Data processing addendum

1.1 Part of the terms

This addendum forms part of our terms of service, as section 1.6 of the terms says. You accept it when you accept the terms. It applies to every organisation on Drasken Cloud; you do not need to sign anything.

If you need a signed copy, write to legal@draskencloud.com. We countersign this same text and send it to you as a PDF. [DPA1]

1.2 What it covers

This addendum covers personal data in your content: personal data about other people that you or your users put into apps, jobs, databases, volumes, backups, logs, environment values and domain names on Drasken Cloud. Your own customers and users are typical examples.

It does not cover personal data about you and your members that we use to run your account, bill you and support you. For that data we are the Data Fiduciary, and our privacy policy explains how we handle it.

1.3 Our roles

For personal data in your content, you are the Data Fiduciary and we are your Data Processor. You decide why and how it is used; we process it on your behalf. If you are yourself processing the data for someone else, you are responsible for passing these commitments on to them, and we act on your instructions as if they were theirs.

1.4 The law it follows

This addendum is the contract that the Digital Personal Data Protection Act, 2023 asks a Data Fiduciary to have with its Data Processor. It applies from the day you accept it, whether or not each duty under that Act and its Rules has come into force yet. Until it has, the Information Technology Act, 2000 and the rules made under it also apply, including the rules on reasonable security practices of 2011.

3.1 Only on your instructions

We process customer personal data only on your documented instructions. Your instructions are:

• •the terms, this addendum and the other documents in section 1.6 of the terms;
• •what you and your members do in the console, such as creating, changing, backing up, restoring and deleting resources, and the settings you choose;
• •other instructions you give us in writing that we agree to, for example in a support request.

We do not use customer personal data for our own purposes, sell it, or use it to profile people or to advertise. We may use information about how the service is used, such as counts, sizes and errors, but not the contents of your content, as section 5.4 of the terms describes.

If the law makes us process customer personal data in another way, we tell you first, unless the law forbids it (section 10). If we believe an instruction breaks data protection law, we tell you, and we may decline to follow it until you confirm or change it.

3.2 Confidentiality

Only staff who need it to do their work can reach customer personal data. Everyone who works for us with that access, as an employee or contractor, is bound to keep it confidential, and stays bound after they leave.

Staff look at your content only for the reasons in section 4.3 of the terms. Those are to run the service, to help when you ask and give permission, to deal with abuse or a security incident, or when the law requires. They touch only what the task needs. Changes they make through our staff tools appear in your organisation's activity history, and we keep a record of each other access with its reason.

3.3 Security

We keep customer personal data secure with reasonable security safeguards, as the Act and the Rules ask. The measures in place today are in the Annex. Our privacy policy describes those for account data, and section 4.7 of the terms explains which parts of security are ours and which are yours.

We review these measures as Drasken Cloud grows. We may change them, but not in a way that lowers the overall protection of customer personal data. We do not claim any security or data-protection certification.

4.1 The list

You agree that we may use the sub-processors listed on our sub-processors page. It says what each one does and where it works. Today they are OVHcloud and Cloudflare for customer personal data, Amazon Web Services for the addresses you ask Drasken Uptime to check, and Let's Encrypt for domain names.

4.2 Our duties when we use them

We use a sub-processor only under a written contract that protects customer personal data at least as well as this addendum does, for the purposes on the list. We remain responsible to you for what our sub-processors do with it, as section 12.2 of the terms says.

4.3 Adding or replacing one

We update the sub-processors page at least 14 days before a new sub-processor starts processing customer personal data, and email the owners who have asked to hear about changes. [DPA2] In an emergency, for example to keep the service running when a provider fails, we may make the change sooner and tell you as soon as we can.

4.4 Your right to object

You may object to a new sub-processor on reasonable data protection grounds, by writing to privacy@draskencloud.com before the change takes effect. We will discuss it with you in good faith. If we cannot meet your objection, you may end the affected service, or the agreement, by notice to us. You pay only for what you used up to then, and we refund the unused days of any paid support plan. [DPA3]

5.1 Requests from data principals

The people whose data is in your content may use their rights under the Act: to see, correct, update or erase their data, to have a grievance heard, and to nominate someone. You answer those requests. Most of what you need you can do yourself, because you control your apps, databases and the data in them.

If one of those people writes to us, we pass the request to your organisation's owners within 5 business days and tell the person we have done so. [DPA6] We do not answer it ourselves unless the law requires us to. Where you cannot do something yourself, we help as far as the service reasonably allows.

5.2 Other help

We give you the information we reasonably have, and that you cannot get from the console or our documentation, to help you:

• •keep your own records and answer the Board or another authority;
• •assess the risks of what you do with personal data;
• •meet your duties when a personal data breach happens (section 6).

This help is free when it is reasonable in scope.

5.3 Information to show we comply

When you ask in writing, we answer reasonable written questions about how we process customer personal data and keep it secure. We do so once a year, within 30 days. We also answer after a personal data breach, or when the Board or another authority asks you. You keep our answers confidential.

We do not accept audits or inspections on our premises or systems. [DPA5] This does not limit an audit or inspection that the law requires us to allow.

6.1 Telling you

If we become aware of a personal data breach that affects customer personal data, we tell your organisation's owners without undue delay. We aim to do so within 24 hours of confirming that the breach affects your data. [DPA4] We tell you by email and, where it helps, in the console.

6.2 What we tell you

So that you can inform the Board and each affected person, and send the Board your detailed report within 72 hours as the Rules ask, we tell you what we know about:

• •what happened, when it happened and when we found out;
• •which of your resources, which kinds of personal data and roughly how many people are affected;
• •the likely consequences;
• •what we have done and will do to contain it and stop it happening again;
• •what you can do, for example rotate a password or check an app;
• •who to contact at Drasken Cloud.

If we do not know everything at first, we tell you what we know and send more as we learn it.

6.3 Who notifies whom

You decide whether and how to notify the Board and the people affected, because you are the Data Fiduciary. We do not notify them for you unless you ask us to and we agree, or the law requires us to. We report cyber security incidents to the Indian Computer Emergency Response Team (CERT-In) within the time the law sets, as section 4.11 of the terms says.

Telling you about a breach is not an admission of fault or liability.

7.1 Taking your data

You can copy customer personal data out of Drasken Cloud yourself at any time, for example with your database engine's own export tools. When the agreement ends, the 30-day export period in section 8.7 of the terms gives your owners time to sign in and take copies, including your backups. If a fault on our side stops you, we help you take them.

7.2 Deleting it

After the export period, we delete customer personal data as section 8.7 of the terms says. We delete it from the service within a further 30 days. Copies in backups go when their retention ends, and in any case within 35 days after the export period ends. When you delete a resource during the agreement, its data is deleted as section 4.6 of the terms says.

We keep a copy only where the law makes us, for example content we removed under an order or a complaint, which Indian law makes us keep for at least 180 days. Such a copy is used for nothing else, and is deleted when the law no longer requires it. On request, we confirm the deletion to you in writing.

8.1 A lawful basis and notices

You are responsible for having a lawful basis, such as consent, for the personal data you put on Drasken Cloud. You also give the people it is about the notices the law asks for, answer their requests, and decide how long you keep their data.

8.2 Lawful instructions

Your instructions to us must follow data protection law. You must not instruct us, or use Drasken Cloud, in a way that would make our processing unlawful.

8.3 Children's data

If your content holds personal data about children (anyone under 18), you must have the verifiable consent of a parent or lawful guardian where the Act requires it. You must not use Drasken Cloud to track or monitor children's behaviour, or to target advertising at them, where the Act forbids it. We do not know what data your content holds and do not check it.

8.4 Sensitive data

Some data deserves more care, such as passwords, financial details, health information and biometric data. If you store it on Drasken Cloud, you choose to, and you decide whether the measures in the Annex, with the ones you add yourself, are enough for it. We do not offer extra measures for particular kinds of data.

8.5 Your own security

You remain responsible for your part of security under section 4.7 of the terms. That includes your apps, your database users and passwords, who you invite, and keeping your own copies of data you cannot afford to lose.

11.1 Liability

Each party's liability under this addendum is subject to section 9 of the terms, including the limits in 9.3, which cover claims under the terms and this addendum together. Nothing in this addendum or the terms limits liability that data protection law does not allow to be limited (9.4).

11.2 How long it lasts

This addendum applies for as long as we process customer personal data for you: for the life of the agreement, through the export period, and until we have deleted that data under section 7. Its duties on confidentiality, deletion and copies the law makes us keep continue after that.

11.3 Which document wins

If this addendum and the terms disagree about how we process personal data, this addendum wins on that point, as section 1.6 of the terms says. A written agreement that you and we have both signed wins over both.

11.4 Changes

We change this addendum in the same way as the terms, and give the same notice for a change that reduces your rights (section 11 of the terms). We do not change it to lower the protection of customer personal data unless the law requires it.

12.1 The processing

12.2 Security measures in place today