When your workloads hold personal data, this is how we handle it.

Controller

The business customer that holds the GPUBank account (you)

Processor

GPU Compute OÜ, registry code 17984370, Müürivahe 62, 10135 Tallinn, Estonia

Effective

From the moment a business account accepts the Terms, for as long as it uses the Service

Precedence

Where this DPA and the Terms disagree about personal data, this DPA prevails

This DPA applies to personal data that you upload to, generate on or serve from GPU resources, persistent disks, buckets and endpoints (the Customer Data). Account and billing data, which we process as a controller, is covered by the Privacy policy.

• We process Customer Data only on your documented instructions. The Terms, your configuration in the console and your API calls are those instructions. If an instruction seems to break the GDPR, we tell you.
• Everyone at GPU Compute OÜ who can reach Customer Data is bound by confidentiality, and access is limited to named engineers for support you request, abuse handling or a legal order.
• We apply the technical and organisational measures in section 5 and keep them at least at that level.
• We help you answer requests from data subjects and meet your obligations on security, breach notification and impact assessments, as far as the nature of the Service allows.
• We make available the information needed to show compliance with this DPA and allow audits as described in section 9.

• You give general authorisation for the sub-processors listed on the sub-processors page.
• We announce any addition or replacement on that page and by email to account owners at least 30 days before it takes effect.
• You may object on reasonable grounds within that period. If we cannot address the objection, you may close the affected resources or the account, and unused prepaid balance for those resources is refunded.
• Each sub-processor is bound by data protection obligations no less protective than this DPA, and we remain responsible for its performance.

• Customer Data stays in the region you choose for a resource. EU regions (Paris, Frankfurt) never leave the EU.
• Choosing Ashburn or Singapore is an instruction to process there. For those transfers, the EU standard contractual clauses (Commission Decision 2021/914, module two or three as applicable) are incorporated into this DPA by reference.
• Where a sub-processor outside the EU is involved, the transfer relies on an adequacy decision, the EU-US Data Privacy Framework or the standard contractual clauses.

• We notify you without undue delay and at the latest within 48 hours of becoming aware of a breach affecting Customer Data, by email to the account owner and in the console.
• The notice describes what happened, the data and the number of people likely concerned, the likely consequences, and the measures taken or proposed. What we do not know yet follows as soon as we know it.
• Notifying the supervisory authority and the people concerned remains your decision as controller. We help you with it.

• You can export Customer Data at any time while resources exist, through the console, the API or standard tools on your own resources.
• When you delete a resource, its data is removed from active storage at once and from backups within 30 days.
• When the account closes, remaining Customer Data is deleted within 30 days, unless the law requires us to keep it, in which case it stays protected under this DPA.

• On request, we answer your security questionnaire and provide the documentation behind the measures in section 5, once per year or after a breach.
• If that is not enough to show compliance, you may audit us, or have an independent auditor bound by confidentiality do it, with 30 days' notice, during business hours, at your cost, and without access to other customers' data.

• Each party's liability under this DPA is subject to the limits in the Terms, except where the GDPR does not allow a limit.
• This DPA is governed by the same law as the Terms: the law of the Republic of Estonia.
• Need a countersigned PDF for your records or your own customers? Write to [email protected] with your company name, address and registration number, and we send it within two business days.