070 Lemesos, Cyprus.