DPA – Data Processing Agreement

(Data Processing Agreement pursuant to Art. 28 of the GDPR)
MediaCP – Media Server Hosting
Last updated: May 25, 2026

1. Introductory Provisions

This Data Processing Agreement ("DPA") governs the terms under which MediaCP – Media Server Hosting, as the processor, processes personal data on behalf of the customer, as the controller.

This DPA is concluded in accordance with Art. 28 of Regulation (EU) 2016/679 (GDPR) and forms an integral part of the service agreement between the customer and MediaCP.

By accepting the terms and conditions or by using MediaCP services, the customer confirms their agreement to this DPA.

---

2. Contracting Parties

Processor

MediaCP – Media Server Hosting
Petr Maléř (Sole Proprietor / OSVČ)
ID (IČO): 11983060
Václava Košaře 61/30
700 30 Ostrava
Czech Republic

E-mail: [email protected]

(hereinafter referred to as the "Processor")

Controller

A natural or legal person utilizing the services provided by the Processor.

(hereinafter referred to as the "Controller")

---

3. Subject of Processing

The Processor primarily provides:

• Radio hosting
• Shoutcast hosting
• Icecast hosting
• AutoDJ services
• IPTV hosting
• TV hosting
• Live streaming
• Video on Demand (VoD)
• VPS servers
• Reseller hosting
• Webhosting
• Other related services

Personal data processing may occur on behalf of the Controller during the provision of these services.

---

4. Purpose of Processing

The purpose of processing is exclusively:

• provision of ordered services,
• storage of customer data,
• operation of streaming servers,
• transmission of audio and video content,
• provision of technical support,
• infrastructure security,
• service performance monitoring,
• maintenance of technical logs,
• generation of traffic statistics.

The Processor will not use personal data for its own marketing purposes.

---

5. Categories of Personal Data

Depending on the service used, the following may be processed in particular:

Identification Data

• first and last name,
• company name,
• Company ID (IČO),
• Tax ID (DIČ).

Contact Data

• e-mail address,
• phone number,
• contact address.

Technical Data

• IP addresses,
• device identifiers,
• user accounts,
• system logs,
• access logs.

Streaming Data

• listener IP addresses,
• connection statistics,
• viewership statistics,
• stream metadata.

Customer Content

• audio files,
• video files,
• databases,
• websites,
• e-mail messages,
• other data stored by the customer.

---

6. Categories of Data Subjects

Processing may include data of:

• the Controller's customers,
• visitors to the Controller's websites,
• listeners of internet radios,
• viewers of streamed broadcasts,
• the Controller's employees,
• the Controller's business partners,
• users of the Controller's information systems.

---

7. Duration of Processing

Personal data is processed:

• for the duration of the provided service,
• for the period necessary for the performance of the contract,
• for the period required by legal regulations,
• for the period necessary to protect the legitimate interests of the Processor.

Upon termination of the service, data will be deleted or returned to the Controller according to their instructions, unless legal regulations provide otherwise.

---

8. Obligations of the Processor

The Processor undertakes to:

Process Data Only According to the Controller's Instructions

Personal data will be processed only to the extent necessary to provide the agreed services.

Maintain Confidentiality

All persons who have access to personal data are bound by a duty of confidentiality. This obligation continues even after the termination of the employment or contractual relationship.

Implement Security Measures

The Processor shall implement appropriate technical and organizational measures, in particular:

• encryption of communication using TLS,
• access rights management,
• firewall protection,
• infrastructure monitoring,
• malware protection,
• regular software updates,
• server system security,
• logging of administrator access.

Assist the Controller

Upon request, the Processor shall provide reasonable assistance to the Controller in:

• handling data subjects' requests,
• complying with obligations under the GDPR,
• conducting data protection impact assessments,
• resolving security incidents.

---

9. Sub-processors

The Controller grants a general consent to the use of sub-processors necessary for the provision of services. These may include, in particular:

• data center providers,
• cloud infrastructure providers,
• monitoring system providers,
• backup service providers,
• network connectivity providers,
• PayPal,
• Stripe.

The Processor shall ensure that all sub-processors are bound by similar data protection obligations.

---

10. Transfer of Data Outside the European Economic Area

If data is transferred outside the EEA, it will be done only under the conditions of the GDPR. The transfer may be based, for example, on:

• Standard Contractual Clauses of the European Commission,
• an adequacy decision,
• another legal basis recognized by the GDPR.

---

11. Security Incidents

If the Processor detects a personal data breach, it shall inform the Controller without undue delay. The notification shall include, if the information is available:

• a description of the incident,
• the scope of the incident,
• categories of affected data,
• likely consequences,
• remedial measures taken.

---

12. Requests from Data Subjects

If the Processor receives a request from a data subject regarding data processed on behalf of the Controller:

• it will not respond to the request without the Controller's instruction,
• it will forward the request to the Controller without undue delay.

---

13. Audit and Documentation of Compliance

The Controller is entitled to request information necessary to verify the compliance of this DPA with the GDPR. The Processor shall provide reasonable cooperation to an extent that:

• does not endanger infrastructure security,
• does not violate the rights of other customers,
• does not disclose trade secrets.

---

14. Termination of Processing

Upon termination of the services:

• the data will be deleted,
• or transferred to the Controller upon their request.

Backups will be removed within the normal cycle of deleting and overwriting backups. Unless otherwise specified, the standard retention period for backups is a maximum of 7 days.

---

15. Liability

Each contracting party is responsible for fulfilling its obligations under the GDPR. The Processor is not liable for:

• the legality of the data stored by the Controller,
• the legal basis for its processing,
• the broadcast content of the customer,
• the content of the customer's websites,
• infringement of third-party rights by the Controller.

---

16. Final Provisions

This DPA becomes effective at the moment the service is ordered.

The current version is always available on the MediaCP website.

Legal relationships not regulated by this agreement are governed by the GDPR and the laws of the Czech Republic.