This Data Processing Agreement ("DPA") is entered into between you, acting as data controller ("Controller"), and Octagon Solutions LLC, Florida, USA ("Processor"), and forms an integral part of the OctaDeploy Terms of Service. Where you use OctaDeploy to host applications that process personal data of third parties (your end users), this DPA governs that processing.

1. Definitions

"Personal Data", "Data Subject", "Processing", "Controller", "Processor", "Sub-processor", and "Supervisory Authority" have the meanings ascribed to them in the EU General Data Protection Regulation (GDPR) 2016/679.

2. Details of Processing

• Categories of data subjects: End users and visitors of the Controller's applications deployed on OctaDeploy
• Types of personal data: Any personal data submitted by end users to the Controller's applications; OctaDeploy does not prescribe or know the categories — the Controller determines what data its application collects
• Purpose and nature of processing: Providing compute, storage, networking, and related infrastructure hosting services for the Controller's applications
• Duration of processing: For the term of the service agreement plus 30 days after termination

3. Controller's Obligations

The Controller shall ensure that: (a) it has a lawful basis for processing the personal data it transmits to the Processor's infrastructure; (b) data subjects have been informed of the processing as required by GDPR; (c) any instructions given to the Processor are lawful; (d) it has implemented appropriate security measures on its application layer.

4. Processor's Obligations

The Processor shall:

• Process personal data only on documented instructions from the Controller (the deployment and operation of the Controller's application constitutes such instructions)
• Ensure that persons authorised to process personal data are bound by confidentiality obligations
• Implement and maintain appropriate technical and organisational security measures (see Section 7)
• Assist the Controller in fulfilling its obligations to data subjects (Art. 15–21 GDPR) within 5 business days of a written request, to the extent technically feasible
• Notify the Controller promptly if, in the Processor's opinion, an instruction infringes applicable data protection law
• Delete or return all personal data upon termination as requested by the Controller, and provide written confirmation
• Make available all information reasonably necessary to demonstrate compliance with this DPA

5. Sub-processors

The Controller provides general authorisation for the Processor to engage the following sub-processors:

• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany — dedicated server infrastructure (EU)

The Processor will inform the Controller by email at least 30 days in advance of any intended addition or replacement of sub-processors, giving the Controller the opportunity to object. If the Controller objects on reasonable data protection grounds and the parties cannot resolve the matter, the Controller may terminate the agreement with 30 days written notice.

6. International Data Transfers

Where personal data is transferred from the EU/EEA to the USA (the Processor's country of incorporation), such transfers are governed by Standard Contractual Clauses pursuant to Commission Implementing Decision (EU) 2021/914, Module 2 (Controller to Processor). The SCCs are incorporated into this DPA by reference. The Processor will provide a signed copy upon written request. For transfers to Hetzner (Germany), no international transfer instrument is required as Germany is an EU member state.

7. Technical & Organisational Security Measures

The Processor maintains the following measures at the time of this DPA, subject to ongoing improvement:

• Encryption in transit: TLS 1.2 or higher for all connections to and from deployed applications
• Isolation: Each application runs in an isolated Docker container; applications cannot access each other's filesystems or networks
• Access control: Role-based access; server access restricted to authorised personnel; SSH key-based authentication only
• Patch management: Regular security patches applied to underlying OS and runtime dependencies
• Incident response: Documented incident detection and response procedure
• Backups: Available as a paid add-on; not enabled by default on all plans

8. Personal Data Breach Notification

The Processor shall notify the Controller without undue delay and in any event within 72 hours of becoming aware of a personal data breach affecting the Controller's data. The notification shall include: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address the breach.

9. Data Subject Rights Assistance

The Processor shall assist the Controller in responding to data subject requests (access, rectification, erasure, restriction, portability, objection — Art. 15–21 GDPR) within 5 business days of a written request from the Controller. Assistance is limited to what is technically feasible given the Processor's infrastructure role.

10. Audit Rights

Upon 30 days written notice and no more than once per calendar year (unless mandated by a Supervisory Authority), the Controller may request: (a) completion of a security questionnaire; (b) access to relevant audit logs and documentation. Physical on-site audits may be arranged by agreement, subject to reasonable advance notice and confidentiality undertakings.

11. Termination

Upon termination of the service agreement, the Processor shall delete all personal data of the Controller's end users within 30 days, unless retention is required by applicable law, and shall provide written confirmation of deletion. The Controller may request return of data in a machine-readable format before deletion.

12. Liability

Each party's liability under this DPA is subject to the limitations and exclusions set out in the Terms of Service. Nothing in this DPA shall limit either party's liability for breach of obligations under applicable data protection law.

13. Contact