Parties and roles
Where the customer determines the purposes and essential means of processing personal data hosted on the purchased service, the customer ordinarily acts as controller and the 3000Host contracting entity acts as processor for that data. For its own billing, security and account administration data, 3000Host may act as controller under the Privacy Policy.
Documented instructions
The processor handles customer personal data only on documented lawful instructions embedded in the agreement, service configuration and authorised requests, unless binding law requires otherwise. If an instruction appears unlawful, it is escalated through the agreed contact route where permitted.
Processing schedule
The type of processing, data categories, data subjects, service location, duration and authorised subprocessors are established in the applicable order or data-processing schedule. No undisclosed special-category processing arrangement is assumed from this general website document.
Confidentiality and security
Persons authorised by the processor are subject to confidentiality obligations. Appropriate administrative, technical and access safeguards are maintained according to the risk and agreed service scope. The customer remains responsible for securing its applications and account permissions except where an approved managed-service schedule provides otherwise.
Subprocessors and transfers
Subprocessors, if used, are bound by appropriate confidentiality, security and processing obligations. Where required, the customer is informed of material changes and permitted to exercise the agreed objection procedure. International data transfers must comply with applicable Omani legal requirements and contractual safeguards.
Incidents and cooperation
The processor notifies the authorised customer contact without undue delay after confirming an incident affecting customer personal data, subject to legal restrictions and available facts. The parties cooperate on investigation and any required notices to regulators or individuals, each within its legal responsibility.
Data-subject requests and audits
The processor reasonably assists the customer with lawful access, correction, deletion and other rights requests within the service’s technical scope. Evidence of relevant controls may be provided through an agreed confidential mechanism, without exposing unrelated customer data or infrastructure secrets.
End of processing
At the end of the authorised purpose or service, personal data is erased in accordance with applicable Omani law, except for a documented existing dispute or legally imposed retention duty. Data export or return is coordinated with the customer before the end where the contracted service permits.
Conflict and operational annexes
This agreement supplements the Terms of Service and the applicable service schedule. It does not change a mandatory legal duty or replace required processing particulars that must be completed for a specific customer. Where the signed data-processing schedule provides more specific protections, those protections govern its subject matter.