Customer Login

EU Data Protection

Overview

PracticalHost Fze, A United Arab Emirates registered company that abides by UAE laws prioritizes customer trust. We know that customer data is essential to our customers’ values and operations. That is why we keep it private and safe.
Our customers entrust us with large amounts of sensitive information from various industries, including healthcare, financial services, government, and technology.
PracticalH helps customers maintain control of their privacy and data security in a myriad of ways:
  • Data Security: We provide our customers' compliance with high-security standards, such as encryption of data in motion over public networks, auditing standards (SOC 2, ISO 27001, ISO 27018), Distributed Denial of Service ("DDoS") mitigations, and a Support team that is on-call 24/7.
  • Disclosure of Customer Service Data: PracticalHost Fze only discloses Service Data to third parties where disclosure is necessary to provide the services or as required to respond to lawful requests from public authorities.
  • Trust: PracticalHost Fze, through its providers (Open Xchange, Rackspace, NameSilo, Enom, Amazon, and Hetzner Online AG, has developed security protections and control processes to help our customers ensure a secure environment for their information.
  • Access Management: PracticalHost Fze provides advanced access and encryption features to help customers protect their information. We do not access or use customer content for any purpose other than providing, maintaining, and improving PracticalHost Fze services, as otherwise required by law.
What is Service Data?
Service Data is any personal information stored in or transmitted viaPracticalHost Fze services by, or on behalf of, our customers and their end-users.
Who owns and controls Service Data?
From a privacy perspective, the customer is the controller of Service Data, and PracticalHost Fze and its suppliers are a processor. This means that throughout a customer subscribes to services with PracticalHost Fze , the customer retains ownership of and control over Service Data in its account.
Who are PracticalHost Fze Provider's sub-processors?
Entity Name: Open Xchange Rackspace Amazon Web Services - Sweden WebVault / MailVault Hetzner Online AG LiveDrive Level 27 BVBA Namesilo Inc. Enom Name.com Only Domains
Entity Type: Cloud Service Provider Cloud Service Provider Cloud Service Provider Cloud Service Provider Cloud Service Provider Cloud Service Provider Cloud Service Provider Domain Registrar Domain Registrar Domain Registrar Domain Registrar
Entity Country: Germany United States United States Singapore Germany UK Belgium United States United States United States New Zealand
How does PracticalHost Fze use Service Data?
We use Service Data to operate and improve our services, help customers access and use the services, respond to customer inquiries, and send communication-related to the services.
What steps does PracticalHost Fze take to secure Service Data?
PracticalHost Fze prioritizes data security and combines enterprise-class security features with comprehensive audits of our applications, systems, and networks to ensure customer and business data is always protected.
For example, PracticalHost Fzeservers are hosted at Tier IV or III+, SSAE-16, PCI DSS, or ISO 27001 compliant facilities. Our Support team is on call 24/7 to respond to security alerts and events.
Where will Service Data be stored?
PracticalHost Fze, through its sub-processors, has data centers in three central regions — the United States, Asia Pacific, and the European Union. The location depends on the type of service offered.
How does PracticalHost Fze Respond to Information Requests?
PracticalHost Fze recognizes that privacy and data security issues are top priorities for customers.
PracticalHost Fze does not disclose Service Data except as necessary to provide its services to its customers and comply with the law.
How does PracticalHost Fze respond to legal requests for Service Data?
In certain situations, we may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements. We may disclose personal data to respond to subpoenas, court orders, or legal processes, establish or exercise our legal rights or defend against legal claims. We may also share such information with relevant law enforcement agencies or public authorities if we believe the same to be necessary to investigate, prevent, or take action regarding illegal activities, suspected fraud, situations involving potential threats to the physical safety of any person, violations of our Terms and Conditions and Service Level Agreement, or as otherwise required by law.

EU Directive

The EU Data Protection Directive (also known as “Directive 95/46/EC“) addresses the processing of personal data and the free movement of such data. This Directive broadly sets out several data protection principles and requirements that must be adhered to when personal data is processed.
Directive 95/46/EC established the Article 29 Working Party (“WP29”), comprised of representatives from the data protection authorities of all the EU Member States and the European Commission. WP29 works to harmonize the application of data protection rules throughout the EU and advises the EU Commission on the adequacy of data protection standards in non-EU countries.
How does the EU Directive apply to customers?
PracticalHost Fze customers that collect and store personal data are considered data controllers under Directive 95/46/EC. Data controllers bear the primary responsibility for ensuring that their processing of personal data is compliant with relevant EU data protection law, including Directive 95/46/EC and the GDPR as of May 25, 2018.
What are the "Model Clauses"?
The European Commission has approved a set of standard provisions called the Standard Contractual Clauses (“Model Clauses”), which provide a data controller with a compliant mechanism to transfer personal data to a data processor outside the European Economic Area (“EEA”).
Does PracticalHost Fze replicate the Service Data it stores?
PracticalHost Fze periodically replicates data for archival, backup, and audit logs. We use our Mailvault, WebVault and Rackspace to store some information backed up, such as database information and attachment files.
Does Service Data hosted in the EU region ever leave that region?
Service and customer data like encrypted file storage, email, archiving, and backup is region-specific. We use different providers for different services. Data hosted in the EU region does not leave that region.

GDPR

Since our inception, PracticalHost Fze approach has been anchored with a solid commitment to privacy, security, compliance, and transparency. This approach includes supporting our customers’ compliance with EU data protection requirements, including those set out in the General Data Protection Regulation (“GDPR”), which becomes enforceable on May 25, 2018.
If a company collects, transmits, hosts, or analyzes the personal data of EU citizens, GDPR requires the company to use third-party data processors who guarantee their ability to implement the technical and organizational requirements of the GDPR. Our contractual commitments guarantee that customers can:
  • Respond to requests from data subjects to correct, amend or delete personal data.
  • Be made aware of and report personal data breaches to relevant supervisory authorities and data subjects in accordance with GDPR timeframes.
  • Demonstrate their compliance with the GDPR as pertaining to PracticalHost Fze Services.
PracticalHost Fze GDPR Product ReadinessThe General Data Protection Regulation (GDPR), which goes into effect on May 25, 2018, provides data subjects with an array of privacy rights, which provide individuals with greater transparency into and control over the uses of their personal information.
What is the GDPR?
The General Data Protection Regulation (“GDPR”) is a new European privacy regulation that will replace the current EU Data Protection Directive (“Directive 95/46/EC”). The GDPR aims to strengthen the security and protection of personal data in the EU and harmonize EU data protection law.
To whom does the GDPR apply?
The GDPR applies to all organizations operating in the EU and processing “personal identifiable data” of EU residents. Personal data is any information relating to an identified or identifiable natural person.
What implications does GDPR have for organizations processing the personal data of EU citizens?
One of the critical aspects of the GDPR is that it creates consistency across EU member states on how personal data can be processed, used, and exchanged securely. Organizations will need to continually demonstrate the security of the data they are processing and their compliance with GDPR by implementing and regularly reviewing robust technical and organizational measures and compliance policies.
How has PracticalHost Fze been preparing for the GDPR?
PracticalHost Fze will comply with the GDPR when it became enforceable in May 2018. Our privacy team is working with customers worldwide to answer their questions and help them prepare for using PracticalHost Fze Services after the GDPR becomes effective. Additionally, our privacy team reviews PracticalHost Fze current product features and practices to ensure we support our customers with their GDPR compliance requirements.
How can PracticalHost Fze customers prepare for GDPR enforcement?
PracticalHost Fze encourages customers to prepare for the GDPR by reviewing their privacy and data security processes and policies to ensure compliance by May 2018. Data controllers are primarily responsible for ensuring that their processing of personal data is compliant with EU data protection law. Below are some key points to consider for GDPR compliance:
  • Geographical Application: The GDPR may apply to organizations established in the EU and specific organizations h are processing the personal data of EU citizens, depending on their activities.
  • Rights of End-Users: Organizations should be cognizant of End-Users whose personal data they may be processing. The GDPR establishes enhanced rights for End-Users, and organizations should be able to accommodate those rights.
  • Data Breach Notifications: Organizations that are controllers of personal data should have transparent processes in place organizations with the GDPR requirement to report data breaches in accordance with the time frames set out within the GDPR. PracticalHost Fze will notify affected customers without undue delay if we become aware of a data breach of our services.
  • Appointment of Data Protection Office" (“PO”): Customers may need to appoint DPOs to manage issues relating to the processing of personal data.
  • Data Processing Agreement" (“PA”): Where personal data is transferred outside the EEA, a customer may need DPAs in place with its sub-processors to ensure adequate Cloud'sprotection for the transferred data. PracticalHost Fze DPA addresses GDPR and can be obtained by submitting a request to privacy@practicalhost.com.
  • Data Protection Impact Assessment" (“D" IA”): DPIAs usually describe organizations' data processes and protective measures, particularly those that may be risky. For data processing activities, customers must conduct and file with authorities a DPIA.
Which PracticalHost Fze services and features can support customers' compliance with the GDPR?
Customers can use PracticalHost Fze third-party ISO certifications and SOC 2 audit reports to help conduct risk assessments and determine whether appropriate technical and organizational measures are in place. For additional information, please get in touch with us at privacy@practicalhost.com.
Does PracticalHost Fze currently provide any product-specific Features/Functionality in its Support product to assist us with our GDPR compliance program?
PracticalHost Fze allows customers to delete Service Data containing personal data, such as profiles, tickets, images, and attachments, in active PracticalHost Fze Support accounts. Customers also have full access to delete cloud data, such as emails, archives, backups, databases, and website content.