Sub-processor List
Sub-processors
PAC WEBHOSTING LTD uses these sub-processors to provide our hosting services. They may process personal data you store on, or send through, our services, under our Data Processing Agreement.
| Sub-processor | What they do | Applies to | Data location | Transfer safeguard |
|---|---|---|---|---|
| Krystal Hosting Ltd (Krystal Cloud) | Cloud infrastructure: servers, Enhance backup servers, S3 storage for cPanel backups, the Enhance DNS servers for hosted domains, and network | All hosting and VPS services | UK. For a VPS, the location you choose: London (UK), Amsterdam (Netherlands), New York or Phoenix (USA). DNS servers: UK, Amsterdam (Netherlands) and USA | Not needed for UK. Amsterdam: UK adequacy regulations. New York and Phoenix: IDTA / UK Addendum. DNS servers in the USA: IDTA / UK Addendum |
| Hetzner Online GmbH | Enhance backup servers, kept for 30 days | Enhance hosting services | EU | UK adequacy regulations (EU) |
| MailChannels Corporation | Outbound email relay and spam filtering | Email sent from hosting accounts | Canada; relay servers worldwide | UK adequacy regulations (Canada); contractual clauses for other locations |
| Patchstack | WordPress vulnerability monitoring and virtual patching | WordPress sites with Patchstack enabled | EEA | UK adequacy regulations (EEA) |
Personal data for domain registrations is passed to the relevant registry, such as Nominet (.uk) or CentralNic, and to the registrar. They process it as independent controllers under their own registry rules, not as our sub-processors.
Licensed software on our servers
This software runs on our own servers. The vendors receive licence and server details only. They have no routine access to your data.
| Vendor | Software | Purpose |
|---|---|---|
| Enhance | Enhance control panel | Hosting control panel and account isolation |
| cPanel, L.L.C. | cPanel & WHM | Hosting control panel |
| CloudLinux, Inc. | CloudLinux OS | Account isolation and resource limits |
| LiteSpeed Technologies | LiteSpeed Web Server | Web server and caching |
| Linkers Gate LLC | cPFence | Server firewall, web application firewall and malware scanning |
| WP Media | WP Rocket | WordPress caching plugin. Optional cloud features, such as Remove Unused CSS and RocketCDN, are enabled by you and covered by WP Rocket’s own terms |
If we ever need to give a vendor temporary access to a server to fix a problem, they’ll be bound by confidentiality. We’ll treat them as a sub-processor for that access.
Services you contract for directly
These services have their own data protection terms with you. They’re not PAC sub-processors:
- Microsoft 365: Microsoft Customer Agreement and Microsoft Products and Services DPA
- QUIC.cloud: when you connect your site to it yourself in the LiteSpeed Cache plugin for WordPress, for example for image optimisation, critical CSS or its CDN. Your site then sends content such as images and pages to QUIC.cloud for processing, under your own QUIC.cloud account and its Service Agreement
- Cloudflare: if you put your own website behind Cloudflare using your own Cloudflare account. PAC doesn’t provide Cloudflare to customers
Changes to this list
We give at least 30 days’ notice before adding or replacing a sub-processor. We update this page and email the primary contact on each account. You can object as set out in clause 5 of the DPA. Questions: [email protected].
| Date | Change |
|---|---|
| 28 September 2026 | List first published |
