Data processing agreement

This Data processing agreement ("DPA") forms part of the Terms of service between Deplium ("Deplium") and the Customer. For billing and usage metadata that Deplium receives from Providers and processes to produce statements, dashboards and alerts, the Customer is controller and Deplium is processor. For account data of the Customer's users and for Deplium's own accounting records, Deplium is an independent controller under its Privacy policy.

Deplium processes personal data contained in Provider billing and usage metadata (for example account identifiers, resource tags and the names or email addresses of Provider account holders) for the duration of the Terms and only to provide the Service: consolidating statements, allocating cost, detecting anomalies and answering support requests.

Deplium processes personal data only on the Customer's documented instructions, which are the Terms, this DPA and the settings the Customer chooses in the dashboard, unless EU or member state law requires otherwise, in which case Deplium informs the Customer before processing where the law allows.

Deplium ensures that staff with access to personal data are bound by confidentiality. Deplium applies technical and organisational measures appropriate to the risk, including: encryption in transit and at rest; hashed credentials; role-based access with multi-factor authentication for staff; least-privilege access to Provider billing data; audit logging of staff actions; segregated production and development environments; regular dependency and vulnerability updates; and documented incident response.

The Customer authorises the sub-processors listed on the Sub-processors page. Deplium imposes data protection obligations on each sub-processor by written agreement and remains liable for their performance. Deplium announces new or replaced sub-processors by email to workspace owners at least 30 days before they process Customer data. The Customer may object on reasonable data protection grounds within that period; if the parties cannot resolve the objection, the Customer may terminate the affected part of the Service without penalty.

Taking into account the nature of the processing, Deplium assists the Customer with data subject requests, security of processing, breach notification, data protection impact assessments and prior consultation. Deplium notifies the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer data, with the information available at that time.

Where processing involves a transfer outside the European Economic Area, the parties rely on the Standard Contractual Clauses (Commission Decision 2021/914, Module Two or Three as applicable) incorporated by reference, with the UK Addendum where UK data is involved, and any additional safeguards documented on the Sub-processors page.

At the end of the Service, Deplium deletes or returns personal data within 30 days at the Customer's choice, except for records Deplium must keep under law, which remain protected under this DPA until deleted.

Deplium makes available the information needed to demonstrate compliance with this DPA, including summaries of third-party reports of its sub-processors. Once per year, on 30 days' notice and at the Customer's cost, the Customer or an independent auditor bound by confidentiality may audit Deplium's compliance during business hours without disrupting operations.

Liability under this DPA is subject to the limitations in the Terms of service. This DPA is governed by the same law and courts as the Terms.