This Data Processing Agreement (“DPA”) forms part of the Terms of Service (the “Agreement”) between Depfloy, LLC (“Depfloy”, “Processor”) and the customer (“Customer”, “Controller”). It applies where Depfloy processes personal data on the Customer’s behalf and that data is subject to the GDPR, the UK GDPR or the Swiss FADP.

Terms defined in the Agreement have the same meaning here. Where this DPA and the Agreement conflict on the processing of personal data, this DPA wins.

A signed copy — including the Standard Contractual Clauses in Section 8 — is available on request from [email protected]. Customers who need one countersigned should write there.

1. Definitions

“Data Protection Law” means the GDPR (Regulation 2016/679), the UK GDPR and the Data Protection Act 2018, the Swiss Federal Act on Data Protection, and any other data protection law applicable to the processing under the Agreement.

“Customer Personal Data” means personal data that Depfloy processes on the Customer’s behalf under the Agreement, as described in Annex I.

“Sub-processor” means a processor engaged by Depfloy to process Customer Personal Data.

“Security Incident” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorised disclosure of or access to Customer Personal Data.

“SCCs” means the Standard Contractual Clauses annexed to European Commission Implementing Decision (EU) 2021/914.

Controller, processor, data subject, processing and supervisory authority carry the meanings given in the GDPR.

2. Roles

The Customer is the controller of Customer Personal Data. Depfloy is the processor and processes it only on the Customer’s documented instructions.

Where Depfloy is instead a controller. Depfloy is the controller of the account, billing, support and usage data described in its Privacy Policy — the data about the Customer’s own staff as users of Depfloy. That is not Customer Personal Data and this DPA does not govern it.

A note on scope, because it is unusual here. Depfloy is a control plane, not a host. The Customer’s application data and databases remain on the Customer’s own servers; Depfloy does not copy them, and backups stream from the Customer’s server directly to the Customer’s own storage. In practice the Customer Personal Data Depfloy actually processes is narrow, and Annex I says exactly what it is rather than leaving it to be assumed.

3. Processing instructions

Depfloy processes Customer Personal Data only:

1. to provide the Service under the Agreement;
2. on the Customer’s further documented instructions, where consistent with the Agreement; and
3. where required by law that applies to Depfloy — in which case Depfloy will tell the Customer beforehand unless that law forbids it.

The Agreement, this DPA and the Customer’s use of the Service through its interfaces are the Customer’s complete documented instructions. Anything beyond them needs written agreement.

Depfloy will tell the Customer if, in its opinion, an instruction infringes Data Protection Law.

4. Confidentiality

Depfloy ensures that everyone authorised to process Customer Personal Data is bound by an appropriate duty of confidentiality, and limits access to those who need it to provide the Service.

5. Security

Depfloy implements and maintains the technical and organisational measures in Annex II, taking account of the state of the art, the cost of implementation, and the nature, scope, context and purposes of the processing.

Those measures may be updated as technology develops, provided the overall level of security is not reduced.

6. Sub-processors

6.1 Authorisation. The Customer gives Depfloy general authorisation to engage the Sub-processors listed in Annex III, and others appointed under this section.

6.2 Obligations. Depfloy imposes data protection terms on each Sub-processor that are no less protective than this DPA, and remains liable to the Customer for its Sub-processors’ acts and omissions as for its own.

6.3 Changes. Depfloy will give the Customer at least thirty (30) days’ notice by email before a new Sub-processor starts processing Customer Personal Data.

6.4 Objection. The Customer may object on reasonable data protection grounds within that thirty (30) day period. The parties will discuss the objection in good faith. If it cannot be resolved, the Customer may terminate the affected part of the Service without penalty and receive a refund of fees paid for the unused period.

6.5 What Sub-processors never receive. No Sub-processor listed in Annex III receives the Customer’s SSH keys, sudo passwords, server credentials or environment variables. Those stay within Depfloy’s own systems.

7. Security incidents

Depfloy will notify the Customer without undue delay, and in any case within seventy-two (72) hours, of becoming aware of a Security Incident affecting Customer Personal Data.

The notification will describe what is known about the nature of the incident, the categories and approximate number of data subjects and records affected, the likely consequences and the measures taken or proposed. Where the full picture is not yet available, Depfloy will send what it has and follow up.

Depfloy will assist the Customer in meeting its own notification obligations under Articles 33 and 34 of the GDPR. Notification is not an admission of fault.

8. International transfers

Depfloy processes Customer Personal Data in the United States.

Where the Customer transfers Customer Personal Data subject to the GDPR, the UK GDPR or the Swiss FADP to Depfloy, the SCCs are incorporated into this DPA by reference and apply as follows:

• Module Two (controller to processor) applies, the Customer being the data exporter and Depfloy the data importer.
• Clause 7 (docking) applies.
• Clause 9 — Option 2, general written authorisation, with the notice period in Section 6.3.
• Clause 11 — the optional independent dispute resolution body is not used.
• Clause 17 — the SCCs are governed by the law of Ireland.
• Clause 18(b) — disputes are resolved before the courts of Ireland.
• Annexes I, II and III of the SCCs are populated by Annexes I, II and III of this DPA.

United Kingdom. The UK International Data Transfer Addendum (version B1.0) applies to UK transfers, with the SCCs as its Approved EU SCCs, Tables 1–4 completed from this DPA and its Annexes, and the importer able to end the Addendum under Section 19.

Switzerland. For transfers under the Swiss FADP, references in the SCCs to the GDPR are read as references to the FADP, “supervisory authority” includes the Swiss Federal Data Protection and Information Commissioner, and “member state” is read so that Swiss data subjects may enforce their rights in Switzerland.

Government access. Depfloy has received no order requiring it to disclose Customer Personal Data to a public authority. If it receives one, it will challenge it where there are grounds, disclose only the minimum required, and tell the Customer unless legally forbidden. Depfloy maintains no back door into its systems for any government.

No Privacy Shield. Depfloy does not rely on the EU–US Privacy Shield, which was invalidated in 2020 and is not a valid transfer mechanism.

9. Data subject requests

Where a data subject exercises a right under Data Protection Law, Depfloy will, taking account of the nature of the processing, assist the Customer by appropriate technical and organisational measures, in so far as possible, to respond.

Most Customer Personal Data is directly accessible and editable by the Customer through the dashboard and the API, so the Customer can usually respond without our help.

If a request reaches Depfloy directly, Depfloy will not respond to it substantively, and will forward it to the Customer without undue delay.

Assistance under this section is provided at no charge unless a request is manifestly excessive or repetitive.

10. Impact assessments

Depfloy will provide the Customer with reasonable information to help it carry out a data protection impact assessment or a prior consultation with a supervisory authority under Articles 35 and 36 of the GDPR, where the Customer cannot obtain that information itself. The Annexes below and the Security page are intended to cover most of what is needed.

11. Audit

Depfloy will make available the information necessary to demonstrate compliance with Article 28 of the GDPR, and allow for and contribute to audits.

The Customer may exercise this right by requesting Depfloy’s current security documentation and completed security questionnaires, which Depfloy will provide on a confidential basis within thirty (30) days.

Where that is genuinely insufficient to demonstrate compliance, the Customer may conduct an on-site audit no more than once every twelve (12) months, on thirty (30) days’ written notice, during business hours, without unreasonable disruption, subject to confidentiality, and at the Customer’s cost — except where the audit reveals a material breach of this DPA, in which case Depfloy bears its own costs. A supervisory authority may audit at any time, and this paragraph does not limit that.

12. Deletion and return

On termination of the Agreement, Depfloy will delete Customer Personal Data within thirty (30) days, except where retention is required by law.

Before then, the Customer can export its data through the dashboard and the API. Anything held in backup systems is isolated from further processing and deleted on the ordinary backup cycle.

Server credentials and environment variables are deleted on the same thirty-day schedule. Deleting them changes nothing on the Customer’s servers — the Customer keeps the keys and should rotate them.

13. Liability

Each party’s liability under this DPA is subject to the limitations in the Agreement. Nothing here limits a data subject’s rights, or either party’s liability to a supervisory authority.

14. Term

This DPA takes effect when the Customer accepts the Agreement and continues while Depfloy processes Customer Personal Data.

Annex I — Description of the processing

This Annex populates Annex I of the SCCs.

A. Parties

Data exporter (controller): the Customer, as identified in its Depfloy account. Contact: the account owner’s email address. Activities: use of the Depfloy Service to manage its own servers and deploy its own applications.

Data importer (processor): Depfloy, LLC, 1111B S Governors Ave STE 29096, Dover, DE 19904, United States. Contact: [email protected]. Activities: providing the Depfloy Service.

B. Categories of data subjects

• The Customer’s own staff and contractors who are members of the Customer’s Depfloy organisation
• Individuals identified in configuration the Customer enters — for example an email address in a notification setting or an environment variable

C. Categories of personal data

• Identity and contact data: names and email addresses of the Customer’s organisation members
• Account data: roles, per-resource scopes, invitation status, authentication metadata
• Activity data: the record of which member performed which action, and when
• Configuration data: server names, project names, domains, environment variables and connection settings, to the extent any of these contain personal data
• Credential data: SSH private keys, sudo passwords and server credentials the Customer provides
• Technical data: IP addresses and user agents in access logs

Not included: the Customer’s application data and databases. These remain on the Customer’s own servers and are never copied to Depfloy. Backups stream from the Customer’s server directly to storage the Customer controls, and Depfloy retains no copy.

D. Special category data

None is requested and none should be provided. Depfloy applies no additional restrictions for special category data because it is not designed to receive any.

E. Frequency

Continuous, for as long as the Customer uses the Service.

F. Nature and purpose

Storage, retrieval, transmission, encryption and deletion, for the purpose of providing the Service: authenticating members, applying permissions, connecting to the Customer’s servers over SSH to provision and deploy, running scheduled operations, and recording what happened.

G. Retention

For the duration of the Agreement, and deleted within thirty (30) days of termination, except where law requires longer. The retention table in the Privacy Policy applies to each category.

H. Sub-processor processing

As set out in Annex III, for the duration and purpose stated there.

I. Competent supervisory authority

Determined under Clause 13 of the SCCs — the authority of the member state in which the data exporter is established, or, where the exporter is not established in the EEA, the authority of the member state where its Article 27 representative is established or where the relevant data subjects are.

Annex II — Technical and organisational measures

This Annex populates Annex II of the SCCs.

Encryption. Server credentials, SSH private keys, sudo passwords and environment variables are encrypted at rest with AES-256-CBC and an HMAC, using a random initialisation vector per value, and decrypted in memory only when a job needs them. All traffic to and from the Service is encrypted in transit with TLS. Connections to Customer servers use SSH.

Access control. Access to production systems is limited to personnel who require it. Within the Service, the Customer controls access through roles (Owner, Admin, Manager, Developer, Viewer) and per-server and per-project scoping. Two-factor authentication is available to all users.

Authentication. Passwords are hashed. API keys and tokens are issued per client and can be revoked individually.

Logging and accountability. Actions taken in the Service are recorded in an activity log with the member who performed them and the time, retained for twenty-four months and available to the Customer.

Segregation. Customer data is logically separated by tenant, and every data-access path is scoped to the acting user’s organisation.

Resilience. Production data is backed up regularly. Restores are exercised.

Incident response. Documented procedures for detecting, escalating and responding to security incidents, including notification under Section 7 of this DPA.

Confidentiality of personnel. Everyone with access is bound by a confidentiality obligation.

Sub-processor management. Written data protection terms with every Sub-processor; the current list is Annex III.

Deletion. Credentials and environment variables are deleted within thirty days of account closure.

The Security page describes these in ordinary language, including what Depfloy deliberately does not hold.

Annex III — Sub-processors

This Annex populates Annex III of the SCCs. Current as of the date at the top of this page.

None of these receives Customer credentials. SSH private keys, sudo passwords, server credentials and environment variables are not shared with any Sub-processor.

The analytics and advertising Sub-processors process data about the Customer’s own users of the Depfloy dashboard, for which Depfloy is generally the controller under its Privacy Policy; they are listed here for completeness. Where consent is required, these are engaged only after it is given.

Depfloy, LLC 1111B S Governors Ave STE 29096, Dover, DE 19904, United States [email protected]