# Data Processing Agreement (DPA)

Version: **2026-10-24.v2**

## 1. Parties and subject

**Customer:** the natural or legal person identified in the electronic execution record. That record contains name/legal entity, address, account, authorised representative and privacy contact and accompanies this DPA.

**Processor:** ideployed UG (haftungsbeschränkt), Torgauer Straße 231–233, 04347 Leipzig, Germany; managing director Hamid Wakili; Leipzig commercial register HRB 45472; contact legal@ideployed.com.

This DPA specifies processing of personal data under the agreed hosting and deployment services. The Customer is a controller or duly authorised processor. In the latter case, it confirms necessary instruction and subprocessing authority, and iDeployed acts as a further processor. The annexes form part of the agreement. This DPA prevails over conflicting service terms concerning data protection, without overriding applicable standard contractual clauses.

iDeployed's own processing, including account-contract administration and its own legal obligations, does not become processor activity solely because of this DPA; the Application Privacy Notice and relevant legal basis govern it.

## 2. Duration, scope and instructions

Processing begins upon effective engagement and continues for the service and agreed return/deletion phase. Nature, purpose, data types and data subjects appear in Annex A. The Customer remains responsible for lawfulness, notices and lawful instructions.

iDeployed processes only on documented instructions, including transfers to third countries, unless Union or Member State law requires processing. In that case it informs the Customer beforehand of the legal requirement unless prohibited on important public-interest grounds. The contract, approved configuration and authenticated resource actions constitute instructions where their scope is clear. Additional instructions are recorded in text; identity and authority are checked.

If iDeployed considers an instruction to infringe data-protection law, it promptly informs the Customer and suspends the affected part as necessary pending clarification. It does not use entrusted data for its own advertising, sale or training its own general-purpose AI models. Any independent purpose requires its own lawful basis and must not circumvent the agreed obligations.

## 3. Confidentiality, access and security

iDeployed ensures authorised personnel are bound by confidentiality or an appropriate statutory duty. Access is limited to necessary, authorised persons. Instructions, permissions and material processing actions are appropriately traceable.

iDeployed implements suitable GDPR Article 32 measures considering risk, state of the art and implementation cost. Annex B sets out the technical measures and organisational obligations. Measures may evolve provided the agreed protection is not reduced; material changes are documented.

## 4. Subprocessors and transfers

By concluding this DPA, the Customer gives general written authorisation for the subprocessors identified in the incorporated version of Annex C, limited to the listed activities. Actual engagement requires the necessary contractual terms and lawful transfer arrangements; naming a service alone does not establish those prerequisites. iDeployed imposes substantively equivalent data-protection obligations on subprocessors and remains responsible to the Customer for their performance under GDPR Article 28.

iDeployed gives at least 30 days' advance notice before adding or replacing a subprocessor, allowing reasoned objections on data-protection grounds. Notices, objections and their handling are documented. The parties assess appropriate remedies or alternatives; if no lawful solution is possible, the affected service is ended in an orderly way without diminishing other rights. Emergency changes must not remove statutory notice and objection rights. 

Processing outside the EU/EEA requires documented instructions and compliance with GDPR Chapter V. iDeployed discloses recipients, countries and applicable safeguards and supports necessary transfer assessments. Vendor claims of “GDPR compliance” are not substitutes. Unlawful governmental access requests are assessed and challenged where appropriate under applicable law; the Customer is informed where legally permitted.

## 5. Assistance and personal-data breaches

iDeployed assists through suitable technical and organisational measures with data-subject rights, security, breach notifications, impact assessments and prior consultation, considering the processing and information available. Requests received directly about entrusted data are forwarded promptly; responses to data subjects require instructions or a legal duty.

iDeployed notifies the Customer without undue delay after becoming aware of a personal-data breach affecting entrusted data. As available, the notice describes its nature and scope, categories and approximate numbers affected, contact point, likely consequences and measures taken or proposed. Missing information follows without undue delay; the first notice does not await a complete investigation. iDeployed documents the incident and assists containment and remediation.

This does not permit a 72-hour waiting period: a controller's statutory deadline for notifying an authority differs from a processor's duty to notify without undue delay. 

## 6. Evidence and audits

iDeployed provides information necessary to demonstrate compliance and enables reasonable audits, including inspections by the Customer or an independent auditor it appoints. Suitable existing evidence may simplify an audit; unavailable certifications are not presumed.

Scope, confidentiality and protection of other customers are reasonably coordinated. Notice periods must not obstruct urgent incident or regulatory reviews. Separate charges require prior agreement and must not render statutory audit or assistance rights ineffective. Unlawful audit-related instructions are handled under section 2.

## 7. Return, deletion and termination

After processing ends, iDeployed returns or deletes entrusted personal data at the Customer's choice and removes existing copies unless law requires retention. Annex A defines format, delivery method and timing. iDeployed confirms completed deletion appropriately.

Required statutory retention is documented by reason and duration, and data is restricted from further unrelated processing. Technical backup remnants follow a binding overwrite/deletion cycle, must not be actively reused and must have deletion instructions reapplied after restoration. An indefinite operator protection hold is not a legal basis. For general volumes, iDeployed funds 30 calendar days of retrieval access from the day after the associated storage service effectively ends, but not before the day after notice of the start and deletion date is received. Any legally required longer retrieval period remains funded unless paid storage is separately expressly agreed. Terms section 6 explains advance termination notice and continuing storage services. The notified, finite return/deletion process must respect the Customer's choice and applicable return/switching periods; specifically justified exceptions require documented review.

Account deletion alone is not necessarily complete resource deletion. The parties must clearly identify remaining data, return needs and lawful deletion instructions. JTL periods must not shorten mandatory return, privacy or switching rights. 

## 8. Contacts, precedence and execution

Each party's privacy and instruction contacts are recorded. Amendments are agreed in text; required subprocessor notices follow section 4. Liability follows lawful agreements and mandatory privacy law, particularly GDPR Article 82; internal responsibility allocation does not restrict data subjects' rights.

This DPA is concluded by express electronic acceptance before processing on the Customer's behalf. The accepting person confirms their authority. The execution record identifies both parties, the account, date and time, chosen language and versions of this DPA and every annex. The Customer receives a durably saveable copy including that record. Acceptance is not data-subject consent and does not replace the Customer's own legal basis. Publishing a DPA alone neither concludes a contract nor retrospectively authorises earlier processing.

## Annex A – Processing description

| Item | Processing description |
| --- | --- |
| Subject and purpose | Hosting and technical provision of Customer-selected applications, containers, source builds, databases and persistent data; technical troubleshooting and recovery as agreed. |
| Operations | Receipt, transmission, storage, technical copying/execution, access by authorised users, logging, agreed return and deletion. Customer-volume backups only if expressly engaged. |
| Data subjects | Depending on the application: customers, prospects, shop visitors, staff, business partners, users and repository contributors of the Customer. |
| Data types | Contact/identity details, user identifiers, application contents, order/delivery information, communications and usage data, technical identifiers and logs; source code may contain personal data. Scope is limited by the actual application and instructions. |
| Excluded default use | Article 9 special-category data, Article 10 criminal-conviction data and full payment-card data are not part of the standard engagement without prior suitability assessment and express agreement. |
| Locations | Primary hosting environment in France; other recipients, assistance and third-country activity follow Annex C and section 4. |
| Duration and return | Engagement and retrieval/deletion phase under section 7. Return covers Customer-provided data and associated exportable metadata insofar as legally returnable and still held. Application data is supplied in its existing native format or a suitable archive, supported databases as a logical export, and available exportable configurations/metadata in a commonly used machine-readable format. Arrange the particular secure transfer method with support@ideployed.com; credentials are not sent in unencrypted support email. Data no longer held need not be reconstructed. Statutory retrieval and switching periods remain unaffected. |
| JTL evaluation restriction | The initial JTL offer permits synthetic shop data only, with no production customer/staff records or live orders. The broader general-platform data categories above do not authorise such use in that offer. Necessary operator account/contact data follows the Privacy Notice. Accidental personal-data uploads still require lawful handling. |

## Annex B – Technical and organisational measures

These measures concern the platform service operated by iDeployed. Individual application configurations and additional requirements are agreed separately. This description does not promise certification, full end-to-end encryption or blanket encryption of every disk and backup.

| Area | Measures and boundaries |
| --- | --- |
| Identity and access | Password hashing, opaque sessions, optional multi-factor authentication and account-scoped authorisation checks. Access rights must be limited to necessary persons and tasks and removed when authority ends. |
| Separation | Separate application resources, network rules and authorisation checks; JTL database connectivity is not publicly exposed. This does not replace secure configuration of the Customer's application. |
| Transmission and secrets | HTTPS for public platform access; encrypted storage of selected authentication secrets. The intended Slack event format sends no passwords, registry credentials or raw application logs. |
| Traceability | Audit and operational history and limited technical event information. Certain network identifiers are hashed; this does not promise anonymity. |
| Availability and recovery | Health/readiness checks, persistent volumes where ordered and nightly platform-database backups. Configured 30-day rotation is not currently a guaranteed maximum because object expiry is delayed. Customer-volume backups and fixed recovery times are not included by default. |
| Retrieval and deletion | Authorisation and dependency checks before resource actions; documented association with the retrieval/deletion instruction and confirmation after execution. Backup remnants are purpose-restricted; deletion instructions must be reapplied after restoration. Periods and exceptions follow section 7 and the Privacy Notice. |
| Organisation and notifications | Responsible function for privacy, instructions and legal enquiries: legal@ideployed.com. Technical support and security reports: support@ideployed.com. Authorised persons are bound to confidentiality; incidents and data-subject requests are recorded and handled under section 5. No guaranteed round-the-clock staffing or contractual response time; mandatory deadlines and breach notification without undue delay remain applicable. |

## Annex C – Subprocessors

The version of the [Provider and Subprocessor Register](05-subprocessors.md) identified in the execution record is incorporated. Its sections 1 and 2 distinguish processing on the Customer's behalf from our own account administration. Supporting services are subprocessors only insofar as they actually process entrusted data. This does not replace the Customer's own agreement with GitHub or a registry.