Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service and applies when bashrack processes personal data on your behalf as part of your workloads: data stored in or passing through your servers, applications, databases, backups, and support attachments ("Customer Data"). You are the controller (or a processor acting for your controller) and bashrack is your processor. Account, billing, and security data about you is covered by our Privacy Policy instead.

The subject matter is hosting and operating the Services you order, for their duration. Categories of data subjects and personal data are those you choose to process; we do not monitor them. Do not place special-category or criminal-offence data in the Services unless your own safeguards make that lawful.

We process Customer Data only on your documented instructions, which consist of the Terms, this DPA, and your configuration and use of the Services, unless the law requires otherwise; in that case we inform you before processing unless the law prohibits it. We tell you if we believe an instruction infringes data-protection law.

Persons authorized to process Customer Data are bound by confidentiality. We do not access the content of your workloads except to provide support you request, to investigate abuse or security incidents, to maintain the Services, or to comply with law.

We maintain technical and organizational measures appropriate to the risk, including separation of customer workloads, role-based staff access, encryption in transit for our websites and APIs, encryption of selected account fields, audit logging, and monitoring. You are responsible for securing what runs inside your resources, including operating systems, applications, credentials, encryption of your data, and backups.

You authorize bashrack to engage sub-processors in these categories: data-center, infrastructure, and hardware providers that host the Services; storage providers for backups and support attachments; and network, security, and email delivery providers. We impose data-protection obligations on them equivalent in substance to this DPA and remain responsible for their performance. We announce new categories by updating this page; you may object on reasonable data-protection grounds within 14 days by contacting us, and if we cannot resolve the objection you may terminate the affected Services.

Where Customer Data is transferred to a country without an adequacy decision and the law requires safeguards, we rely on standard contractual clauses or another lawful transfer mechanism. You choose the location of the resources you order.

You control your workloads and can access, correct, export, and delete Customer Data yourself. We forward requests we receive from your data subjects to you and, taking into account the nature of the processing, provide reasonable assistance with data subject requests, security, impact assessments, and consultations with authorities. Assistance beyond the standard Services may be charged at reasonable cost.

We notify you without undue delay after becoming aware of a personal data breach affecting Customer Data, with the information reasonably available to help you meet your own obligations, and we take reasonable steps to contain it.

When you terminate a resource, its Customer Data is deleted as part of termination, and remaining copies in backups are deleted as those backups rotate or expire. Export what you need before terminating. We may retain Customer Data where the law requires it.

We make available the information reasonably necessary to demonstrate compliance with this DPA on request to [email protected]. Further audits or inspections, including by an auditor you appoint who is bound by confidentiality, take place on reasonable notice, during business hours, no more than once a year unless an authority requires otherwise, and at your cost.

Liability under this DPA is subject to the limitations in the Terms of Service, except where the law does not allow them. If this DPA conflicts with the Terms regarding Customer Data, this DPA prevails.