1. Scope and roles

1.1 This Data Processing Agreement (the "DPA") applies when ON DIVERSITY CLOUD EUROPE, S.L. ("DIVERSITY") processes personal data on behalf of the Customer in providing the Services. It is the DPA referred to in the General Terms (/general-terms/), forms part of the Agreement, and meets the requirements of Article 28 of Regulation (EU) 2016/679 (the "GDPR").

1.2 The Customer is the controller of that personal data, or a processor acting for its own customers. DIVERSITY is the Customer's processor or, where the Customer is itself a processor, its sub-processor.

1.3 DIVERSITY processes the personal data of the Customer's contact persons as controller, as described in its Privacy Policy (/privacy-policy/). For the Telecom services, DIVERSITY processes traffic and location data as a provider of electronic communications services under Spanish Law 11/2022 of 28 June, General Telecommunications Law, as controller. This DPA applies to the content that DIVERSITY stores for the Customer within those services, such as call recordings and voicemail.

1.4 Terms such as "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meaning given in the GDPR. Other capitalised terms have the meaning given in the General Terms.

2. Details of the processing

Subject matter The provision of the Services under the Agreement
Duration The term of the Agreement, and afterwards until the personal data is returned or deleted under Section 10
Nature and purpose Hosting, storage, transmission, backup and recovery, management, monitoring, support and the other operations needed to provide the Services ordered
Types of personal data The personal data the Customer and its users store, process or transmit using the Services, as determined by the Customer. This may include special categories of personal data where the Customer decides to process them
Data subjects As determined by the Customer, for example its employees, users, customers and other contacts

3. Instructions

3.1 DIVERSITY processes personal data only on the Customer's documented instructions, including on transfers to third countries. The Agreement, and the Customer's use and configuration of the Services, are the Customer's instructions. Further instructions must be in writing and consistent with the Agreement.

3.2 Where European Union or Member State law requires DIVERSITY to process personal data otherwise, DIVERSITY informs the Customer of that legal requirement before processing, unless that law prohibits it.

3.3 DIVERSITY informs the Customer immediately if, in its opinion, an instruction infringes the GDPR or other data protection law.

3.4 DIVERSITY does not access the content of Customer Data except as needed to provide the Services, to provide support the Customer asks for, or to comply with the law.

4. Confidentiality

DIVERSITY ensures that the persons it authorises to process personal data are bound by confidentiality obligations or by an appropriate statutory obligation of confidentiality.

5. Security

5.1 DIVERSITY implements the technical and organisational measures in the Annex, which take into account the state of the art, the costs, and the nature, scope, context and purposes of the processing, as Article 32 of the GDPR requires.

5.2 The Customer is responsible for the security of what it controls, including its accounts and credentials, its configuration of the Services, the operating system and software on unmanaged Services, the encryption of its bare metal disks, and the protocols that protect its own traffic.

5.3 DIVERSITY may update the measures in the Annex, provided that the overall level of security is not reduced.

6. Sub-processors

6.1 The Customer gives DIVERSITY a general authorisation to engage sub-processors. DIVERSITY makes the current list of its sub-processors available to the Customer on request.

6.2 DIVERSITY informs the Customer at least 30 days before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may terminate the affected Services, without penalty, before the change takes effect.

6.3 DIVERSITY imposes on each sub-processor, by contract, data protection obligations that are at least as protective as this DPA, and remains liable to the Customer for its sub-processors (General Terms, Section 19.2).

6.4 Operators of the data centres that house DIVERSITY's infrastructure provide space, power and cooling only and have no logical access to Customer Data. They are not sub-processors.

7. Location and transfers

7.1 DIVERSITY stores and processes personal data in the European Union, in the regions selected in the Order Form (General Terms, Section 9.4), or in Amsterdam for the AI services (/contracts/ai/). In IT maintenance, the personal data stays on the Customer's own systems and backup media, and DIVERSITY processes it there (/contracts/it-maintenance/, Section 8.2). Where the Customer's systems are outside the European Union, the data stays where the Customer keeps it, and DIVERSITY works on it remotely from the European Union.

7.2 DIVERSITY does not transfer personal data to a country outside the European Economic Area. If a transfer ever becomes necessary, it will take place only with the Customer's prior written consent and with the safeguards required by Chapter V of the GDPR.

7.3 Requests from authorities for access to Customer Data are handled as described on the Data Act page (/data-act/, Section 5.2).

8. Assistance

8.1 Taking into account the nature of the processing, DIVERSITY assists the Customer by appropriate technical and organisational measures in responding to requests from data subjects exercising their rights. If DIVERSITY receives such a request directly, it passes it to the Customer without undue delay and does not answer it unless the Customer instructs it to.

8.2 DIVERSITY assists the Customer, taking into account the information available to it, in meeting its obligations on security, personal data breaches, data protection impact assessments and prior consultation of the supervisory authority (Articles 32 to 36 of the GDPR).

8.3 Assistance that goes beyond what the Services already provide, or that is needed because of the Customer's own acts, may be billed at the rates in the Order Form.

9. Personal data breaches

9.1 DIVERSITY notifies the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting the Customer's personal data.

9.2 The notification describes, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Information that is not yet available is provided as soon as it is.

9.3 DIVERSITY takes reasonable steps to contain the breach and limit its effects. Notifying the supervisory authority and the data subjects remains the Customer's decision and responsibility as controller.

10. Return and deletion

10.1 At the end of the Agreement, or of a Service, the Customer may export its personal data as set out in the General Terms (Section 17) and in the Specific Terms of the Service.

10.2 DIVERSITY then deletes the personal data, including copies, as set out in those Specific Terms, unless European Union or Member State law requires it to keep them. Copies in backups are deleted when those backups expire. A Locked Backup under the Disaster Recovery Specific Terms is deleted when its lock period ends.

11. Audits

11.1 DIVERSITY makes available to the Customer the information necessary to demonstrate compliance with Article 28 of the GDPR, including the reports of the independent audits of its data centres.

11.2 Where that information is not sufficient, the Customer, or an independent auditor bound by confidentiality that it mandates, may carry out an audit, including an inspection, once a year, on at least 30 days' written notice, during Business Hours as defined in the Support Specific Terms (/contracts/support/), and in a way that does not disrupt the Services or breach the confidentiality of other customers. Audits required by a supervisory authority, or following a personal data breach, are not limited to once a year.

11.3 Each party bears its own costs of an audit. Access to the data centre buildings is subject to the rules of their operators. For Customers subject to Regulation (EU) 2022/2554 (DORA), the audit, access and inspection rights in the Order Form or its addendum apply as well (General Terms, Section 3.3).

12. Records and cooperation

DIVERSITY keeps the record of processing activities required by Article 30(2) of the GDPR and cooperates with the supervisory authorities. The Data Protection Officer can be reached at legal@corp.ondiversity.eu.

13. Liability and precedence

13.1 Liability under this DPA is governed by Section 14 of the General Terms, without prejudice to Article 82 of the GDPR.

13.2 This DPA prevails over the Specific Terms, the General Terms and the Acceptable Use Policy on the processing of personal data (General Terms, Section 3.2).

Annex: technical and organisational measures

Area Measures
Encryption Data that DIVERSITY stores or transmits to provide the Services, including backups and disaster recovery copies, is encrypted in transit and at rest. On bare metal, the Customer decides whether and how its disks are encrypted.
Key management Encryption keys are managed by DIVERSITY. Their physical copies are kept in a high-security vault operated by a specialist security company in Spain.
Access control Only authorised DIVERSITY staff located in the European Union can access the infrastructure and Customer Data. Administrative access requires multi-factor authentication and is logged.
Physical security The infrastructure runs on hardware owned by DIVERSITY in independently audited data centres in Madrid, Amsterdam, Munich and Helsinki, with controlled and registered access.
Network Customer networks are isolated from each other. Private Link and the traffic between DIVERSITY's sites are encrypted.
Availability Backups as provided in each Service's Specific Terms. Monitoring of the infrastructure.
Deletion Cloud disks, snapshots and backups are deleted and zeroed before the space is reused. Bare metal disks are securely erased to NIST SP 800-88 before the server is reused.
Staff Staff are bound by confidentiality and have access only as their role requires.