Data Processing Agreement (DPA)

1. Parties and scope

This Data Processing Agreement ("DPA") is entered into between Nodesty LLC ("Processor") and the customer who accepts the Terms of Service ("Controller"), and forms an integral part of the Terms of Service.

The DPA applies where the Controller hosts or processes, on the services, personal data subject to the GDPR, the UK GDPR, the Swiss Federal Act on Data Protection or the KVKK. If it conflicts with the Terms of Service on data protection, the DPA prevails.

2. Definitions

"Customer Data" means personal data that the Controller hosts, transmits or processes on the services. Terms such as "personal data", "processing", "controller", "processor" and "personal data breach" have the meaning given in the applicable data protection law.

3. Details of processing

• Subject matter: providing hosting services such as virtual servers, dedicated servers, web hosting and mail hosting.
• Duration: the term of the services and, after they end, until deletion is complete.
• Nature: storage, hosting, transmission over the network, backup and technical support.
• Purpose: providing the services under the Terms of Service.
• Types of data: determined by the Controller; any personal data the Controller uploads to the services.
• Data subjects: determined by the Controller; for example the Controller's customers, users and employees.

4. Instructions

The Processor processes Customer Data only on the Controller's documented instructions. The Terms of Service, this DPA and the actions the Controller takes through the customer panel, the API or support channels count as instructions.

The Processor does not access the content of Customer Data except for a support request from the Controller, to resolve a security incident or under a legal obligation. If it believes an instruction infringes data protection law, it informs the Controller immediately.

5. Confidentiality

The Processor ensures that the people it authorises to access Customer Data are bound by contractual or statutory confidentiality, and limits access to those who need it for their work.

6. Security measures

In line with GDPR Article 32 and KVKK Article 12, the Processor applies at least the following measures:

• Physically secured data centers and redundant network infrastructure.
• DDoS protection and network-level traffic filtering.
• Role-based access to management systems, two-factor authentication and access logs.
• TLS encryption of customer panel and API traffic.
• Security logging and incident monitoring.

On unmanaged services, the operating system, applications, credentials and backups of Customer Data are the Controller's responsibility.

7. Sub-processors

The Controller gives the Processor general written authorisation to engage the providers listed on the Sub-processors page. The Processor updates the list at least 30 days before adding a new sub-processor.

Within that period, the Controller may object on reasonable data protection grounds by writing to privacy@nodesty.com. If the parties cannot reach a reasonable solution, the Controller may terminate the affected service and receive a refund of prepaid fees for the unused period.

The Processor imposes obligations on sub-processors equivalent to those in this DPA and remains liable to the Controller for their failure to meet them.

8. Data subject requests

The Processor reasonably assists the Controller, through the customer panel and support channels, in responding to data subjects exercising their rights. If the Processor receives a request directly, it forwards it to the Controller without answering it.

9. Personal data breaches

The Processor notifies the Controller without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Data. The notice describes, as far as known at the time, the nature of the breach, the categories of data affected, its likely consequences and the measures taken or proposed.

10. Impact assessments and consultation

The Processor reasonably provides the information the Controller needs for data protection impact assessments and prior consultation with supervisory authorities.

11. Deletion or return

The Controller is responsible for exporting Customer Data before the service ends. After the service ends, the servers and storage holding Customer Data are deleted. Data that must be kept by law is kept for as long as that obligation lasts.

12. Information and audits

The Processor provides on request the information needed to demonstrate compliance with this DPA. The Controller may carry out an audit at most once a year, with 30 days' written notice, at its own cost and primarily by document review. Audits are carried out without harming the data or security of the Processor's other customers.

13. International transfers

• EEA: the Standard Contractual Clauses adopted by European Commission Decision 2021/914, Module 2 (controller to processor) and Module 3 (processor to processor), are incorporated into this DPA by reference. Clause 7 (docking) does not apply; for Clause 9 the general authorisation option with a 30-day period applies; the optional wording in Clause 11 does not apply. For Clauses 17 and 18, Irish law and the courts of Ireland apply. The annexes are deemed completed with the details of processing and security measures in this DPA.
• United Kingdom: the UK Information Commissioner's International Data Transfer Addendum (IDTA Addendum) is deemed added to the clauses above.
• Switzerland: the Standard Contractual Clauses apply with references read as references to the Swiss Federal Act on Data Protection.
• Turkey: the standard contract published by the Board under KVKK Article 9 is signed by the parties at the Controller's request.

14. Liability and term

The parties' liability under this DPA is subject to the limitations in the Terms of Service, but those limitations do not restrict data subjects' statutory rights. The DPA remains in force for as long as the Processor processes Customer Data.

15. Acceptance

Accepting the Terms of Service also means accepting this DPA. If you need a signed copy, write to privacy@nodesty.com with your company details.