The General Data Protection Regulation (GDPR) came into force on 25 May 2018. It applies to companies that process the personal data of EU citizens. It builds on existing data protection law and gives people greater control over how organisations like Eirhost use their information, including the ability to access, correct or remove it. It also gives Eirhost additional responsibilities for the data we handle.
The Irish Data Protection Commissioner provides further information at https://www.dataprotection.ie/docs/GDPR/1623.htm and http://gdprandyou.ie/.
What the terms mean
Personal data is information about a living person. It includes information that can identify someone on its own or when combined with other information. Examples include a name, PPS number, home or business address, online customer number and email address.
Processing covers what an organisation does with personal data, such as collecting, organising, recording, storing, structuring or using it. It covers both digital and paper-based work.
A data subject is the person whose data is being processed. A data controller decides why and how personal data is processed, either independently or jointly with others. A controller can be a person, organisation, public authority, agency or other body. Where EU or Member State law determines the purpose and means of processing, that law can also identify the controller or set the criteria for choosing one.
A data processor is a person, organisation, public authority, agency or other body that processes personal data on a controller’s behalf. Examples include a company hired to send marketing materials or a courier delivering parcels for an online shop.
Information Eirhost collects as a controller
When you sign up, we collect the information we need to set up the service you selected and bill you on a recurring basis. We limit collection to what we need to provide our services, work to reduce the amount of personal data we hold and aim to be clear about what we collect. Eirhost is registered with the Data Protection Commissioner under registration number 9636/A.
The information we collect as part of our services includes your name, company name, postal address, email address, phone number, payment preferences and payment information, IP address, call logs, call recordings and identification documents when requested.
Phone calls. We log details such as the caller’s number and the length of the call. We may also record calls and will tell callers in advance when recording is in use. We delete call logs and recordings monthly.
.ie domain registration. We may ask for identification, such as a passport, driving licence, PPS number or Revenue documentation, to meet our contractual obligations to the IEDR and satisfy its registration requirements. We use this information solely for domain registration and remove the documents from our systems within 28 days.
Account ownership. For business sales, ownership disputes or other account management queries, we may ask everyone involved to provide identification so we can verify ownership. We explain why we need it before collecting it and delete the information monthly.
Other requests for information. If we need further personal data in connection with your account or services, we explain why we are asking and how long we will keep it. Some records must be kept for seven years, for example to meet Irish Revenue requirements. We aim to retain personal data only for as long as necessary.
When you are the controller and Eirhost is the processor
You are the controller for personal data you store or process through Eirhost, including data about your customers or users. This applies whether you put the data directly on our servers, collect it through a website we host or use another Eirhost service. In these cases, Eirhost acts as your processor.
As the controller, you must check that any processors you use comply with the GDPR and that the required contractual terms are in place. This statement supports your due diligence and explains how we address data protection and security in our day-to-day operations.
We do not access the data you store on our servers. Any processing is limited to providing the services you use. We do not use your hosted data for our own purposes or give third parties access unless the law requires it. This may include a court order or a request from the relevant authorities. We follow internal procedures, handle requests in accordance with applicable law and notify you as the controller when we receive such a request.
How we manage GDPR compliance
As an Irish company serving customers in the EU, we are committed to complying with the GDPR. Ahead of its implementation, we committed to training staff on their responsibilities, updating internal policies and assigning responsibility for ongoing compliance. We also committed to reviewing our systems, processes and services, with particular attention to data security and external providers, establishing procedures and scheduled reviews for ongoing compliance, and updating our service terms to meet the GDPR’s contractual requirements for controllers and processors.
We have reviewed the services we provide and our internal policies and procedures. We have implemented technical and staff procedures to protect data and carry out ongoing checks on the GDPR compliance of our sub-processors and other third-party processors, including data centres and domain registries.
Where data is hosted
Eirhost operates from data centres in Dublin, Ireland, and London, UK. Facilities outside the EU serve specific customers who are generally based outside the EU.
How we protect our systems
Our data centres are staffed around the clock, every day of the year. CCTV covers the interior, exterior and all entrances. Perimeter Access Card (PAC) systems control access to the site and data rooms, and electronic door access systems secure entrances. We use our own systems to monitor site access and all servers remotely.
We keep our staff up to date on business security and maintain the security of our servers around the clock. We prioritise security patches and updates and consider data protection and privacy when making changes to our systems. We also maintain the security of customers’ servers where their service agreement covers this work.
How we handle data breaches
If a breach as defined by the GDPR occurs, we will notify you within 48 hours of becoming aware of it. We will also report relevant breaches to the office of the Irish Data Protection Commissioner as required by the GDPR.
Contact us about your data
For general GDPR questions or help making a request, email gdpr@eirhost.com.
For access requests, write to Eirhost Web Hosting, Ashtown Business Centre, Navan Road, Dublin 15.
Access requests are free, and we will respond within 30 days. If we refuse a request, we will explain our reasons in detail. You can update the information we hold through the available account functions or as part of your request. You can also use the available functions to request deletion of your data.
