Data Processing Addendum

Scope and roles

This Data Processing Addendum applies when Tucloud processes personal data on behalf of a business customer through hosting, deployment, database, email, or related services. The customer is the controller or processor that determines instructions, and Tucloud acts as processor or subprocessor for that customer data.

For account, billing, security, abuse, and service administration data that Tucloud determines how to process, Tucloud acts as an independent controller as described in the Privacy Policy.

Customer instructions

Tucloud will process customer personal data only to provide the services, comply with documented customer instructions, protect the services, and meet legal obligations. The agreement, service configuration, and support requests constitute documented instructions.

The customer is responsible for ensuring its instructions and processing are lawful and for providing all required notices and obtaining any required consent.

Annex I — processing details

Subject matter and duration: processing customer personal data to provide the hosting, deployment, database, domain, DNS, TLS, mailbox, backup, support, and connected services selected by the customer, for the term of the service plus the limited deletion, backup, dispute, and legally required retention periods described in the Privacy Policy.

Nature and purposes: collection, transmission, storage, organization, retrieval, access, encryption, backup, deletion, troubleshooting, security monitoring, and other operations needed to deliver, secure, support, and maintain the services under documented customer instructions.

Data subjects may include the customer's users, personnel, contractors, applicants, clients, visitors, subscribers, contacts, and other individuals whose data the customer submits. Data may include identifiers, contact and account data, authentication records, IP and device data, communications, hosted files and database records, application logs, domain and mailbox data, and other personal data chosen by the customer. The customer must not submit special-category, highly sensitive, health, payment credential, or government-identifier data unless the parties have expressly agreed that the service and safeguards support it.

Annex II — technical and organizational measures

Access and tenancy: authenticated access, least-privilege administrative roles, tenant-scoped database queries and row-level controls, restricted service credentials, and separation of customer projects and hosting accounts.

Protection and resilience: TLS for network transport, encryption of environment-variable values at rest, signed and HTTP-only security cookies where applicable, firewall and resource-isolation controls, operational backups, service health monitoring, and documented recovery procedures appropriate to the selected service.

Secure operations: logging of relevant authentication and deployment events, dependency and vulnerability maintenance, secret rotation and restricted production access, incident triage and escalation, deletion workflows, and personnel confidentiality. Controls are reviewed as the architecture and risk change; this description does not promise a certification or control that Tucloud has not independently verified.

Confidentiality and security

Personnel authorized to process customer personal data are subject to confidentiality obligations. Tucloud maintains technical and organizational measures appropriate to the service and risk, including access controls, encrypted transport, infrastructure isolation, secret encryption, monitoring, backups, vulnerability controls, and incident procedures.

Subprocessors

The customer authorizes Tucloud to use subprocessors needed to provide the services. Tucloud will require subprocessors to protect customer personal data through contractual or other legally recognized obligations appropriate to their role. The current Subprocessor List is incorporated into this Addendum.

Tucloud will post a material new subprocessor at least 30 days before that provider begins routine processing where reasonably possible. A customer with a reasonable data protection objection must contact Tucloud during that notice period so the parties can seek a practical resolution. Emergency security replacements may occur sooner with notice as soon as reasonably possible.

Assistance and incidents

Taking into account the nature of processing and information available, Tucloud will provide reasonable assistance with data subject requests, security obligations, impact assessments, and regulator inquiries. Additional work outside standard service capabilities may be charged at agreed rates.

Tucloud will notify the customer without undue delay after confirming a personal data breach affecting customer personal data and will provide available information reasonably needed for the customer's legal obligations.

International transfers

Customer personal data may be processed in countries identified in the Privacy Policy or Subprocessor List. Where a transfer mechanism is legally required, the parties will cooperate to implement applicable standard contractual clauses or another valid safeguard.

Deletion, return, and audits

At termination and on customer request, Tucloud will delete or make available customer personal data within the service's technical capabilities, except where retention is required by law or maintained temporarily in protected backups.

Tucloud will provide information reasonably necessary to demonstrate compliance. Audits must be proportionate, protect other customers and security, avoid unreasonable disruption, and use available reports before requesting an on-site review.

Precedence and contact

If this Addendum conflicts with the Terms on processing customer personal data, this Addendum controls. Requests concerning this Addendum may be sent to legal@tucloud.app.