What is the GDPR?

OVH will access data in two circumstances only:

• In order to implement services, particularly to improve the support provided to customers when they contact the OVH helpline. In this situation, access to data will be limited, thanks to specific authorisations and specific control and security measures.
• To comply with legal obligations as part of legal and/or administrative requests. These requests are very strictly regulated.

Access as part of customer support:
When a customer contacts OVH customer support, depending on the issue involved, two categories of data may be accessed. On the one hand, in order to handle the customer's request as well as possible, customer support will access the data provided by the customer when his OVH account was created (surname, first name, telephone number, email address, etc.).
On the other hand, and only if expressly requested by the customer and subject to technical restrictions unique to each service, the customer support team may access the data it has stored on OVH services, in order to determine the origin of the problem encountered and, potentially, to solve it.

Access as part of a request from judicial and/or administrative authorities:
In order to act in accordance with the regulations in force, OVH is obliged to answer requests from judicial and/or administrative authorities. Since requests for access are covered by a strict legal framework, OVH will not authorise these requests until we have ensured that they are valid and substantiated. Moreover, unless prohibited by the request or by law, OVH undertakes to inform the customer as soon as possible in the event that such a request is made. Requests issued from a third-party country will not be handled unless there is an underlying international agreement, such as a treaty for mutual legal assistance, in force between the third-party country applicant and the Union or a Member State.

There are two different scenarios, depending on the choices made by the customer as to the location of the datacentres storing their data:

When the customer chooses a service that involves one or more datacentres within the European Union:
In this scenario, the customer's data will never be transferred outside:

• the Member States of the European Union;
• countries recognised by the European Commission as offering a sufficient degree of protection for personal data with regard to the protection of private life, liberties and fundamental human rights. The list of these countries is available on the European Commission website.

In the wake of 'Safe Harbour' being ruled invalid, and despite the fact that the European Commission deems that the American bodies that are members of the Privacy Shield offer a sufficient degree of protection, OVH will never transfer customer data with a selected geographical location within the EU to the United States of America.

Transfers of data to countries recognised by the European Commission as offering a sufficient degree of protection may occur as part of an intervention by OVH customer support. For OVH datacentres based in the European Union, the OVH customer support teams who may be called on to intervene are based in the European Union and in Canada, since Canada is recognised by the European Commission as a country offering an adequate degree of protection for personal data. OVH also reserves the right to entrust customer support services that may involve remote access to data stored by customers, as part of our services, to other bodies in the OVH Group based in countries that are also recognised by the European Commission as offering a sufficient degree of protection (excluding the USA).

The guarantees provided by OVH with regard to data transfer mean that customers can meet their own regulatory obligations. Article 45 of the GDPR, which defines "transfers on the basis of an adequacy decision", stipulates that the transfer of personal data to a third-party country or to an international organisation may take place if the Commission has ruled that that third-party country, a territory or one or more specific sectors of that third-party country, or the international organisation in question, offers an adequate degree of protection. Such transfers do not need to be authorised separately.

If the customer chooses a service that uses a datacentre located outside the European Union:
In this scenario, it seems obvious that data will be transferred outside the European Union. The location or geographical area of the datacentre(s) used for the service can be found on the OVH website. Where several datacentres are available, customers may select the datacentre of their choice, and OVH will not change the location or geographical area requested in the order without the customer's permission and subject to the individual terms and conditions of certain services.

To assist organisations wishing to process personal data using datacentres located outside the European Union, in a country that does not offer an adequate degree of protection for personal data, OVH may, by express request, discuss the implementation of safeguards that would permit such a transfer, as defined in Article 46 of the GDPR, "Transfers subject to appropriate safeguards".