Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the agreement between the customer identified in an order or Cloudlayer account (“Customer”) and the operator of cloudlayer.io identified in that order or account (“Cloudlayer”). It applies when Cloudlayer processes Customer Personal Data to provide the Service.

By accepting the Terms of Service or an order that references this DPA, each party enters this DPA for itself and, where applicable, its authorized affiliates. If the parties have signed a different data processing agreement for the same Service, that signed agreement controls.

1. Definitions

“Applicable Data Protection Law” means privacy and data-protection law that applies to the processing under the agreement, including the GDPR, UK GDPR, and applicable U.S. state comprehensive privacy laws.

“Customer Personal Data” means personal data contained in Customer Data that Cloudlayer processes on Customer’s behalf. “Controller,” “processor,” “data subject,” “personal data,” “processing,” and “supervisory authority” have the meanings given by Applicable Data Protection Law. “Service Provider” and “Contractor” have the meanings given by applicable U.S. state privacy law.

“GDPR” means Regulation (EU) 2016/679. “UK GDPR” means the GDPR as incorporated into UK law. “SCCs” means the European Commission standard contractual clauses adopted by Implementing Decision (EU) 2021/914. “UK Addendum” means the then-current International Data Transfer Addendum issued by the UK Information Commissioner.

“Security Incident” means a breach of security that leads to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data processed by Cloudlayer. It excludes unsuccessful attempts that do not compromise Customer Personal Data.

2. Roles and scope

Customer is the controller or a processor acting for another controller. Cloudlayer is a processor or subprocessor. For U.S. state privacy law, Cloudlayer acts as Customer’s Service Provider or Contractor for Customer Personal Data.

Customer determines the purposes and essential means of processing. Cloudlayer processes Customer Personal Data only to provide, secure, support, and maintain the Service; follow Customer’s documented instructions; meet the agreement; and comply with law. The agreement, Customer’s configuration and use, and support requests are documented instructions.

If Cloudlayer believes an instruction violates Applicable Data Protection Law, it will notify Customer unless prohibited by law and may pause the affected processing while the parties address it. If law requires Cloudlayer to process data outside Customer’s instructions, Cloudlayer will notify Customer before doing so unless the law prohibits notice.

Annex 1 describes the subject matter, duration, nature, purpose, data, and people. Processing continues for the agreement term and any limited return, deletion, backup, legal-hold, or transition period.

3. Customer responsibilities

Customer will:

• provide lawful, fair, and transparent instructions;
• have all rights, notices, lawful bases, permissions, and consents needed for Customer Personal Data and the configured workflow;
• limit data to what is adequate, relevant, and necessary;
• configure access, roles, sharing, authentication, retention, destinations, and integrations appropriately;
• respond to data subjects and regulators as controller, or help its controller do so;
• avoid submitting prohibited or unsupported regulated data; and
• notify Cloudlayer before an instruction requires a materially different security or legal scope.

The Service is not enabled for PHI or ePHI. This DPA is not a business associate agreement and does not authorize PHI or ePHI processing.

4. Confidentiality and personnel

Cloudlayer will ensure that people authorized to process Customer Personal Data are bound by confidentiality and receive access only as needed for their duties. Cloudlayer will provide appropriate privacy and security training for personnel with relevant access and will remove access when it is no longer needed.

5. Security

Cloudlayer will maintain technical and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, disclosure, or access. Annex 2 describes the measures for the Service. Cloudlayer may update them as technology and risk change, provided an update does not materially reduce overall protection during an active order.

Customer recognizes that security depends on the nature and scope of its use. Customer will use the available controls and will not expose credentials or direct the Service to an insecure destination.

6. Security Incidents

Cloudlayer will notify Customer without undue delay after confirming a Security Incident involving Customer Personal Data. Notice will include, as information becomes available, the nature of the incident; affected data and data subjects; likely consequences; measures taken or proposed; and a contact for follow-up.

Cloudlayer will investigate, mitigate, preserve appropriate evidence, and reasonably cooperate with Customer’s legally required assessment and notification. Cloudlayer’s notice is not an admission of fault or liability. Customer is responsible for notices to controllers, data subjects, and authorities unless law assigns that duty directly to Cloudlayer.

7. Data-subject requests

Taking into account the nature of processing, Cloudlayer will provide reasonable technical and organizational assistance for Customer to respond to requests to access, correct, delete, restrict, object, or port Customer Personal Data.

If Cloudlayer receives a request relating to Customer Personal Data, it will direct the requester to Customer and notify Customer where permitted. Cloudlayer will not independently fulfill the request unless Customer instructs it or law requires it. Customer is responsible for verifying the requester and deciding how to respond.

8. Compliance assistance

Taking into account the nature of processing and information available to Cloudlayer, Cloudlayer will reasonably assist Customer with data-protection impact assessments, prior consultations, records of processing, security obligations, and regulator inquiries that concern the Service. Assistance beyond standard documentation and product controls may be subject to reasonable fees when the need was not caused by Cloudlayer’s breach.

9. Subprocessors

Customer gives general authorization for Cloudlayer to use subprocessors to provide the Service. The maintained Subprocessor List identifies Cloudlayer-appointed subprocessors and their roles.

Cloudlayer will impose written data-protection obligations on each subprocessor that are no less protective in substance for the processing delegated to it. Cloudlayer remains responsible for the subprocessor’s performance of those obligations to the extent required by law and this DPA.

Cloudlayer will provide advance notice of a new subprocessor before it begins processing Customer Personal Data. Customer may object during the notice period on reasonable data-protection grounds. The parties will work in good faith on a commercially reasonable alternative. If no reasonable alternative is available, Customer may terminate the affected Service before the new subprocessor begins processing and receive a prorated refund of prepaid fees for the unused period. This is Customer’s exclusive remedy for a subprocessor objection.

Customer-directed storage, webhooks, integrations, recipients, and other destinations are not Cloudlayer-appointed subprocessors. Customer is responsible for its relationship, instructions, security, region, and transfer mechanism with them.

10. Audits and information

Cloudlayer will make available information reasonably necessary to demonstrate compliance with this DPA, including relevant security documentation, summaries, questionnaires, and independent assessment reports if available. No reference to an assessment means that Cloudlayer has obtained a certification or attestation unless the Security page expressly identifies the report and scope.

If the information provided is insufficient for a specific legal requirement, Customer may request one audit per year by an independent auditor bound by confidentiality. Additional audits are permitted after a Security Incident or when a regulator requires one. An audit must use reasonable advance notice, avoid access to other customers’ data or systems, minimize disruption, follow security requirements, and occur during normal business hours. Customer bears its costs unless the audit finds a material Cloudlayer breach.

Cloudlayer may satisfy an audit request through a recent independent report when the report reasonably covers the requested controls. Neither Customer nor its auditor may conduct penetration testing without written authorization.

11. Return and deletion

During the agreement, Customer may export Customer Personal Data using available product controls and APIs. After termination or an authenticated deletion instruction, Cloudlayer will delete or return Customer Personal Data as provided by the Service and Customer’s instruction, unless law requires retention.

Deletion from backups occurs through the backup lifecycle. Until deletion, retained data remains protected and is used only for recovery, legal, security, or compliance purposes. Cloudlayer may retain billing, security, audit, and dispute records that it controls under the Privacy Notice. De-identified data may be retained when it cannot reasonably be linked to a person.

12. International transfers

Customer authorizes processing in the countries disclosed in the Subprocessor List. When Customer Personal Data protected by the GDPR is transferred to a country without an applicable adequacy decision and no other lawful mechanism applies, the SCCs are incorporated as follows:

• Module Two applies when Customer is a controller and Cloudlayer is a processor.
• Module Three applies when Customer is a processor and Cloudlayer is a subprocessor.
• Clause 7, the docking clause, applies.
• For Clause 9, Option 2 applies and the notice period is the advance notice period under Section 9.
• For Clause 11, the optional independent dispute-resolution language does not apply.
• For Clause 17, the law of Ireland governs to the extent the SCCs require EU Member State law.
• For Clause 18, the courts of Ireland are selected.
• Annexes 1 through 3 of this DPA complete the corresponding SCC annexes.

If the UK GDPR restricts a transfer, the UK Addendum is incorporated and completed using the information in this DPA; the SCC selections above apply as modified by the UK Addendum. For another jurisdiction, the parties will use the applicable approved addendum or transfer terms and interpret this DPA to preserve a valid safeguard.

Cloudlayer will provide information reasonably needed for a transfer assessment and will notify Customer when legally permitted if it receives a binding government demand for Customer Personal Data. Cloudlayer will review the demand, challenge unlawful or overbroad demands where there are reasonable grounds, and disclose only what it is legally required to disclose.

13. U.S. state privacy terms

Cloudlayer will not sell or share Customer Personal Data, use it for cross-context behavioral advertising, or retain, use, or disclose it outside the direct business relationship and the specific business purposes in the agreement, except as law permits for a Service Provider or Contractor. Cloudlayer will not combine Customer Personal Data with personal data received from another person or collected from Cloudlayer’s own consumer interaction, except as law permits to provide the requested business purpose.

Cloudlayer certifies that it understands these restrictions and will comply with them. Customer may take reasonable and appropriate steps to help ensure consistent use, require Cloudlayer to stop and remediate unauthorized use, and monitor compliance through Section 10.

14. What controls if terms conflict?

If this DPA conflicts with the agreement about processing Customer Personal Data, this DPA controls. The SCCs or mandatory law control over a conflict with this DPA. The liability limits in the agreement apply to this DPA to the extent law permits.

Cloudlayer may update this DPA to reflect law, an approved transfer mechanism, or Service changes. A change will not materially reduce Customer’s data-protection rights during an active order. A materially adverse change will receive reasonable advance notice.

Annex 1: Processing details

Parties. The data exporter is Customer at the address and contacts in its account or order. The data importer is Cloudlayer at 2769 Jefferson Davis Highway, Suite 111-1054, Stafford, Virginia 22554, United States; privacy contact: privacy@cloudlayer.io. Each party’s agreement acceptance is its signature for incorporated transfer terms.

Subject matter and purpose. Provision of Cloudlayer’s capture, document, form, submission, signature, generation, storage, delivery, automation, collaboration, support, security, billing, and customer-selected integration workflows.

Nature and frequency. Collection, recording, organization, structuring, hosting, storage, adaptation, retrieval, consultation, rendering, capture, extraction, AI-assisted transformation when selected, transmission, delivery, restriction, return, and deletion. Processing occurs when Customer or its users, respondents, signers, recipients, schedules, APIs, or integrations invoke the Service.

Data subjects. Customer users and personnel; organization members; website visitors; contacts; form respondents; signers; document recipients; Customer’s customers, prospects, suppliers, and partners; and other people whose data Customer submits.

Personal data. Account and contact data; identifiers; authentication and authorization data; device, network, usage, security, and audit data; form questions and responses; signature, consent, routing, and event data; document, template, media, webpage, and file content; communication and support data; billing and transaction metadata; integration and delivery metadata; and AI prompts, selected inputs, outputs, and feedback.

Sensitive data. The Service can process sensitive data only when Customer is authorized to submit it and the Service scope permits it. PHI and ePHI are prohibited without a written eligible scope and business associate agreement. Customer must not use standard payment fields to collect payment-card data.

Duration and deletion. The agreement term plus the configured retention, export, recovery, backup, legal-hold, and deletion periods described in Section 11 and the Privacy Notice.

Competent supervisory authority. The authority determined under Clause 13 of the SCCs based on Customer’s establishment, representative, or affected data subjects.

Annex 2: Technical and organizational measures

Cloudlayer’s measures are risk-based and include:

• tenant-scoped authorization, organization and workspace membership, role controls, least privilege, and access review;
• authentication controls, credential and secret management, revocation, and protection of service-to-service access;
• encryption in transit and encryption at rest for Customer Data stored by Cloudlayer, with managed key and secret controls;
• network segmentation, restricted ingress and egress, request validation, server-side request forgery defenses, rate limits, and abuse controls;
• secure development practices, code review, automated testing, dependency and vulnerability management, and controlled deployment;
• logging, immutable or append-only audit evidence for security-sensitive and customer workflow events, monitoring, alerting, and incident response;
• availability, backup, restore, recovery, capacity, and change-management controls appropriate to the Service, without creating a contractual uptime commitment unless an order expressly does so;
• data minimization, configurable retention, deletion, trash and recovery controls, and protection of temporary processing artifacts;
• personnel confidentiality, access offboarding, security and privacy training, and controlled support access;
• provider inventory, data-flow review, written subprocessor obligations, and change review;
• isolation of capture and rendering work, safe handling of untrusted files and web content, and separation between jobs; and
• periodic testing and evaluation of safeguards, remediation tracking, and preservation of appropriate evidence.

The maintained Security page provides additional operational context and expressly identifies any independently verified certification or report.

Annex 3: Subprocessors

The current Cloudlayer-appointed subprocessors, services, roles, data categories, and processing locations are maintained in the Subprocessor List. That list is incorporated into this DPA.