Data Processing Agreement

This DPA is between [CUSTOMER_LEGAL_NAME_AND_ADDRESS] (“Customer”) and [LEGAL_NAME] IKE, [REGISTERED_ADDRESS] (“Meteorack”). Customer is controller or a processor authorised by its controller; Meteorack is processor or subprocessor respectively for customer personal data. It covers purchased Annex A services. Meteorack's independent controller activities require separate notice/lawful basis. This DPA prevails over the main agreement on processing; applicable SCCs prevail in their scope and mandatory law over all.

We process only documented instructions: agreement, service configuration and authorised requests, including transfers. If EU/Member State law requires other processing, we notify beforehand unless prohibited for important public interest. We immediately inform Customer of instructions infringing GDPR/applicable law and seek lawful correction; we do not replace the controller. Customer determines lawful purposes/bases/additional conditions, informs people, minimises data and has authority to appoint us. Our own legal obligations are not generally waived.

People with access are bound by confidentiality or appropriate statutory duties. Access is need-based, reviewed and revoked. Support access must be restricted, approved where needed and logged. Relevant training and staff-exit procedures are required. These measures remain contractual proposals until Annex B is verified.

Apply appropriate Article 32 measures for confidentiality, integrity, availability and resilience, considering risk, data nature/volume and cost. Annex B specifies controls/limitations. Do not materially reduce agreed protection. No universal encryption, certification or RPO/RTO is asserted without evidence. Material security gaps need remediation/lawful processing restriction; notice alone does not cure them.

General written authorisation is proposed only for completed, accepted Annex C entries. Unknown names/unaccepted services are not authorised. Before additions/replacements give [SUBPROCESSOR_NOTICE: proposed 30 days] with service, data, locations and safeguards. Customer may raise substantiated data-protection objections within that period. Seek reasonable alternatives; if none exists, do not impose silent use and allow affected-service termination with unearned prepayment refunds/lawful switching. Emergency changes need real necessity, prompt notice and preservation of lawful rights.

Impose at least the same protection obligations by written contract, particularly sufficient measures, and remain fully liable to Customer for their performance under Article 28(4). A processor Customer obtains its controller's approval. Controller suppliers are separately recorded, not automatically customer subprocessors.

Every transfer/remote access outside the EEA needs Annex C recording and a Chapter V mechanism. Where SCCs are needed complete actual parties, Module 2 or 3 as appropriate, annexes, competent authority and supplementary safeguards/assessment. Do not incompatibly amend SCCs or replace them with this DPA. An EU region does not establish absence of third-country access. Assess binding authority requests, challenge where lawfully justified and notify where permitted; we do not guarantee that no lawful request will be executed.

Assist Customer through suitable technical/organisational measures, insofar as possible, with Chapter III. Forward customer-data requests without undue delay to [CUSTOMER_PRIVACY_CONTACT]. Do not give substantive answers without instructions except our own legal duties. Supply location/export/correction/erasure information and implement instructions across production, backups and restores with documented exceptions. The one-month rights deadline is not permission for us to delay for a month.

Notify Customer without undue delay after awareness of a customer personal data breach at [CUSTOMER_SECURITY_CONTACT] through a secure channel. Do not wait 72 hours or for a completed investigation. Provide nature, categories/approximate numbers of people/records, contact, likely effects, measures and phased updates. Preserve evidence, contain the incident and assist risk assessment and authority/individual notifications. The controller's 72-hour rule does not delay our notice. Do not announce on Customer's behalf without instructions unless law requires it.

Considering processing nature and available information, assist Articles 32–36, DPIAs and prior consultation. Reasonable disclosed costs may be agreed for additional bespoke help without obstructing mandatory help, urgent deadlines or remediation of our breach. Complete [ASSISTANCE_PRICING]; exercising rights cannot depend on an expensive subscription.

Provide all necessary Article 28 compliance information and allow/contribute to audits, including inspections by Customer or its mandated auditor. Start with available recent evidence where sufficient. Reasonable notice, confidentiality and other-tenant protection cannot defeat genuine audit, urgent investigation or regulator access. No blanket annual limit overrides lawful need. Complete [AUDIT_CONTACT_AND_COST] proportionately, without fees for our proven breach.

At Customer's choice after processing services end, return or erase data and delete existing copies unless EU/Member State law requires storage. Record lawful exceptions by provision, category, duration and restricted access. Data Act retrieval/export rights precede scheduled final erasure. Agree formats/timing in [SERVICE_RETURN_ERASURE_SCHEDULE], separately from account deactivation.

Current blocker: B2 versions have 45-day COMPLIANCE locks; manifests reconnect them to tenants/objects. A chosen technical lock is not itself legally required retention. A lawful/technical solution or specific assessment is needed before signing; customer consent alone cannot waive individuals' rights. Proposed controls: isolation from ordinary use, erasure at the first lawful/technically available point, documented maximum periods/failures, pending-deletion records and reapplication before restored data returns to active use. Confirm completion and disclose limited residues/reasons. No promise of complete erasure within 45 days or an unimplemented reaper.

This DPA lasts while we process customer personal data; confidentiality/erasure/audit duties survive as needed. Main-agreement caps do not restrict Article 82 rights, mandatory liability or regulator powers. Changes are documented and must not incompatibly reduce protection. Complete date, authorised representatives, acceptance record and A/B/C before application: [DPA_EXECUTION].

Subject: provision of selected services. Nature: receiving, storing, organising, retrieving, transmitting, copying/backing up, recovering and erasing under instructions. Purpose: operating/protecting/supporting Customer's service. Duration: agreement, lawful switching/retrieval and completed retention/erasure schedule. Instructions do not include independent advertising or general AI training.

Customer completes [DATA_SUBJECTS_AND_CATEGORIES], controller contact and special-category/criminal/children's data. These are not permitted without assessing additional lawful conditions/safeguards. Attach actual projects/services and processing frequency [PROCESSING_DETAILS] to the order.

Proposed minimum contract baseline for owner verification: authentication/least privilege and tenant isolation, protected transmission, appropriate secrets/key management, restricted staff access, logs without unnecessary payloads, patch/change management, incident handling, backups with verified recovery, periodic effectiveness assessment and minimisation/deletion. Complete owner, scope, evidence, review frequency and recovery for each control in [SECURITY_CONTROL_REGISTER].

Available evidence: self-hosted FSN1 production, source account-vault encryption and Auth identity/session revocation. These do not prove MFA for every administrator, universal at-rest encryption, all effective role checks, all backup/restore tests or RPO/RTO. B2 SSE/default encryption is unknown. Raw IP/user agents, query SQL and indefinite journals require minimisation/retention controls. Fresh redacted evidence is needed before signing; this drafting task is not a live audit.

This is a candidate register based on confirmed operations/uncertainties, not a complete approved subprocessor list. Each actual subprocessor needs exact legal entity, service, customer data, all processing/access countries, DPA/transfer mechanism and authorisation date. Unknown entries grant no authorisation.

Self-hosted Ory/ClickHouse/Yugabyte/Ceph are not outside subprocessors simply by software name. Google/Azure/AWS/Vercel/Netlify/DigitalOcean are comparison sources, not established current Meteorack subprocessors. Customer-contracted services require its own role mapping. [FINAL_SUBPROCESSOR_REGISTER] remains a blocker.