Data processing agreement

1. Subject and duration

We process personal data on the customer’s behalf to provide InfraHarbour, for as long as the agreement for the service lasts and after that until the data has been deleted under section 12.

2. What is processed

• Data subjects: the customer’s users, and people whose data is held at the providers the customer connects (such as contacts in invoices or domain registrations).
• Data: names, email addresses, roles, sign-in data, logs with IP addresses and times, alert addresses, screenshots of sites and what the panel fetches from the customer’s providers.
• Purpose: to show, propose, approve and carry out changes to the customer’s infrastructure, monitor it and log what is done.

The customer chooses which providers are connected and so which data is fetched.

3. The customer’s responsibility

The customer is responsible for having a legal basis for all processing it has us carry out, for the data subjects having received the information they are entitled to, and for having the right to connect its providers and put the data in. The customer shall not put special categories of personal data into the service.

4. The customer’s instructions

The customer’s instructions are the agreement for the service, this agreement and what the customer does in the panel. Other instructions must be given in writing; if they require work beyond the service, we may charge for it. If we believe an instruction breaks data protection law, we say so and may hold off following it.

5. Confidentiality

Only those who need it to run the service have access to the data, and they are bound by confidentiality.

6. Security

We take appropriate technical and organisational measures, among them:

• Encryption of keys to providers (AES-256-GCM) and of all traffic (TLS).
• Passwords as salted hashes, passkeys and two-factor.
• Roles and per-domain access, and accounts kept apart.
• Approval before anything is written at a provider, and backups before and after every change.
• Logs of decisions and of calls made with agent keys.
• The database in Western Europe.

The customer is responsible for the security of what it controls itself: users, roles, keys and sign-ins.

7. Retention in the service

The service keeps data for these periods and then deletes it automatically:

• Decided proposals and the activity log: 90 days.
• The API log and calls to providers: 30 days.
• Uptime checks: 31 days.
• Zone backups: all of them for 30 days, then one a week up to 90 days and one a month up to a year.
• Search Console data: 490 days.
• Screenshots: the five latest per domain.
• Account, users, keys and settings: for as long as the account exists.

8. Sub-processors

The customer gives general authorisation for us to use sub-processors. Today they are:

• Cloudflare, Inc. — hosting, database (Western Europe), storage, email and protection.
• Resend, Inc. — sending alert emails.
• GitHub, Inc. — scheduled jobs for screenshots.

We impose equivalent data protection obligations on every sub-processor. New or changed sub-processors are announced at least 30 days in advance. If the customer objects on reasonable grounds and we cannot meet the objection, the customer’s sole remedy is to terminate the agreement for the service with effect from the day the change applies.

9. Transfers outside the EU/EEA

The sub-processors are US companies. Transfers to the US are based on the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses, which the customer hereby accepts.

10. Personal data breaches

We notify the customer without undue delay after becoming aware of a personal data breach affecting the customer’s data, with the information we have. It is the customer who notifies the supervisory authority and informs the data subjects, where required.

11. Assistance to the customer

Taking into account the nature of the processing, we assist the customer in answering data subjects’ requests and with impact assessments and prior consultations. Much of this the customer can do itself in the panel; we may charge for assistance beyond that.

12. When the agreement ends

Within 30 days after the agreement for the service has ended we delete the customer’s data, unless the law requires it to be kept. Until then the customer can export its zones. After that, the data cannot be restored.

13. Audits

We show that this agreement is followed primarily by providing written information. If that is not enough, the customer may, at most once a year and on at least 30 days’ written notice, have an independent auditor bound by confidentiality audit us during office hours. The audit is at the customer’s expense and must not disclose other customers’ data or endanger the security of the service.

14. Liability

The limitation of liability in the terms of service also applies to this agreement, as far as the law allows. The customer shall indemnify us against claims arising from the customer having had no legal basis for the processing or otherwise breaching data protection law.

15. Law and disputes

This agreement is governed by the law of Cyprus. Disputes shall be settled exclusively by the courts of Larnaca, Cyprus. This agreement is written in English. Translations are for convenience only, and if they differ the English text prevails.