General Data Protection Regulation Policy

SIRSTEVEHQ provides web hosting to clients worldwide, and we have a responsibility to protect each client and to provide the best services available.

What is the General Data Protection Regulation (GDPR)?

The European Union’s General Data Protection Regulation, or GDPR, is a regulation that came into effect on May 25, 2018.

The GDPR regulates the collection, processing, transport, and use of personal information about individuals in Europe. GDPR compliance cannot be “certified” as such since there is no certification process. Compliance with GDPR laws & regulations is not as straightforward as an organisation being either “compliant” or “non-compliant”.

What is SIRSTEVEHQ doing to ensure data protection for all our customers?

SIRSTEVEHQ uses Payment Card Industry (PCI) compliant gateways such as PayStack, Flutterwave, and Klump, which employ tokenized payment methods to ensure the highest level of security for cardholder data. Since we no longer store payment card information on our platform, we do not require PCI DSS compliance directly, but we rely on these trusted gateways to handle all sensitive payment data securely.

SIRSTEVEHQ is also ISO 9001 and ISO 27001 certified, demonstrating our commitment to quality management and information security management standards. These certifications ensure that we maintain robust processes for protecting your data and consistently delivering high-quality services.

SIRSTEVEHQ is a registered data controller with the Information Commissioner’s Office (ICO).

We are Payment Services Directive (PSD2) ready and use 3DS authentication to comply with PSD2 and Strong Customer Authentication (SCA) requirements.

All of our signup, login, and support services are completed through a secure connection (HTTPS/SSL).

We use cryptographic hash functions to protect your information. Your password is stored as a hash digest, and in the event of a security breach, your original password cannot be recovered from our servers.

In accordance with GDPR, our customers have the right to access their data or request to “be forgotten” (to be permanently deleted from our databases). To request either of these, please use the following links:

GDPR Data Request

GDPR Ready Service Audit In the absence of an official compliance GDPR certification, and therefore no definition of what compliance means, we have prepared a GDPR Ready Service Audit that will help service providers and customers reach a level of mutual trust and assurance.

Article 28 of the GDPR states, “Where the processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of this Regulation and ensure the protection of the rights of the data subject.” Essentially, this means that all service providers must demonstrate compliance, or their customers will put their own compliance at risk if using a non-compliant provider. Consequently, it is expected that it will become standard practice for customers to require evidence of GDPR compliance from third-party service providers. GDPR Ready is designed to help service providers understand what they need to do and provide the assurances their customers will demand.

Request a GDPR Ready Audit

Use of Industry-Standard Software

As part of our hosting services, SIRSTEVEHQ utilizes industry-standard software and control panels, including but not limited to WHMCS, cPanel, Plesk, DirectAdmin, Enhance, 20i and Zare. These software solutions are essential tools in the hosting industry and are widely used by hosting providers and data centres across the globe.

Please note that these software solutions are developed and maintained by third-party providers located outside Nigeria and may involve data processing outside of the Nigeria/Africa. SIRSTEVEHQ has no control over the internal operations of these software providers. By using our services, you acknowledge and agree that your data may be processed by these third-party systems and may be transferred to and stored in locations outside Nigeria/Africa as part of their standard operations.

While these software tools are industry-standard and trusted by countless providers, customers are advised to be aware of the potential for their data to be processed outside of Nigeria/Africa. This is consistent with the operations of most hosting providers and data centres worldwide.

GDPR Addendum

Any client wishing to hold Personal Data on their SIRSTEVEHQ hosted environment will need to ensure they are complying with their own responsibilities as a Data Controller (both under the current Data Protection Act 1998, and under the GDPR once it applies).

Last Updated: 29^th December 2024