--- title: Data Processing Agreement | GPUBank GPU cloud url: https://gpubank.io/dpa description: The Article 28 GDPR agreement, part of the Terms for every business account. You stay the controller of your data; we process it only on your instructions. generated: 2026-11-02T00:15Z publisher: GPUBank (GPU Compute OÜ, Tallinn, Estonia) summary_for_ai: https://gpubank.io/llms.txt full_text_for_ai: https://gpubank.io/llms-full.txt --- > Markdown version of https://gpubank.io/dpa, generated from the live page. GPUBank is a GPU cloud billed by the second at one all-in price per GPU (vCPU, RAM, NVMe, a public IPv4 and traffic included), in Paris, Frankfurt, Ashburn and Singapore. Prices are in US dollars, excluding VAT. §Legal · Data Processing Agreement # When your workloads hold personal data, this is how we handle it. The Article 28 GDPR agreement, part of the Terms for every business account. You stay the controller of your data; we process it only on your instructions. Version 1.0 Effective 4 October 2026 GPU Compute OÜ · Tallinn ≈ 4 min read · 10 sections [Sub-processors](https://gpubank.io/subprocessors) [contact@gpubank.io](mailto:contact@gpubank.io) The short version Six sentences that say what the 10 sections below say. If the two ever disagree, the sections win. Plain English Applies automatically Part of the Terms for business accounts. A countersigned PDF is sent on request. Your instructions only We process your data to run the resources you start, nothing else. Your region, your choice Data stays in the region you pick. EU regions never leave the EU. 48 hours A breach affecting your data is notified to you within 48 hours of our becoming aware of it. Named sub-processors Listed publicly, changes announced 30 days ahead, with a right to object. Deleted when you say At the end of the service, data is deleted within 30 days, backups included. **On this page** 1. 01 Parties and scope 2. 02 What we process, and why 3. 03 Our commitments as processor 4. 04 Sub-processors 5. 05 Technical and organisational measures 6. 06 International transfers 7. 07 Personal data breaches 8. 08 Return and deletion 9. 09 Audits 10. 10 Liability and signature ## Parties and scope # What it means You, the business customer, are the controller. GPU Compute OÜ is the processor. The DPA covers personal data inside your workloads. **Controller** The business customer that holds the GPUBank account (you) **Processor** GPU Compute OÜ, registry code 17984370, Müürivahe 62, 10135 Tallinn, Estonia **Effective** From the moment a business account accepts the Terms, for as long as it uses the Service **Precedence** Where this DPA and the Terms disagree about personal data, this DPA prevails This DPA applies to personal data that you upload to, generate on or serve from GPU resources, persistent disks, buckets and endpoints (the **Customer Data**). Account and billing data, which we process as a controller, is covered by the [Privacy policy](https://gpubank.io/privacy). ## What we process, and why # What it means We store and compute on your data because you start resources that do. We do not decide what is in it. | Item | Description | | --- | --- | | Subject matter | Hosting and computing on Customer Data through the Service | | Nature of processing | Storage, transfer to the GPU servers you select, computation, retrieval and deletion | | Purpose | Providing the Service as you configure it, and nothing else | | Duration | The life of the account, then the deletion period in section 8 | | Categories of data | Whatever you choose to process. We have no knowledge or control of the content | | Categories of data subjects | Determined by you: for example your users, customers, employees, or people in your datasets | | Special categories | Only if you process them; you are responsible for having a legal basis | ## Our commitments as processor # What it means The Article 28 list, in plain words. - We process Customer Data only on your documented instructions. The Terms, your configuration in the console and your API calls are those instructions. If an instruction seems to break the GDPR, we tell you. - Everyone at GPU Compute OÜ who can reach Customer Data is bound by confidentiality, and access is limited to named engineers for support you request, abuse handling or a legal order. - We apply the technical and organisational measures in section 5 and keep them at least at that level. - We help you answer requests from data subjects and meet your obligations on security, breach notification and impact assessments, as far as the nature of the Service allows. - We make available the information needed to show compliance with this DPA and allow audits as described in section 9. ## Sub-processors # What it means You authorise the sub-processors on our public list. We announce changes 30 days ahead and you can object. - You give general authorisation for the sub-processors listed on the [sub-processors page](https://gpubank.io/subprocessors). - We announce any addition or replacement on that page and by email to account owners at least 30 days before it takes effect. - You may object on reasonable grounds within that period. If we cannot address the objection, you may close the affected resources or the account, and unused prepaid balance for those resources is refunded. - Each sub-processor is bound by data protection obligations no less protective than this DPA, and we remain responsible for its performance. ## Technical and organisational measures # What it means What actually protects your data, listed so your security team can check it. | Area | Measure | | --- | --- | | Encryption | TLS 1.2 or higher on every connection; persistent disks encrypted at rest; customer-managed keys on request for reserved capacity | | Isolation | Each resource runs in its own virtual machine or container with dedicated GPUs; no GPU is shared between customers at the same time | | Wiping | GPU memory and local NVMe scratch are wiped between customers; deleted disks are cryptographically erased | | Access control | Production access limited to named engineers with individual keys, logged and reviewed monthly | | Network | No public web port on our servers; traffic arrives through an encrypted tunnel with DDoS protection | | Availability | Replicated persistent storage, rolling backups of control-plane data for 30 days | | Incident response | On-call rotation, documented response procedure, post-mortem published for every regional incident | | People | Confidentiality undertakings for every person with access; access removed the day someone leaves | ## International transfers # What it means Data goes where you send it. Choosing a region outside the EU is your instruction, and the standard clauses cover it. - Customer Data stays in the region you choose for a resource. EU regions (Paris, Frankfurt) never leave the EU. - Choosing Ashburn or Singapore is an instruction to process there. For those transfers, the EU standard contractual clauses (Commission Decision 2021/914, module two or three as applicable) are incorporated into this DPA by reference. - Where a sub-processor outside the EU is involved, the transfer relies on an adequacy decision, the EU-US Data Privacy Framework or the standard contractual clauses. ## Personal data breaches # What it means If something happens to your data, you hear it from us within 48 hours, with what we know. - We notify you without undue delay and at the latest within 48 hours of becoming aware of a breach affecting Customer Data, by email to the account owner and in the console. - The notice describes what happened, the data and the number of people likely concerned, the likely consequences, and the measures taken or proposed. What we do not know yet follows as soon as we know it. - Notifying the supervisory authority and the people concerned remains your decision as controller. We help you with it. ## Return and deletion # What it means Your data is yours to take. When the service ends, we delete it. - You can export Customer Data at any time while resources exist, through the console, the API or standard tools on your own resources. - When you delete a resource, its data is removed from active storage at once and from backups within 30 days. - When the account closes, remaining Customer Data is deleted within 30 days, unless the law requires us to keep it, in which case it stays protected under this DPA. ## Audits # What it means Ask us questions first; if the answers are not enough, an audit is possible. - On request, we answer your security questionnaire and provide the documentation behind the measures in section 5, once per year or after a breach. - If that is not enough to show compliance, you may audit us, or have an independent auditor bound by confidentiality do it, with 30 days' notice, during business hours, at your cost, and without access to other customers' data. ## Liability and signature # What it means The liability terms of the Terms apply. A signed copy is available whenever you need one. - Each party's liability under this DPA is subject to the limits in the Terms, except where the GDPR does not allow a limit. - This DPA is governed by the same law as the Terms: the law of the Republic of Estonia. - Need a countersigned PDF for your records or your own customers? Write to [contact@gpubank.io](mailto:contact@gpubank.io) with your company name, address and registration number, and we send it within two business days. ## Document history Every version, dated. A change that matters is announced 30 days ahead. 1. 4 Oct 2026 Version 1.0 · first published. A question this page does not answer? Write to [contact@gpubank.io](mailto:contact@gpubank.io). Questions about our documents are answered within 15 business days, and anything about a running service much faster. [Sub-processors](https://gpubank.io/subprocessors) [Open console](https://console.gpubank.io/)