ThriveHost GDPR Policy
The General Data Protection Regulation (GDPR) is the legal framework governing data protection law across the European Union, effective from May 25, 2018.
Unlike Directive 95/46/EC, which previously governed data processing, the GDPR has direct effect within the Union and does not require national transposition. Its primary aim is to harmonize the laws regulating the processing of personal data across Europe.
Furthermore, the GDPR enshrines the principle of extraterritoriality, meaning that, in specific circumstances, its scope can extend beyond European borders.
If your organization processes personal data, it is highly likely that you must comply with the GDPR provisions. ThriveHost, as both a data processor and a data controller, adheres to these regulations and fulfills the associated obligations.
Definitions
Understanding the specific issues in European regulations can be complex, especially with the GDPR’s 99 articles, 173 recitals, and numerous guidelines. A clear understanding of the following terms is essential to avoid risks from broad or imprecise interpretations of regulatory obligations:
Personal data: Any information related to an identified or identifiable individual. An identifiable individual is someone who can be identified, directly or indirectly, through identifiers such as names, identification numbers, location data, or other factors.
Processing: Any operation or set of operations performed on personal data, whether automated or manual, such as collecting, recording, organizing, structuring, storing, adapting, altering, retrieving, consulting, using, disclosing, transmitting, disseminating, aligning, combining, restricting, erasing, or destroying.
Controller: The natural or legal person, public authority, agency, or other body that determines the purposes and means of processing personal data.
Processor: The natural or legal person, public authority, agency, or other body that processes personal data on behalf of the controller.
ThriveHost as a Processor
ThriveHost frequently acts as a processor when handling personal data on behalf of a data controller. This scenario typically occurs when you use ThriveHost’s services to store personal data on our infrastructure. Within the limits of our technical capabilities, ThriveHost processes this data strictly according to your instructions and on your behalf.
ThriveHost’s Commitments as a Processor
As a processor, ThriveHost commits to:
Processing personal data solely for service delivery: ThriveHost will only process your data to perform the services correctly and will not use your information for any other purposes, such as marketing.
Data residency within the EU: We keep your data within the EU or in countries recognized by the European Union as providing an adequate level of protection unless you select a data center outside the EU.
Subcontractor transparency: ThriveHost will inform you if any subcontractors are involved in processing your personal data. Currently, no services involving access to your data have been subcontracted outside ThriveHost.
Strict security standards: We apply rigorous security measures to ensure a high level of data protection for our customers.
Prompt data breach reporting: In case of a data breach, ThriveHost will notify you without undue delay.
Regulatory compliance support: ThriveHost will help you meet your regulatory obligations by providing comprehensive information about our services.
These commitments ensure that our customers can trust ThriveHost as a responsible processor.
ThriveHost as a Data Controller
ThriveHost acts as a data controller when determining the purpose and method of processing its own data. This typically includes collecting data for billing, managing accounts receivable, improving service quality and performance, sales prospecting, and commercial management. It also applies to collecting personal data about our employees.
In this context, your data—data stored on ThriveHost’s services—is not affected. However, certain information related to you or your employees (such as contact details provided during technical support requests) may be processed. ThriveHost ensures that this personal data is protected with the following commitments:
Commitments as a Data Controller
ThriveHost commits to:
Limiting data collection: We collect only the necessary details for invoicing, support services, and fulfilling legal obligations concerning data retention (in compliance with laws such as the French Law 2004-575 of June 21, 2004, on confidence in the digital economy).
Purpose limitation: We use collected data only for the purposes for which it was gathered.
Proportionate data retention: Personal data related to customer relationships (e.g., names, addresses, email addresses) is retained for the duration of the contract and an additional thirty-six (36) months. After this period, the data is deleted from all platforms and backups.
Restricted data sharing: We do not transfer personal data to third parties, except to companies associated with ThriveHost as part of contract performance. Intra-group data sharing may involve transfers outside the EU based on binding corporate rules implemented by ThriveHost.
High-security standards: We implement appropriate technical and organizational measures to ensure a high degree of security for personal data.
By adhering to these principles, ThriveHost ensures compliance with the GDPR, safeguarding personal data and maintaining transparency in our data processing activities.