1. About this page
ON DIVERSITY CLOUD EUROPE, S.L. ("DIVERSITY", "we", "us") provides data processing services within the meaning of Regulation (EU) 2023/2854 (the "Data Act"). This page contains the information that the Data Act requires us to make available:
- the jurisdiction to which the infrastructure used for our services is subject, and the measures we take to prevent unlawful international governmental access to data (Article 28);
- the procedures, methods and formats available for switching and data export, including our register of data structures and formats (Article 26);
- our switching and data egress charges (Article 29).
This page is referred to in Sections 9.3 and 17 of our General Terms (/general-terms/).
2. Scope
This page applies to our cloud services (VPS, VDS, MEM and MNG instances, object storage, managed databases, single sign-on and Active Directory), to Private Link and to our bare metal services. Where an Order Form includes another service that qualifies as a data processing service under the Data Act, this page also applies to that service.
Colocation is not a data processing service: customers install and control their own equipment and data. Our telecommunications services (CloudPBX, SIP trunking, numbers, A2P messaging, and fibre and mobile lines) are electronic communications services governed by Spanish Law 11/2022 of 28 June, General Telecommunications Law, including its rules on number portability.
3. Provider
The services are provided only by ON DIVERSITY CLOUD EUROPE, S.L., a company incorporated under Spanish law, NIF B24972143, with registered office at Calle de Hermosilla 48, 28001 Madrid, Spain. No parent company, shareholder or other entity established outside the European Union controls DIVERSITY or can give it instructions.
4. Jurisdiction of our infrastructure (Article 28(1)(a))
The services in Section 2 run on hardware owned by DIVERSITY, housed in data centres in the following regions, all within the European Union. All these services are available in all four regions. Where an Order Form includes our AI services, they run in Amsterdam only.
| Region | Country | Applicable law |
|---|---|---|
| Madrid | Spain | Spanish law and European Union law |
| Amsterdam | Netherlands | Dutch law and European Union law |
| Helsinki | Finland | Finnish law and European Union law |
| Munich | Germany | German law and European Union law |
Customer data, including backups and replicas, is stored only in the region or regions selected by the customer and is not moved to another region without the customer's agreement.
We do not use providers established outside the European Union, or subject to the law of a country outside the European Union, to store or process customer data for these services. The data centre operators provide space, power and cooling only and have no logical access to customer data.
5. Measures against unlawful governmental access (Article 28(1)(b) and Article 32)
We take technical, organisational and contractual measures to prevent international and third-country governmental access to, or transfer of, non-personal data held in the European Union where it would conflict with European Union law or with the law of the Member State concerned.
5.1 Contractual measures
Our contracts with customers are governed by Spanish law and state the region where customer data is stored (General Terms, Section 9.4). Our General Terms (Section 9.3) commit us to the measures described on this page.
5.2 Handling of requests from authorities
When we receive a request from an authority for access to customer data, we apply the following procedure:
- We review the request to assess its legal basis and scope.
- We give effect to a decision or judgment of a court, tribunal or administrative authority of a country outside the European Union only where it is based on an international agreement in force between that country and the European Union or Spain, such as a mutual legal assistance treaty (Article 32(2) of the Data Act and, for personal data, Article 48 GDPR).
- Where no such agreement exists, we provide non-personal data only if the conditions of Article 32(3) of the Data Act are met. We may ask the opinion of the competent Spanish authorities.
- Where we must respond, we provide the minimum amount of data permissible, based on a reasonable interpretation of the request (Article 32(4)).
- We inform the customer of the request before complying with it, unless the request serves law enforcement purposes and for as long as informing the customer would undermine them (Article 32(5)).
- We challenge requests that we consider unlawful or disproportionate.
5.3 Technical and organisational measures
- Only authorised DIVERSITY staff located in the European Union can access our infrastructure and customer data.
- All administrative access is logged, and multi-factor authentication is enforced for it.
- Data that DIVERSITY stores or transmits to provide the services, including disaster recovery copies, is encrypted in transit and at rest. On bare metal servers, the customer controls the server and decides whether and how its disks are encrypted. The protection of the customer's own traffic to and from its services depends on the protocols the customer uses.
- Encryption keys are managed by DIVERSITY. Their physical copies are kept in a box in a high-security vault operated by a specialist security company in Spain.
6. Switching and data export (Article 26)
6.1 Procedure. A customer can ask to switch to another provider or to its own infrastructure, or to export or erase its data, by written notice to legal@corp.ondiversity.eu. Section 17 of our General Terms sets out the notice period (one month), the transition period (30 calendar days), the data retrieval period (at least 30 calendar days) and the erasure of data afterwards.
6.2 Register of exportable data, structures and formats. The table below is the register referred to in Article 26(b) of the Data Act. It lists, for each service, the data and digital assets that can be exported, the export method and the formats.
| Service | Exportable data and digital assets | Export method | Formats |
|---|---|---|---|
| VPS, VDS, MEM and MNG instances | Disk images and snapshots; instance configuration | Export by DIVERSITY on request | Raw disk image; configuration in JSON |
| Bare metal | Full content of the server's disks | Full disk export by DIVERSITY on request (see 6.4). The customer can also copy its data at any time with its own tools. | Full disk image |
| Object storage | Objects and their metadata | Self-service by the customer at any time through the S3-compatible API. No action by DIVERSITY is needed. | Objects in their original format, through the S3-compatible API |
| Managed databases | Databases, users and configuration | Full dump by DIVERSITY on request | SQL dump (PostgreSQL, MySQL); the engine's native dump format (Redis, MongoDB) |
| Single sign-on | Users and their attributes (such as name and email address), groups, roles and application (client) configuration created by the customer. Passwords are not exported in readable form. Our own layer is excluded (Section 6.3). | Export by DIVERSITY on request | JSON or CSV |
| Active Directory | Users, groups and organisational units created by the customer, with their attributes. Passwords are not exported in readable form. | Export by DIVERSITY on request | LDIF |
| Private Link | None. Private Link stores no customer data, and its configuration is specific to our network (Section 6.3). | Not applicable | Not applicable |
| AI services | Model weights fine-tuned on Customer Data, and models the Customer uploaded to an Endpoint. Prompts and outputs are not stored (AI Specific Terms, 5.4), so there are none to export. | Download by the Customer at any time during the term and for 30 days after it (AI Specific Terms, 5.5), or export by DIVERSITY on request | The model's own weight format, as trained or uploaded |
| Data Driven platform | The Customer's data on the Platform, and the assets built on it for the Customer: datasets, pipelines, dashboards and notebooks | Export by DIVERSITY on request. The Customer can also copy its data at any time with its own tools. | Data in its original formats; assets in the formats of the tools that hold them |
| Disaster Recovery | Ready Copies and Locked Backups of the Customer's systems | Export by DIVERSITY on request | Raw disk image; configuration in JSON |
| Event Streaming | Topics, queues and the messages they still retain; broker configuration | Export by DIVERSITY on request. The Customer can also consume its messages at any time with its own clients. | The broker's native formats; configuration in JSON |
6.3 Excluded data. The following are not exportable:
- data specific to the internal functioning of our services, whose export would risk a breach of our trade secrets (Article 25(2)(f) of the Data Act): our internal monitoring data about our infrastructure; hypervisor and host configuration; and the configuration of our internal and corporate networks, including the network-side configuration of Private Link;
- software, configuration and other assets protected by our intellectual property rights (Article 2(38) of the Data Act), including the components, extensions and configuration that DIVERSITY adds to the single sign-on service.
These exclusions do not impede or delay switching.
6.4 Known restrictions and technical limitations. A full disk export of a bare metal server requires the server to be shut down for the duration of the export. We know of no other restrictions or technical limitations.
7. Switching and data egress charges (Article 29)
We do not charge switching charges, including data egress charges, for switching to another provider or to the customer's own infrastructure. Our standard service fees and any early termination charges are set out in the Order Form.
8. Updates
We keep this page up to date. The "Last updated" date shows the current version.
9. Contact
Questions about this page: legal@corp.ondiversity.eu.