Data Processing Addendum

1. Roles

The Customer is the controller (or “business”) of Customer Personal Data and is responsible for having a lawful basis for it and for giving its data subjects any notices the law requires. The Processor processes Customer Personal Data only as the Customer’s processor (or “service provider”).

2. Details of the processing

3. Processing only on instructions

The Processor processes Customer Personal Data only on the Customer’s documented instructions, which are the Terms, this DPA and the Customer’s configuration of the Service, unless the law requires otherwise — in which case the Processor will tell the Customer first unless the law prohibits it. The Processor will tell the Customer if it believes an instruction infringes data protection law.

4. Confidentiality

Everyone the Processor authorises to process Customer Personal Data is bound by a duty of confidentiality and accesses it only as needed to provide or support the Service.

5. Security

The Processor maintains appropriate technical and organisational measures under Article 32 UK GDPR, including:

• encryption of data in transit with TLS, and of stored credentials and environment variables at rest with AES-256;
• salted hashing of passwords, single-use expiring hashed reset links, and optional two-step verification;
• role-based access controls, with authorisation enforced on every API route and access limited to staff who need it;
• isolation of each customer’s applications in separate containers with resource limits;
• rate-limiting, error monitoring and alerting to detect abuse and failures; and
• regular review of these measures as the Service and threats evolve.

6. Sub-processors

The Customer gives general authorisation for the Processor to engage the sub-processors listed in the annex below. The Processor will give at least 30 days’ notice by email and on this page before adding or replacing a sub-processor. The Customer may object on reasonable data-protection grounds within that period; if the parties cannot resolve the objection, the Customer may terminate the affected Service and receive a refund of any prepaid fees for the period after termination.

The Processor imposes data protection obligations on each sub-processor that are no less protective than this DPA, and remains responsible to the Customer for their performance.

7. International transfers

Where Customer Personal Data is transferred from the United Kingdom to a country without adequacy regulations, the parties rely on the UK Extension to the EU–US Data Privacy Framework for certified recipients or, otherwise, on the UK International Data Transfer Addendum to the EU standard contractual clauses, which are incorporated into this DPA by reference, with the Customer as exporter and the Processor as importer.

8. Data subject requests

Taking into account the nature of the processing, the Processor will assist the Customer by appropriate technical and organisational measures in responding to requests from data subjects to exercise their rights. If the Processor receives such a request directly, it will pass it to the Customer without responding to it, except to confirm it has been forwarded.

9. Personal data breaches

The Processor will notify the Customer without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. The Processor will provide further information as it becomes available and reasonably assist the Customer with its own notification duties.

10. Impact assessments and consultations

The Processor will provide reasonable assistance, using information available to it, with any data protection impact assessment and prior consultation with a supervisory authority that the Customer is required to carry out in relation to the Service.

11. Deletion at the end of the Service

The Customer can export its content at any time during the term. When the Customer deletes an application or its account, the Processor deletes the related Customer Personal Data from its live systems immediately, and it rolls off backups within their normal cycle, unless the law requires it to be kept.

12. Information and audits

The Processor will make available the information reasonably necessary to demonstrate compliance with this DPA. Where that information is not sufficient, the Customer may audit the Processor, or appoint an independent auditor bound by confidentiality to do so, no more than once a year on at least 30 days’ written notice, during business hours, at the Customer’s cost, and in a way that does not compromise the security of the Service or other customers’ data.

13. US state privacy laws

Where the Processor acts as a service provider or contractor under the CCPA or similar US state laws, it will not:

• sell or share Customer Personal Data, or use it for cross-context behavioural advertising;
• retain, use or disclose it for any purpose other than the business purposes of providing the Service, or outside its direct business relationship with the Customer; or
• combine it with personal data it receives from other sources, except as the law permits.

14. Compliance and liability

The Processor will comply with the obligations that applicable data protection law places on it, provide the level of privacy protection that law requires, and notify the Customer if it determines it can no longer meet them, in which case the Customer may take reasonable steps to stop and remedy unauthorised processing. Each party’s liability under this DPA is subject to the limitations in the Terms, except where the law does not allow them to apply.

Questions about this DPA can be sent to support@paasnext.com. The Customer may request a countersigned copy for its records.

15. Annex: current sub-processors