This Data Processing Agreement (“DPA”) is part of the Terms of Service between you (the “Customer”, as controller) and Terarium j.d.o.o., operator of Eigenflops (the “Processor”). It applies whenever Customer Data stored or processed with the Services contains personal data, and it meets the requirements of Article 28 of the GDPR.
1. Subject matter and duration
The Processor processes personal data only to provide the Services: hosting the Customer's containers and storage on GPU servers. Processing lasts for the duration of the Customer's Rentals.
2. Nature of processing, data and data subjects
The Processor stores and provides computing resources for Customer Data. The Processor does not decide which personal data the Customer stores, or whose. The types of personal data and categories of data subjects are determined by the Customer.
3. Processor's obligations
The Processor will:
- process personal data only on the Customer's documented instructions, which are these Terms and the Customer's use of the Services, unless EU or Croatian law requires otherwise;
- ensure that people authorised to process the data are bound by confidentiality;
- implement appropriate technical and organisational security measures under Article 32 GDPR, as described in section 6;
- use sub-processors only as described in section 5;
- help the Customer, as far as reasonably possible, to respond to data subject requests;
- help the Customer meet its obligations on security, breach notification and data protection impact assessments, taking into account the information available to the Processor;
- delete all Customer Data when a Rental ends, as set out in the Terms of Service;
- make available the information needed to show compliance with this DPA, and allow reasonable audits, with reasonable advance notice and at the Customer's cost.
4. Personal data breaches
The Processor will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Data, and provide the information the Customer reasonably needs to meet its own notification obligations.
5. Sub-processors
The Customer gives general authorisation for the Processor to use the data center operator where the servers are colocated in Zagreb, Croatia, EU, which provides the facility, power and network connectivity. The Processor will inform the Customer by email of any intended addition or replacement of sub-processors that process Customer Data, and the Customer may object on reasonable grounds. The Processor imposes data protection obligations on sub-processors equivalent to this DPA.
6. Security measures
- Servers are owned by the Processor and located in a data center certified to ISO/IEC 27001, 27017 and 27018.
- Each Rental runs in its own isolated container.
- Access to infrastructure is limited to authorised personnel.
- Customer identities are verified before access is granted.
- Customer Data is deleted at the end of each Rental.
The Customer is responsible for security inside its containers, including access credentials, software updates, encryption of stored data where needed, and backups.
7. Data location
Customer Data is stored and processed in Zagreb, Croatia, EU. The Processor does not transfer Customer Data outside the EU.
8. Liability and precedence
Liability under this DPA is governed by the Terms of Service. If this DPA conflicts with the Terms of Service on the processing of personal data, this DPA takes precedence.
9. Signed copy
If your organisation needs a signed copy of this DPA, email info@terarium.xyz.