Data Processing Agreement (DPA)

Version dated 31/10/2026

This English text is a translation provided for information purposes only. Only the French version of this Data Processing Agreement is legally binding between the Parties. In the event of any discrepancy, ambiguity or conflict of interpretation between this translation and the French version, the French version shall prevail. The French version is available at https://hodi.host/gp-fr/dpa/.

Recitals

This Data Processing Agreement (the "Agreement" or "DPA") forms an integral part of the Hodi General Terms of Service (the "GTS") and of the Contract concluded between HODI SAS, a simplified joint-stock company (société par actions simplifiée) with share capital of €20,000, registered with the Saint-Denis de La Réunion Trade and Companies Register under number 910 167 758, with registered office at 14 rue Pasteur, 97400 Saint-Denis, Réunion (hereinafter "Hodi" or the "Processor"), and the customer identified in the Hodi Order / Service Contract (hereinafter the "Customer" or the "Controller"), together the "Parties" and individually a "Party".

It sets out the conditions under which Hodi processes, on behalf of the Customer, the personal data contained in the content hosted through the Services, in accordance with Article 28 of Regulation (EU) 2016/679 ("GDPR") , French Act No. 78-17 of 6 January 1978 as amended, and the Local Law as defined in Article 1.

In the event of conflict between this Agreement and the GTS regarding the processing of personal data, this Agreement prevails.

ARTICLE 1. Definitions

The terms "personal data", "processing", "controller", "processor", "data subject", "personal data breach" and "supervisory authority" have the meaning given in Article 4 GDPR. Capitalised terms not defined here have the meaning given in the GTS.

For the purposes of this Agreement, the following terms also apply:

• "Customer's Country": the country where the Customer that signed the Order is established;
• "Hosting Country": the country where the main data centre hosting the Customer's data is located, as chosen by the Customer when placing the Order;
• "Local Law": the personal data protection legislation of the Customer's Country and, if different, that of the Hosting Country, together with their implementing texts;
• "Local Supervisory Authority": the authority responsible for personal data protection in the Customer's Country;
• "Authority": any court, administrative authority, prosecuting authority or other public body, whatever its country, empowered to require the disclosure of data;
• "Request": any injunction, requisition, order, letter rogatory or access request issued by an Authority and relating to the Customer's data;
• "ECOWAS": the Economic Community of West African States (CEDEAO);
• "WAEMU": the West African Economic and Monetary Union (UEMOA).

ARTICLE 2. Purpose and allocation of roles

2.1. In accordance with Article 20 of the GTS, each Party is the controller of the data it processes for its own purposes.

2.2. Hodi acts as controller for the processing necessary to perform the Contract, in particular Customer identification data and payment details. This processing is described in Hodi's Privacy Policy at https://hodi.host/confidentialite.

2.3. Hodi acts as processor on behalf of the Customer for the personal data contained in the content the Customer hosts, stores or processes through the Services. This Agreement governs solely that processing scope.

2.4. Unmanaged dedicated servers. For unmanaged (virtual) dedicated server offers, Hodi has no administrator access to the Customer's systems (Article 31 of the GTS) and provides infrastructure only. The Customer is solely responsible for administration, security and data processing. Hodi's processing scope is limited to providing and maintaining the underlying infrastructure.

ARTICLE 3. Description of the processing

The nature, purpose and duration of the processing, the types of data and the categories of data subjects are described in Annex 1.

ARTICLE 4. Obligations of the Processor

Hodi undertakes to:

4.1. Process on documented instructions. Hodi processes personal data solely to provide the Services and on the Customer's documented instructions, including regarding transfers, as set out in the Contract, the GTS, this Agreement and the Customer's use of the Services. Where required to process by Union or Member State law, Hodi informs the Customer beforehand unless legally prohibited. Where such processing results from a Request, whatever the country of the Authority issuing it, Article 7 applies.

4.2. Flag non-compliant instructions. Hodi immediately informs the Customer if, in its opinion, an instruction infringes the GDPR or other applicable data protection provisions.

4.3. Ensure confidentiality. Hodi ensures that persons authorised to process the data are bound by confidentiality and appropriately trained, and applies the principle of least privilege (Article 6.3 of the GTS).

4.4. Implement security measures. Hodi implements the appropriate technical and organisational measures under Article 32 GDPR, described in Annex 2 and Article 6 of the GTS.

4.5. Govern the use of sub-processors under the conditions of Article 5.

4.6. Assist with data subject rights. Taking into account the nature of the processing, Hodi assists the Customer, by appropriate technical and organisational measures and insofar as possible, in responding to requests to exercise data subject rights (access, rectification, erasure, restriction, portability, objection). Where a request is addressed directly to Hodi, Hodi forwards it to the Customer promptly without responding itself, unless otherwise instructed.

4.7. Assist with security and compliance. Hodi assists the Customer in ensuring compliance with Articles 32 to 36 GDPR (security, breach notification, impact assessments, prior consultation), taking into account the nature of the processing and the information available to it.

4.8. Notify data breaches. Hodi notifies the Customer of any personal data breach without undue delay and no later than 72 hours after detecting it (Article 6.6 of the GTS), providing the information needed for the Customer to notify the supervisory authority and data subjects where applicable.

4.9. Maintain records of the categories of processing carried out on behalf of the Customer, in accordance with Article 30(2) GDPR.

4.10. Make information available and allow audits necessary to demonstrate compliance with Article 28 GDPR, under the conditions of Article 8.

ARTICLE 5. Sub-processors

5.1. The Customer authorises Hodi to engage sub-processors to perform the Services (Article 24 of the GTS). The current list is set out in Annex 3.

5.2. Hodi imposes on each sub-processor, by contract, data protection obligations substantially equivalent to those in this Agreement, and remains fully liable to the Customer for the sub-processor's performance.

5.3. Hodi requires each sub-processor processing or having access to the Customer's data, in particular partner data centre operators, to notify Hodi immediately of any Request, unless prohibited by law, to disclose only what is strictly necessary and not to transfer the data to another country without Hodi's consent.

5.4. The list in Annex 3 states, for each sub-processor, its country of registration and the country where the Customer's data is processed.

ARTICLE 6. Data location and transfers

6.1. Data hosted by customers is stored on Hodi's infrastructure or that of selected hosting partners, and not on US public cloud platforms. It is located in the country or region chosen by the Customer at the time of the Order, among those offered for the subscribed offer. Its backup is located according to the offer and the hosting data centre (Article 21 of the GTS).

For the "web hosting and emails", "web hosting PRA/PCA" and "Nuaz" offers, the 30-day backup is made:

• data centre in the European Union (France, Réunion, Martinique): in Germany. The data does not leave the European Union;
• data centre in West Africa (Côte d'Ivoire, Ghana, Nigeria, Senegal, Togo): in Lomé (Togo). The data does not leave the ECOWAS region, nor the WAEMU region for the States that are members;
• data centre in Central Africa (Cameroon): in Lomé (Togo);
• data centre in East Africa (Kenya, Tanzania, Uganda): in Mauritius;
• data centre in South Africa (Cape Town): in Johannesburg. The data does not leave South Africa;
• data centre in another country (Egypt, Madagascar, Morocco, Mauritius, Rwanda, Tunisia): in Germany (EU).

For the "CYBER+" offer, the hourly backup is made in Germany, whatever the country of the hosting data centre.

For dedicated servers and dedicated virtual servers, the PRA/PCA backup is made in the same country as the hosting data centre (except as provided in Article 21 of the GTS). The optional Acronis backup is made in the country chosen by the Customer at the time of the Order, and the optional JetBackup backup in Germany.

Hodi does not change, without the Customer's agreement, the location or geographical area chosen at the time of the Order.

Depending on the offer and options subscribed, certain data is stored or accessible outside the Hosting Country: backups made in Germany, in Lomé or in Mauritius (Article 21 of the GTS), anti-spam filtering (Article 15 of the GTS) and the sub-processors listed in Annex 3. At the Customer's request, Hodi provides the information needed for the formalities required by Local Law (location of data and backups, sub-processors concerned, security measures).

6.2. Where processing involves a transfer to a third country without an adequacy decision, Hodi implements appropriate safeguards, in particular the European Commission's Standard Contractual Clauses (Article 20 of the GTS) and, where necessary, supplementary measures.

6.3. The Customer grants Hodi a mandate to conclude, in its name and on its behalf as data exporter, the Standard Contractual Clauses required with the relevant data importers. The Customer warrants that it holds the authorisations necessary for this purpose.

ARTICLE 7. Requests from authorities

7.1. Principle. Hodi discloses Customer data to an Authority only in compliance with a mandatory legal obligation or an enforceable decision applicable to it. Hodi never discloses Customer data on its own initiative.

7.2. Informing the Customer. Hodi informs the Customer of any Request without delay, no later than forty-eight (48) business hours after its receipt and, in any event, before any disclosure of data. This information specifies the identity and country of the Authority, the legal basis relied upon and the data concerned, and is accompanied by a copy of the Request. It also applies where the Request is addressed to a sub-processor and brought to Hodi's attention.

7.3. Informing the country of origin of the data. At the Customer's request, Hodi also informs the Local Supervisory Authority of the existence of the Request. Where the Request comes from an Authority of a country other than the Customer's Country and the Hosting Country, and the Customer has not responded within five (5) business days, Hodi provides this information on its own initiative.

7.4. Prohibition on informing. The information provided for in Articles 7.2 and 7.3 is given to the extent not prohibited by law. Where a prohibition applies, Hodi uses its best efforts to have it lifted and provides the information as soon as it ceases.

7.5. Review and challenge. Hodi reviews the lawfulness of the Request (jurisdiction of the Authority, legal basis, proportionality, scope). Where there are serious grounds to challenge it, in particular a conflict with Local Law, Hodi challenges it or asks the Authority to narrow it, to the extent legally possible. The Customer may, at its own expense, intervene in the proceedings.

7.6. Mutual legal assistance. Where the Request comes from an Authority foreign to the Hosting Country and disclosure is likely to breach Local Law, Hodi notifies the Authority accordingly and asks that the Request be submitted through international mutual legal assistance channels. If Hodi remains bound by an enforceable decision that has not been suspended, it complies only to the extent required, and such compliance does not constitute a breach of the Contract.

7.7. Minimisation and register. Hodi limits any disclosure to the data specifically covered by the Request and grants no Authority global or permanent access to the Customer's systems or data. Hodi keeps a register of Requests received and makes it available to the Customer concerned on request, to the extent permitted by law.

ARTICLE 8. Audits

8.1. On request, Hodi makes available the information and documents demonstrating its compliance, including its Security Assurance Plan (Article 6.8 of the GTS) and, subject to a non-disclosure agreement, available audit reports.

8.2. The Customer may carry out an audit at its own expense, at most once per year, on reasonable notice, during business hours and without disrupting the Services or compromising other customers' security. Additional audits may be conducted following a proven breach or at a supervisory authority's request.

ARTICLE 9. Obligations of the Controller

The Customer warrants that it has a legal basis for the processing it carries out through the Services, provides lawful instructions, informs data subjects, does not host data for unlawful purposes, complies with the GDPR and Local Law (Articles 11 and 20 of the GTS), and completes the formalities required by Local Law with the Local Supervisory Authority. The Customer remains responsible for the lawfulness of the data it processes and the instructions it gives.

ARTICLE 10. Fate of data at the end of the contract

10.1. On termination of the Services, Hodi deletes or returns the personal data at the Customer's choice, under the reversibility conditions of Article 31 of the GTS, and destroys existing copies unless legally required to retain them.

10.2. As a security measure, Hodi retains backups after termination, automatically deleted 30 days after termination for the "web hosting and emails", "web hosting PRA/PCA" and "Nuaz" offers, and 7 days for other Services provided by Hodi (Article 25.3 of the GTS).

10.3. It is the Customer's responsibility to retrieve and export its personal data before the end of the Services, under the reversibility conditions set out in Article 31 of the GTS. The Customer is informed that termination or expiry of the Services results in deletion of the data, including backups, within the periods indicated above.

ARTICLE 11. Liability

Hodi is liable for damage caused by processing only where (i) it has not complied with the obligations of the GDPR specifically incumbent on processors, or (ii) it has acted outside or contrary to the Customer's lawful instructions. In all other cases, the Customer remains responsible for the processing it carries out through the Services.

The limitations and caps on liability set out in the GTS and the Contract apply to this Agreement.

ARTICLE 12. Term

This Agreement takes effect on acceptance of the Contract and remains in force for the duration of Hodi's processing of personal data on behalf of the Customer. Confidentiality obligations survive for twelve (12) months after termination (Article 19 of the GTS).

ARTICLE 13. Governing law and jurisdiction

This Agreement is governed by French law, without prejudice to the application of the mandatory provisions of Local Law. Any dispute is subject to the procedure set out in Article 34 of the GTS: an attempt at amicable resolution through the Néo-Justice online optimized negotiation, then arbitration under the Néo-Justice Negotiation and Arbitration Rules, and, where arbitration does not apply, the jurisdiction of the Courts of Saint-Denis de La Réunion.

ARTICLE 14. Contact

For any question relating to this Agreement or to the processing of personal data, in particular to notify a security incident, the Customer may contact Hodi:

• by email at securite@hodi.host;
• by opening a request from its client area;
• by post at: HODI SAS, 14 rue Pasteur, 97400 Saint-Denis, Réunion.

Annex 1: Description of the processing

• Nature and purpose: hosting, storage, backup and provision of the Customer's content through the subscribed Services (web hosting and emails, PRA/PCA, CYBER+, Nuaz, VPS, managed or unmanaged virtual dedicated server, Odoo Cloud, and related services).
• Duration: the term of the Contract plus backup retention periods (Article 10).
• Categories of data subjects: determined by the Customer (e.g. its customers, prospects, employees, users of its sites and applications).
• Categories of data: determined by the Customer, corresponding to the content it hosts. The Customer shall not host special categories of data (Article 20 of the GTS) without appropriate measures and specific instructions.
• Processing operations: storage, hosting, backup, replication, restoration, and technical operations necessary to provide and secure the Services.

Annex 2: Technical and organisational security measures

Summary of the measures under Article 6 of the GTS:

• Physical data centre security: fire compartments, backup power, early fire detection, oxygen-reduction suppression, redundant cooling, restricted and logged physical access.
• High availability: redundant architecture, real-time replication across two data centres in the same territory for the relevant offers, per-component firewalling.
• Network segmentation: separation of administration traffic from regular traffic; strong isolation between customers on shared hosting, with dedicated segmentation available as an option on dedicated servers.
• Access security: logical access via a secured dedicated link and ZTNA, administration interfaces not exposed to the internet, multi-factor authentication for staff, least-privilege principle, password policy compliant with the ANSSI-PG-078 guide, logging of administrator access, regular reviews of rights and privileged accounts, encryption of workstations, media and devices.
• Application protection: antivirus/antimalware, web application firewall (WAF), layer 3/4 DDoS protection.
• Vulnerability management: regular application of security patches, with rebootless kernel updates for critical vulnerabilities.
• Backups: automated and supervised daily procedure, encrypted backups that are technically inaccessible from the production infrastructure; retention and locations per offer (Article 21 of the GTS).
• Business continuity and disaster recovery (PRA/PCA): continuity and recovery plan covering in particular cyclone risk and cryptolocker-type attacks (backups inaccessible to Hodi), tested at least once a year.
• Monitoring: real-time monitoring 24/7, with redundant alerting.
• Incident management: breach notification within a maximum of 72 hours.
• Documentation: Security Assurance Plan provided on request.
• Continuous improvement (ISO/IEC 27001): Hodi has initiated an ISO/IEC 27001 certification process to continuously strengthen its information security management system.

Annex 3: List of sub-processors

This lists the sub-processors that may process the personal data hosted by the Customer. The sub-processors actually engaged depend on the offer subscribed and the location chosen by the Customer. The list states, for each sub-processor, the country where the Customer's data is processed, the customer countries or regions concerned per offer family, and its country of registration. Transfers outside the EU/EEA are covered by appropriate safeguards (standard contractual clauses).

Switzerland and the United Kingdom benefit from a European Commission adequacy decision. Transfers to any country outside the European Union without an adequacy decision (see the "Country" column above) are covered by standard contractual clauses. This list is kept up to date; it does not include sub-processors relating to the "marketplace" products defined in the GTS.

Note: payment and billing providers (Stripe, pawaPay, WHMCS) process identity and payment data for which Hodi acts as controller (Article 20 of the GTS); they fall under Hodi's Privacy Policy, not this DPA.