Data Processing Agreement
Last updated: [DATE]
This Data Processing Agreement ("DPA") is part of our Terms of Service between the customer ("you", the controller) and [COMPANY NAME AND LEGAL FORM] ("we", the processor). It applies when we process personal data on your behalf under Article 28 of the GDPR.
1. What we process
| Subject matter | Providing Cloud Spend Guard to you. |
|---|---|
| Duration | As long as you use the Service, then until the data is deleted as set out below. |
| Nature and purpose | Reading, storing and displaying information about the resources and costs in your connected cloud accounts, and answering questions about it. |
| Types of personal data | Personal data that appears in resource names, tags and configuration in your cloud accounts, and the names and email addresses of members of your Workspace. |
| Data subjects | Your employees, contractors and other people whose data appears in your cloud accounts. |
2. Our obligations
- We process personal data only on your documented instructions, which are these terms and how you use the Service, unless the law requires otherwise. We will tell you if we think an instruction breaks the law.
- Everyone we allow to process the data is bound to confidentiality.
- We protect the data with the measures described on our Security page.
- We help you, as far as we reasonably can, to respond to data subjects' requests and to meet your obligations under Articles 32 to 36 of the GDPR.
- We notify you without undue delay, and within [48 HOURS], after becoming aware of a personal data breach affecting your data.
- We make available the information needed to show that we meet this DPA, and allow reasonable audits with advance notice, at your cost.
3. Subprocessors
You authorize the subprocessors on our Subprocessors page. We bind each of them to data protection obligations at least as strict as this DPA and remain responsible for them. We will tell you before adding or replacing one, and you can object. If we cannot resolve your objection, you can end the agreement.
4. International transfers
The Service runs in the United States. Transfers of personal data outside the European Economic Area are protected by the EU-U.S. Data Privacy Framework where the recipient is certified, and otherwise by the European Commission's Standard Contractual Clauses (Decision 2021/914), which are incorporated into this DPA by reference.
5. Deletion
When you delete a Connection or close your account, we delete the related personal data within [30 DAYS], unless the law requires us to keep it.