Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service (the "Terms") between Arct Technology LLC ("Arct Cloud", "we", "us", "our"), and the customer that holds the Account ("you"). It governs how we process personal data that you store or run on the Services.

1. Parties, scope and incorporation

1.1. This DPA is incorporated into the Terms. When you accept the Terms, you accept this DPA. No separate signature is needed. If you accept on behalf of a company or other organisation, that organisation is the customer, and you confirm that you have authority to bind it.

1.2. This DPA applies only where Customer Content includes personal data that is subject to the GDPR, the UK GDPR, the Swiss FADP or US State Privacy Laws. It applies only to the extent that we process that personal data on your behalf to provide the Services.

1.3. This DPA does not cover personal data that we process as a controller for our own purposes. Section 4 lists that processing and our Privacy Policy describes it.

1.4. If you need a signed copy for your records, email [email protected]. We will send a copy of this DPA countersigned by Arct Technology LLC. The signed copy has the same terms as this page. A signed copy, a customer form, a security questionnaire or any other document you send us does not change this DPA. A change requires a written amendment signed by an authorised representative of each party.

2. Definitions

Capitalised terms not defined here, including Account, Console, Consumer, Customer Content, End User, Platform and Services, have the meaning given in the Terms.

• Customer Personal Data: personal data contained in Customer Content that we process on your behalf, as your processor or subprocessor, to provide the Services.
• Data Protection Laws: the laws on data protection and privacy that apply to the processing of Customer Personal Data under the Terms, including the GDPR, the UK GDPR, the Swiss FADP and US State Privacy Laws.
• GDPR: Regulation (EU) 2016/679.
• UK GDPR: the GDPR as it forms part of the law of the United Kingdom, read with the Data Protection Act 2018.
• Swiss FADP: the Swiss Federal Act on Data Protection of 25 September 2020 and its ordinances.
• US State Privacy Laws: the California Consumer Privacy Act, as amended by the California Privacy Rights Act, and its regulations (the "CCPA"), and the comparable consumer privacy laws of other US states, each where it applies.
• SCCs: the standard contractual clauses that the European Commission adopted in Implementing Decision (EU) 2021/914 of 4 June 2021.
• UK Addendum: the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018 (version B1.0, in force from 21 March 2022), as later revised.
• Restricted Transfer: any disclosure of Customer Personal Data to us or to a Subprocessor, including making it available by remote access, that is subject to the transfer rules of the GDPR, the UK GDPR or the Swiss FADP and is not covered by an adequacy decision or regulation that applies to the recipient, wherever the data is stored. The SCCs apply to transfers to us unless and until we hold a valid certification under the EU-U.S. Data Privacy Framework, or its UK or Swiss extension, that covers the transfer.
• Personal Data Breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data on systems that we or our Subprocessors manage.
• Subprocessor: a third party that we engage and that processes Customer Personal Data.
• "Controller", "processor", "data subject", "personal data", "processing" and "supervisory authority" have the meaning given in the GDPR. Equivalent terms under other Data Protection Laws, such as "business", "service provider" and "personal information" under the CCPA, are read in the same way.

3. Roles and instructions

3.1. Roles

For Customer Personal Data, you are the controller and we are your processor. Where you process the data for another controller, such as your own client, you are a processor and we are your subprocessor. In that case you warrant that the controller has authorised your instructions to us, our appointment as your subprocessor and our use of Subprocessors under section 7. You are the controller's sole point of contact with us, and you are solely responsible for passing on to the controller any notice or information that Data Protection Laws require it to receive.

3.2. Your instructions

We process Customer Personal Data only on your documented instructions, including for transfers to the locations and Subprocessors described in sections 7 and 12. Your instructions are:

• the Terms and this DPA;
• your use and configuration of the Services through the Console, the API and the servers you control; and
• requests you make in support tickets that are consistent with the Terms.

These are your complete and final documented instructions to us at the time you accept this DPA. Any additional or different instruction requires our written agreement. We are not obliged to accept it, and we may make our agreement subject to fees that we tell you in advance and to any other terms we reasonably require.

3.3. Processing required by law

If the law requires us to process Customer Personal Data other than on your instructions, we will tell you before we carry it out, unless that law prohibits telling you on important grounds of public interest. For data subject to the GDPR, the UK GDPR or the Swiss FADP, this applies only to Union or Member State law, UK law or Swiss law to which we are subject. Requests made under the law of any other country are handled under section 12.6.

3.4. Unlawful instructions

We will immediately tell you if, in our opinion, an instruction infringes Data Protection Laws. We may suspend the processing affected by that instruction until you change it to a lawful one. We will also immediately tell you if we cannot follow your instructions, including because a change in the law prevents us. This section does not oblige us to monitor your instructions or to give you legal advice about them. To the maximum extent permitted by applicable law, we are not liable to you for suspending processing under this section, and the suspension does not affect fees that are due under the Terms.

3.5. Access to Customer Content

The Services are unmanaged. You decide what personal data your servers hold and how it is processed. We do not inspect or monitor the contents of your servers, backups or snapshots in the normal course of providing the Services. We access Customer Content only:

• when you ask us to in a support ticket;
• to investigate abuse, fraud or a security issue;
• to comply with valid legal process; or
• to protect the safety of any person.

Access for the last three purposes is processing for our own purposes under section 4.

3.6. Your responsibilities

• You will comply with Data Protection Laws in your use of the Services. As between the parties, you are solely responsible for the accuracy, quality and lawfulness of Customer Personal Data and of the means by which you obtained it.
• You represent and warrant that you have, and will maintain, a lawful basis for your processing and for our processing under this DPA, and that you have given every notice and obtained every consent or authorisation that Data Protection Laws require for it. You are responsible for the lawfulness of your instructions.
• You are responsible for the security of everything inside your servers: operating systems, software, user accounts, credentials, firewall rules, any encryption, and your own copies of important data.
• The Services are not designed for special categories of personal data or data about criminal convictions. If you store such data, you are responsible for any additional safeguards the law requires.
• You may not store protected health information under HIPAA, payment card data within the scope of PCI DSS or export-controlled technical data unless a separate addendum signed by us allows it.
• You will give us, on request, the information we reasonably need to meet our own obligations under Data Protection Laws, such as the identity and contact details of any controller for which you act.

4. Where we act as a controller

We act as an independent controller, and not as your processor, for the following processing, even where it involves Customer Content or data about your end users:

• creating and managing Accounts, sign-in and Console access;
• billing, payments, taxes and collection of amounts owed;
• fraud prevention and sanctions screening;
• support communications, including the contents of support tickets;
• handling abuse reports and enforcing the Acceptable Use Policy, including reviewing reported material and preserving or reporting it where the law requires;
• network and platform security, including detecting and mitigating DDoS attacks;
• measuring resource use for capacity planning and for usage charges, such as outbound transfer and snapshot storage;
• complying with our legal obligations and with legal process, protecting the safety of any person or of the Services, and establishing, exercising or defending legal claims; and
• our website, analytics and marketing, as described in the Privacy Policy and the Cookie Policy.

The processor terms in this DPA do not apply to this processing. Each party is responsible for its own compliance with Data Protection Laws for it. Information that does not identify, and cannot reasonably be linked to, any individual, such as aggregated statistics about use of the Services, is not personal data, and this DPA does not restrict it.

5. Confidentiality

5.1. We give access to Customer Personal Data only to personnel and contractors who need it to provide the Services or for a purpose in section 3.5.

5.2. Each person with that access is bound by a written duty of confidentiality or by a statutory duty of confidentiality.

5.3. We do not disclose Customer Personal Data to third parties except to Subprocessors under section 7, on your instructions, or where the law requires it under section 12.6. You instruct us to disclose Customer Personal Data to a competent authority without legal compulsion only where we believe in good faith that the disclosure is necessary to prevent an imminent risk of death or serious physical injury to any person, and only to the extent Data Protection Laws permit it.

6. Security

6.1. We implement and maintain the technical and organisational measures described in Annex II. These take into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing, and the risks to data subjects.

6.2. We may update Annex II over time. An update will not reduce the overall level of protection for Customer Personal Data.

6.3. Security is shared. We secure the facilities, network and virtualisation layer that we operate. You secure everything inside your servers, as set out in section 3.6. You are responsible for deciding whether the measures in Annex II meet the needs of your processing.

6.4. To the maximum extent permitted by applicable law, we are not responsible for any Personal Data Breach, loss or unavailability of Customer Personal Data to the extent it is caused by you or your End Users, by the software, configuration or credentials inside your servers, by your failure to apply security measures that you control, or by your failure to keep your own copies of Customer Personal Data.

7. Subprocessors

7.1. General authorisation

You give us general authorisation to engage Subprocessors. The current list is on our Subprocessors page (Annex III). You authorise the Subprocessors listed there on the date you accept this DPA.

7.2. Our obligations

We engage each Subprocessor under a written contract that imposes in substance the same data protection obligations as this DPA, including audit and assistance obligations. We remain fully responsible to you for each Subprocessor's performance of those obligations as if it were our own, subject to section 14, except where the SCCs apply.

7.3. Notice of changes

We will email the Account owner at least 30 days before we add or replace a Subprocessor, and we will update the Subprocessors page at the same time, except as section 7.5 provides. To have these notices sent to an additional address, email [email protected]. You are responsible for keeping the Account owner's email address current and for reviewing these notices. We may remove a Subprocessor at any time without advance notice.

7.4. Objections

You may object to a new or replacement Subprocessor during the 30-day notice period by emailing [email protected] with your reasonable data protection grounds. An objection is reasonable, for example, where the Subprocessor competes with you, or where its use would breach a law that applies to you. An objection must use the subject line "Subprocessor objection" and identify your Account, the Subprocessor concerned and the grounds for the objection. If you do not object within the notice period, you are treated as having authorised the Subprocessor. We will work with you in good faith to resolve the objection, for example by proposing a different configuration or location for your Services.

If we cannot resolve the objection within 15 days after we receive it, or within a longer period we agree in writing, you may terminate the affected Services by written notice, and we may also terminate them by written notice to you. To the maximum extent permitted by applicable law, termination under this section is your sole and exclusive remedy for an objection to a Subprocessor. It does not entitle you to a refund or credit of fees already paid, except where mandatory law requires one, and it does not relieve you of fees accrued before termination. An objection that does not rest on reasonable data protection grounds does not give a right to terminate under this section.

7.5. Urgent replacement

We may replace a Subprocessor with less than 30 days' notice, or without advance notice, where the replacement is needed urgently for reasons outside our reasonable control, such as a security risk, a Subprocessor ceasing to provide its service or breaching its obligations, or a legal requirement, to the extent Data Protection Laws allow. In that case we will notify you as soon as reasonably practicable after the replacement, and the objection period in section 7.4 runs from that notice.

8. Assistance

8.1. Data subject requests

You control your servers, so you can access, correct, export, restrict and delete the personal data on them yourself. If we receive a request from a data subject about Customer Personal Data and can identify you as the relevant customer, we will tell you without undue delay. We will not answer the request ourselves, except to acknowledge it or where the law requires. Taking into account the nature of the processing, we will give you reasonable assistance, through appropriate technical and organisational measures where possible, to respond to such requests.

8.2. Security, breaches and impact assessments

Taking into account the nature of the processing and the information available to us, we will help you meet your obligations under articles 32 to 36 of the GDPR and the UK GDPR, and the equivalent provisions of other Data Protection Laws. These cover security of processing, notification of Personal Data Breaches, data protection impact assessments and prior consultation with supervisory authorities. We help mainly by providing this DPA, Annex II, and information about the Services that you reasonably request.

8.3. Regulator enquiries

If a supervisory authority contacts us about Customer Personal Data, we will tell you, unless the law prohibits it. If you receive an enquiry, complaint or claim that concerns our processing, or that alleges that we have breached Data Protection Laws, you will tell us promptly, to the extent the law allows.

8.4. Cost of assistance

You are responsible for responding to data subjects and supervisory authorities about your processing, mainly through the self-service features of the Services. To the extent Data Protection Laws allow, we may charge you a reasonable fee, based on the time and costs involved, for assistance under this section 8, section 9 or section 11 that goes beyond providing this DPA, Annex II, the self-service features of the Services, the notices under section 9 and the questionnaire answers under section 11.1. We will tell you the fee before we do the work. We do not charge for assistance with a Personal Data Breach that our breach of this DPA caused.

9. Personal Data Breach

9.1. We will notify you without undue delay after we become aware of a Personal Data Breach.

9.2. We send the notice by email to the Account owner's email address. You agree that email notice is sufficient. You must keep that address current.

9.3. As far as the information is known at the time, the notice will describe:

• the nature of the breach, including the categories and approximate number of data subjects and records concerned;
• its likely consequences;
• the measures we have taken or propose to take to address it and to limit its effects; and
• a contact point for further information.

Where we cannot give all of this at once, we will give it in phases without further undue delay.

9.4. We will take reasonable steps to contain and investigate the breach and to limit its effects, and we will cooperate with you.

9.5. As controller, you decide whether to notify supervisory authorities and data subjects, and you make those notifications. We do not notify them on your behalf unless the law requires it or we agree with you in writing. Except where the law requires otherwise, you will consult us before you name us in a public statement about a Personal Data Breach.

9.6. Unsuccessful attempts and events that do not compromise the security of Customer Personal Data are not Personal Data Breaches. Examples are pings, port scans, blocked network attacks and failed sign-in attempts. We do not notify you of them. A compromise caused by software, settings or credentials inside your servers falls under your responsibility in section 3.6.

9.7. Our notice of a Personal Data Breach is not an admission of fault or liability.

9.8. Report a suspected security incident affecting the Services to [email protected].

9.9. Information we give you about a Personal Data Breach or other security event is our confidential information. You may share it with your advisers, insurers, supervisory authorities, affected data subjects and any controller for which you act, to the extent needed to meet your obligations under Data Protection Laws. To the extent Data Protection Laws allow, we may withhold information that would compromise the security of the Services or of other customers, or that the law or a law enforcement authority requires us to withhold.

10. Deletion and return

10.1. Return of data

Customer Personal Data stays on servers that you control. You can copy it out of your servers at any time while they run, using standard tools. Before you cancel or delete a server, export any data you want to keep. That export is how Customer Personal Data is returned to you, and you choose return or deletion by exporting the data before the deletion events in section 10.2. We are not obliged to extract, copy or return data for you; any assisted return we agree to is subject to section 8.4. We do not restore or return data after it is deleted. Customers in the EU can also use the switching and export terms in the Terms.

10.2. Deletion

We delete Customer Personal Data on the timelines in the Terms. In summary:

• When you delete a server, its disk and its backups are permanently deleted at once.
• When you cancel a server, it keeps running until the end of the paid period. At the end of that period, the server and its backups are permanently deleted.
• If any invoice is unpaid after its due date, your Account is suspended. On day 21 after the due date, all servers, backups, snapshots and other data on the Account are permanently deleted. You are responsible for paying invoices before their due date, and we are not responsible for data lost through deletion for non-payment.
• Snapshots are kept until you delete them, except in the non-payment case above. They are billed while they exist.
• Backups rotate through 7 slots. When all slots are full, the oldest backup is replaced.
• For any other end of the Services, the Terms apply.

A switching request under the Terms pauses these timelines until the retrieval period ends.

10.3. Residual copies

Deleted backups and snapshots are removed from backup storage in that system's routine cleanup. Until then they remain encrypted and are not used.

10.4. Retention required by law

We may keep Customer Personal Data where a law that applies to us requires it, including under a legal preservation request. We keep it only for as long as that law requires, protect it under this DPA and use it for no other purpose.

10.5. Confirmation

On request to [email protected], we will confirm in writing that deletion has taken place.

11. Audits

11.1. Information and questionnaires

On request, we will give you the information reasonably needed to demonstrate our compliance with this DPA and with article 28 of the GDPR and the UK GDPR. This includes this DPA, Annex II and written answers to reasonable security questionnaires. We answer questionnaires once in any 12-month period, plus whenever a Personal Data Breach or a supervisory authority makes a further answer necessary. Additional or customised requests are subject to section 8.4. You agree to rely on this information first, before you request an audit under section 11.3.

11.2. Data center certifications

Where the operators of the data centers that host the Services hold third-party certifications or audit reports, we will provide copies or summaries if the operator allows it, under a duty of confidentiality.

11.3. On-site audits

If the information under sections 11.1 and 11.2 is not enough to demonstrate our compliance, or a supervisory authority requires it, you may audit our processing of Customer Personal Data on these terms:

• you give at least 30 days' written notice to [email protected];
• no more than one audit in any 12-month period, unless a supervisory authority requires another;
• the audit is carried out by you or by an independent auditor that we both approve, that is not our competitor, and that is bound by confidentiality;
• scope, timing and duration are agreed in a written audit plan before the audit, and the audit takes place during business hours without unreasonable disruption;
• the audit does not give access to other customers' data, to information we must keep confidential, to our trade secrets or to information that would compromise the security of the Services, such as credentials and encryption keys;
• the audit is limited to our processing of Customer Personal Data under this DPA, and the auditor follows our reasonable security and safety rules while on our premises or systems;
• access to a data center is subject to the operator's rules and consent;
• you bear all costs of the audit, including the reasonable cost of our staff time; and
• you keep the results confidential and share the report with us.

11.4. This section does not change the SCCs. Where the SCCs give you wider audit rights, those rights apply.

11.5. Everything we provide or you learn under this section 11, including questionnaire answers, certifications, reports and audit results, is our confidential information. You may use it only to verify our compliance with this DPA and Data Protection Laws, and you may disclose it only to your auditors, legal advisers, a supervisory authority, or a controller for which you act, under a duty of confidentiality, or as the law requires.

12. International transfers

12.1. Where Customer Personal Data is processed

• The primary disks of your servers stay in the location you select at deployment. We do not move a primary disk to another location without your instruction, unless the law requires it (section 3.3).
• Backups and snapshots are stored in our backup storage, which can be in a different country from the server.
• We are a US company. Our personnel may access our infrastructure remotely. Making Customer Personal Data available to us, including by remote access, is a Restricted Transfer where it meets the definition in section 2, wherever the data is stored.

12.2. EU Standard Contractual Clauses

For each Restricted Transfer subject to the GDPR, the SCCs are incorporated into this DPA by reference. Module 2 (controller to processor) applies where you are a controller. Module 3 (processor to processor) applies where you are a processor. You are the data exporter and we are the data importer. Your acceptance of the Terms counts as signature of the SCCs by both parties. The following selections apply:

Where Module 3 applies, you will pass to your controller any notice from us that the SCCs require the controller to receive. You confirm that your controller has authorised our use of Subprocessors under section 7.

12.3. United Kingdom

For each Restricted Transfer subject to the UK GDPR, the UK Addendum is incorporated into this DPA by reference and completed as follows:

• Table 1: the parties and contact details in Annex I.A. The start date is the date you accept the Terms.
• Table 2: the Approved EU SCCs, with the modules and selections in section 12.2.
• Table 3: Annexes I, II and III of this DPA.
• Table 4: the importer may end the UK Addendum as set out in its Section 19.

The Mandatory Clauses of the UK Addendum apply. The UK Addendum is governed by the law of England and Wales, and disputes under it go to the courts of England and Wales.

12.4. Switzerland

For each Restricted Transfer subject to the Swiss FADP, the SCCs apply as set out in section 12.2, with these changes:

• The Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority for transfers governed by the Swiss FADP.
• References to the GDPR are read as references to the Swiss FADP to the extent the transfer is governed by it.
• The term "Member State" in the SCCs does not prevent data subjects who are habitually resident in Switzerland from bringing claims there, in line with Clause 18(c).

12.5. Onward transfers

We transfer Customer Personal Data to a Subprocessor outside the European Economic Area, the United Kingdom or Switzerland only with a safeguard that Data Protection Laws accept, such as an adequacy decision or standard contractual clauses.

12.6. Requests from public authorities

We are subject to US law, including laws that can require a US provider to disclose data in its possession, custody or control wherever the data is stored (such as 18 U.S.C. 2713, part of the CLOUD Act). If a public authority asks us for Customer Personal Data, we will:

• try to redirect the authority to request the data from you directly;
• review the legality of the request, and challenge it where we conclude after careful assessment that there are reasonable grounds to consider it unlawful;
• notify you promptly and send you a copy of the request, unless the law prohibits it. If it does, we will use our best efforts to obtain a waiver so that we can tell you as much as possible, as soon as possible;
• disclose only the minimum data that a reasonable reading of the request allows;
• document our assessment and make it available to you where the law allows; and
• give you aggregate information about such requests where the law allows.

Our Law Enforcement Guidelines page describes how we handle these requests.

12.7. Transfer assessments

On request, we will give you the information about our processing and about the laws that apply to us that you reasonably need for your assessment under Clause 14 of the SCCs.

12.8. Changes to transfer mechanisms

If a transfer mechanism in this section is replaced, amended or found invalid, we may adopt a valid replacement, such as a new version of the SCCs or the UK Addendum, by notice to you. The parties will cooperate in good faith to keep transfers lawful.

13. US state privacy laws

13.1. Under the CCPA, we are your service provider for Customer Personal Data. You disclose it to us only for these limited and specified business purposes: hosting, storing and transmitting Customer Content, backing it up and taking snapshots where you use those features, and deleting it, each on your instructions (the "Business Purposes").

13.2. We will not:

• sell or share Customer Personal Data, as the CCPA defines those terms;
• retain, use or disclose it for any purpose other than the Business Purposes in section 13.1, or outside our direct business relationship with you, except as the CCPA permits; or
• combine it with personal information that we receive from others or collect ourselves, except as the CCPA permits.

13.3. We will comply with the obligations that the CCPA places on us and give Customer Personal Data the level of privacy protection that the CCPA requires. We will tell you if we decide that we can no longer meet these obligations.

13.4. You may take reasonable and appropriate steps to make sure that we use Customer Personal Data in line with your CCPA obligations, including through section 11. On notice to us, you may take reasonable steps to stop and remediate any unauthorised use.

13.5. For other US State Privacy Laws, sections 3, 5, 7, 8, 9, 10 and 11 form the processor terms those laws require. We certify that we understand the restrictions in this section 13 and will comply with them.

14. Liability

14.1. To the maximum extent permitted by applicable law, and except as set out in section 14.2, each party's liability arising out of or relating to this DPA, including liability between the parties under the SCCs, the UK Addendum and the Swiss changes in section 12.4, whether in contract, tort or under any other theory, is subject to the exclusions and limitations of liability in the Terms, to the extent those exclusions and limitations apply to that party. The cap in the Terms is one aggregate cap for all claims under the Terms, this DPA and those clauses together. This DPA does not create a separate or additional cap, and no loss may be recovered more than once.

14.2. Section 14.1 does not limit either party's liability towards data subjects under the third-party beneficiary rights in the SCCs, the UK Addendum or the Swiss changes, and it does not apply to liability between the parties to the extent those clauses do not allow it to be limited. Section 14.1 also does not limit any liability that cannot be limited under applicable law, including the liability described in section 15.1 of the Terms, or the rights that mandatory consumer law gives Consumers.

15. Order of precedence and governing law

15.1. If documents conflict on the processing of Customer Personal Data, this order applies:

1. the SCCs, with the UK Addendum and the Swiss changes, where they apply, and only to the extent of the conflict;
2. this DPA; and
3. the Terms and the other documents they incorporate.

Nothing in this DPA or the Terms changes the SCCs or limits the rights of data subjects under them.

15.2. Except where the SCCs or the UK Addendum set the governing law and courts, the governing law and dispute resolution terms of the Terms apply to this DPA.

16. Term and changes

16.1. This DPA takes effect when you accept the Terms. It continues for as long as we process Customer Personal Data, including after the Terms end, until the data is deleted under section 10.

16.2. We may change this DPA through the change process in section 18 of the Terms, which sets the notice we give and your options. Changes that Data Protection Laws or a supervisory authority require, and the adoption of a replacement transfer mechanism under section 12.8, may take effect sooner where the Terms allow it. If you do not accept a change, your remedy is to cancel the affected Services before it takes effect. A change will not reduce the protection that Data Protection Laws require for Customer Personal Data.

16.3. Any provision of this DPA that by its nature should continue after the DPA ends will continue.

17. Indemnity

17.1. To the maximum extent permitted by applicable law, you will defend, indemnify and hold harmless Arct Technology LLC and its members, managers, employees, contractors and agents from and against any third-party claim, including a claim by a data subject, a controller for which you act or a supervisory authority, and any resulting losses, damages, administrative fines, penalties, settlements and reasonable costs, including legal and investigation fees, to the extent they arise from:

• your breach of this DPA or of Data Protection Laws;
• processing of Customer Personal Data on the Services without the lawful basis, notice, consent or authorisation that section 3.6 requires; or
• an instruction you gave us that infringes Data Protection Laws.

17.2. Section 17.1 does not apply to the extent the claim or loss is caused by our breach of this DPA. The procedure, and the limits for Consumers, in the indemnification section of the Terms apply to this section. Section 14.1 does not limit your obligations under this section, to the extent the law allows. Nothing in this section limits the rights of data subjects under the SCCs.

18. General

18.1. The general provisions of the Terms apply to this DPA, including those on notices, electronic communications, assignment, force majeure, waiver and entire agreement. Section 15 of this DPA governs conflicts between this DPA and the Terms.

18.2. If any provision of this DPA is found invalid or unenforceable, it is enforced to the maximum extent the law allows, and the rest of this DPA remains in effect. Any provision of this DPA that conflicts with the SCCs is ineffective only to the extent of that conflict.

18.3. Only you and we may enforce this DPA, except for the rights that the SCCs, the UK Addendum or Data Protection Laws give to data subjects. A controller for which you act, and any of your affiliates, may exercise rights relating to this DPA only through you, unless Data Protection Laws require otherwise, and their claims count toward the aggregate cap in section 14.1.

18.4. Our records of your acceptance of this DPA, of your Console and API settings, of support tickets and of notices sent under this DPA are evidence of your instructions and of those notices, unless shown to be wrong.

Annex I: Details of processing

A. List of parties

B. Description of processing and transfer

C. Competent supervisory authority

As set out for Clause 13 in section 12.2.

Annex II: Technical and organisational measures

This annex lists the measures we apply to the infrastructure that stores and carries Customer Personal Data.

1. Physical security

Our servers are housed in third-party colocation data centers in the cities where we offer servers. The operators of those facilities control physical access to them.

2. Network security and DDoS mitigation

• DDoS protection is included on every plan.
• Each server runs as a separate virtual machine, logically separated from other customers' virtual machines by the hypervisor.

3. Access control and least privilege

• Administrative access to hypervisors, backup storage and the Console back end is limited to authorised personnel who need it for their role.
• Personnel do not access the contents of customer servers except as set out in section 3.5.
• Customers sign in to the Console through our authentication provider. Sign-in credentials are held by that provider.

4. Encryption

• The website, the Console and the API are served over TLS.
• Backups and snapshots are encrypted on the host before they are written to backup storage.
• Data you send to and from your servers is encrypted in transit only when you use encrypted protocols, such as SSH or TLS.

5. Logging

• We keep logs, such as access, security, network and billing records, to run, secure and maintain the Services.
• We log Console sign-ins and account activity, including IP addresses.

6. Availability and restoration

• Optional daily backups keep 7 rotating slots. Manual snapshots are kept until deleted under section 10. Either can be used to recover server data, as the Service Terms describe. You choose whether to use them.
• We do not promise that any backup or snapshot will be complete, current or restorable. Keeping independent copies of Customer Personal Data, and any redundancy you need, is your responsibility.

7. Incident response

• We investigate suspected security incidents and notify you of Personal Data Breaches under section 9.
• Security reports and vulnerability reports go to [email protected].

8. Personnel

• Personnel and contractors with access to Customer Personal Data are bound by confidentiality under section 5.

9. Subprocessors, assistance and deletion

• Subprocessors are bound by written data protection terms under section 7.
• We assist you as set out in section 8.
• Customer Personal Data is deleted as set out in section 10.

10. Measures you are responsible for

You are responsible for the security of your servers as set out in section 3.6, including updates, firewall rules, credentials, access management, encryption of stored data where you need it, and your own backups.

Annex III: Subprocessors

The current list of Subprocessors, with the service each provides and its location, is on our Subprocessors page. The Infrastructure group on that page lists the Subprocessors that store or carry Customer Content. The Account, billing and analytics group lists vendors that support our processing as a controller under section 4. Those vendors are not Subprocessors under this DPA. Changes follow section 7.