Privacy & security
Transparent about your data, security and agreements
You trust us with your website, your email and your customers' data. Here you can read exactly where that data is stored, how we protect it, which parties are involved and what we agree with you contractually.
In short
- Our own hardware runs in the BIT datacenter in Ede
- Your website, databases and email are stored on our own servers in the Netherlands
- 99.9% uptime guarantee per month, set out in the SLA
- We notify you of a data breach within 48 hours at the latest
- Up to 10 backups per day and up to 90 days back (depending on your package)
- Data processing agreement included as standard, no signature needed
Data location
Where is your data stored?
Our own hardware in Ede
Our own hardware runs in the BIT datacenter in Ede. The servers that hold your website, databases and mailboxes are our property and are managed by us. BIT provides the space, power and cooling and in principle has no access to your data.
Certified datacenter
The BIT datacenter is certified under ISO 27001 (information security), ISO 9001 (quality) and NEN 7510 (information security in healthcare). Read more about the datacenter and our network at Datacenter and network.
Data in the Netherlands
The files, databases and mailboxes in your hosting package are stored on our own servers in the Netherlands. For some support and security tools, data may also be processed outside the EEA, solely with the legal safeguards for transfers outside the EU. You can see which parties those are under sub-processors.
Redundant network and DNS
Our internal network and power supply are redundant. Your domain names run on geographically separated name servers.
Security
How we protect your data
For us, security is a combination of technology and fixed agreements. An overview of the key measures:
Technical measures
- Encrypted connections: a free SSL certificate with every hosting package.
- Isolated accounts: customer environments are separated from each other where technically possible.
- Server security: firewall and protection against abuse and attacks on our web servers.
- Backups: daily, and several times a day with most packages.
- Monitoring: our systems are monitored automatically.
- Administration: access control and logging on our management environments.
- Updates: regular security updates of platform and infrastructure. In case of immediate risks we carry out emergency maintenance.
Organizational measures
- Only authorized staff have access to personal data, and they are bound by a duty of confidentiality.
- We only engage other parties on the basis of written agreements that adequately protect your data.
- In the event of a data breach, we inform you within 48 hours at the latest after it becomes known to us.
- Once a year, and when there is a concrete suspicion of misuse, you may have it checked whether we comply with the data processing agreement. This is done by an independent auditor bound by confidentiality, or we provide you with a statement from an independent third party. The costs of an audit are for your account.
Privacy & GDPR
Who is responsible for what?
Under the GDPR we have a different role depending on the data. This is how it works:
Your account
For your customer account, invoices and contracts, we are the controller. How we handle that is set out in our privacy statement.
Data in your hosting
For everything you store or process through our services, such as websites, databases and email, you are the controller and we are the processor. Our data processing agreement applies to this.
Resellers
Do you resell our services to your own customers and are you a processor yourself? Then we are the sub-processor and the same data processing agreement applies.
The data processing agreement
- Is automatically part of your agreement, you do not need to sign anything.
- We only process your data for the purposes you determine.
- Requests from data subjects (for example for access) that reach us, we forward to you.
- We announce changes at least two months in advance. If you do not agree, you can terminate at the end of those two months.
Special categories of personal data?
Do you process health data, for example? Then contact us in advance, so we can look together at what is needed for that.
End of your service
As long as your hosting package is active, you make a backup of your account yourself via your control panel and download it. If we have not received your payment before the due date, you lose access to your service. We keep your package and your data for a further period: if you still pay the outstanding invoice, you regain access. If you cancel, make sure you have made a backup before the end date. What we are legally required to retain, such as invoice data (7 years), we keep for as long as necessary.
Sub-processors
Which parties are involved?
We distinguish between sub-processors (who process personal data on your behalf), parties that process data in their own role, and suppliers without access to customer data. We inform you of material changes, and you can object to a new sub-processor on reasonable grounds within a reasonable period.
Sub-processors
| Party | Purpose | Location |
|---|---|---|
| CloudLinux / Imunify360 | Server security, malware detection, firewall and protection against abuse | Depending on configuration, possibly outside the EEA with appropriate safeguards |
| Cookiebot / Usercentrics | Cookie and consent management on websites | Depending on configuration, possibly outside the EEA with appropriate safeguards |
Parties with their own role
| Party | Purpose | Location |
|---|---|---|
| Mollie | Payments | Netherlands / EEA |
| PayPal | Payments (only if you choose this) | Possibly outside the EEA with appropriate safeguards |
| Domain registries and registrars | Registration, management, transfer and renewal of domain names | Depending on the registry, inside and outside the EEA |
| Let's Encrypt | Issuing and managing SSL certificates | Possibly outside the EEA with appropriate safeguards |
Suppliers without access to customer data
| Party | Purpose | Location |
|---|---|---|
| BIT | Datacenter and colocation | Netherlands |
| JBMC Software / DirectAdmin | Software and licenses for hosting management | Not applicable to customer data |
| LiteSpeed | Web server and caching software | Not applicable to customer data |
Uptime & backups
Availability, backups and support
In the SLA we guarantee at least 99.9% uptime per calendar month. Planned maintenance within the maintenance window does not count towards this. If we fail to achieve that, you can claim an SLA credit via a ticket within 30 days after that month. We offset it against a subsequent invoice.
| Web hosting | Backups per day | Restore up to |
|---|---|---|
| Mini | 1 to 3 times | 3 days |
| Starter | 1 to 3 times | 7 days |
| Basic | 1 to 5 times | 30 days |
| Medium | 1 to 5 times | 60 days |
| Deluxe | 1 to 10 times | 90 days |
| Ultimate | 1 to 10 times | 90 days |
Outages and maintenance
We carry out planned maintenance in the night-time maintenance window from 00:00 to 07:00. If we expect an interruption, we announce it at least 7 days in advance where possible. Outages that affect multiple customers are reported with updates on status.theory7.net.
Support
Support is available every day from 09:00 to 21:00 via chat and ticket, and depending on your package also by phone. How quickly we respond also depends on your package: see Support explained.
Frequently asked questions
Short answers to what we often hear
Is Theory7 ISO certified?
Theory7 itself is not. The BIT datacenter where our hardware runs is: ISO 27001, ISO 9001 and NEN 7510. On top of that we take our own security measures.
Do I need to sign the data processing agreement?
No. The data processing agreement automatically becomes part of your agreement as soon as you take a service in which we process personal data for you. A signature is not required for it to be valid.
Where are my backups stored?
In the Netherlands. How often we make a backup and how long we keep it depends on your package.
Can I take my data to another provider?
Yes. As long as your service is active, you make a full backup of your account yourself via your control panel and download it. Do that before the end date: after that you no longer have access. If that is due to an unpaid invoice, you regain access after payment.
Contact
Something to report or ask?
Privacy
Questions about privacy or a request regarding your personal data, such as access, correction or deletion? Email privacy@theory7.net. If you are not satisfied with how we handle your data, you can file a complaint with the Autoriteit Persoonsgegevens (the Dutch Data Protection Authority).
Abuse and illegal content
Do you see spam, phishing, malware or other illegal content on a website hosted with us? Report it via abuse@theory7.net. We assess every report according to our Notice & Take Down policy.
Company details
Theory7 B.V.
Buitenvaart 2110-11
7905 SX Hoogeveen
Chamber of Commerce (KvK) 90213580
