Data Processing Agreement
Version: draft 0.1 Effective: date
Operator: Evgeny Shevtsov, country, legal entity and registered address ("we", "us"). Contact: [email protected].
1. Parties and scope
This agreement is between the operator named above ("Processor") and the organization that uses the Service ("Controller"), and forms part of the Terms of Service. It applies to personal data that the Processor processes on behalf of the Controller in providing the Service.
What is not in scope: the contents of the Controller's databases and the data of the Controller's own customers do not pass through the Processor. The open-source software and the runner work in the Controller's environment; the Processor does not receive that data or database passwords. If the Controller nevertheless sends such data to the Service, it does so against this agreement and in breach of the Terms.
2. Details of the processing
| Subject matter | Providing the control panel, API, portal, statistics and monitoring of LokaDB Cloud |
|---|---|
| Duration | The term of the Service, then deletion under section 9 |
| Nature and purpose | Storing, displaying and transmitting operational data to deliver the Service, send alerts and support the Controller |
| Types of personal data | Names, e-mail addresses and sign-in identifiers of the Controller's users; names or identifiers of organizations; IP addresses and activity in logs; operational metrics, which contain no row contents |
| Data subjects | The Controller's employees and contractors who use the Service, and contact persons of the Controller's customers if their names are entered |
3. Instructions
The Processor processes personal data only on the Controller's documented instructions, which are these terms and the Controller's use of the Service. If the Processor believes an instruction breaks the law, it tells the Controller. If the law requires other processing, the Processor tells the Controller first unless the law forbids it.
4. Confidentiality
People authorised to process the data are bound by confidentiality.
5. Security
The Processor applies appropriate technical and organizational measures, including: encryption in transit; secrets stored hashed or encrypted; separation of customers' data in the Service; least-privilege, logged access; token and certificate authentication of runners and agents with revocation; backups of the Service's own data; further measures confirmed with counsel and engineering.
6. Sub-processors
The Controller gives general authorisation to sub-processors needed to run the Service. Current ones: hosting, e-mail, payment: names and locations. The Processor informs the Controller of changes 30 days ahead, binds sub-processors to equivalent duties, and remains liable for them. The Controller may object on reasonable grounds within that period.
7. Assistance
The Processor helps the Controller, with reasonable measures and at reasonable cost, to answer data-subject requests, to run impact assessments and to consult authorities, as far as these relate to the processing here.
8. Personal data breach
The Processor notifies the Controller without undue delay, and in any case within 48 hours, after becoming aware of a breach affecting the Controller's personal data, with the information it has about the nature, consequences and measures taken.
9. Deletion and return
When the Service ends, the Processor deletes the Controller's personal data within 30 days, or returns it on request first, except where the law requires storage (for example invoices).
10. Audits
The Processor gives the Controller the information needed to show compliance and allows reasonable audits, no more than once a year unless a breach occurred, on 30 days' notice, in business hours, under confidentiality, at the Controller's cost.
11. International transfers
Data is processed in region. A transfer to another country takes place only with an appropriate safeguard for example standard contractual clauses, to be attached as Annex B.
12. Liability and law
Liability is governed by the Terms of Service. This agreement is governed by the law stated there check against the data-protection law that applies to the Controller.
13. Order of precedence
If this agreement conflicts with the Terms on the processing of personal data, this agreement prevails.
Signature. Accepted electronically when the Controller accepts the Terms, or signed by both parties for Enterprise.