Data processing agreement

1. Scope

This agreement applies whenever logi-ciel processes personal data on your behalf as part of the service. It forms part of the terms of service and applies to every account without a signature. You are the controller of that data, and we are the processor, in the sense of Article 28 of the GDPR. If you want a signed copy for your records, write to privacy@logi-ciel.co.

2. What we process

Subject: hosting, storing and transmitting the data you place on servers, volumes, databases and buckets.
Duration: as long as the contract runs, and until the data is deleted under section 9.
Nature: storage, transmission, backup and deletion, each at your instruction.
Data and data subjects: whatever you choose to store. We don’t inspect it, so you decide both.

3. Your instructions

We process the data only on your documented instructions. Those instructions are these terms and what you do in the console, the API, lc or Terraform. If the law requires us to process data in another way, we tell you first, unless the law forbids it.

4. Our staff

Only engineers who need access to run the platform can reach the systems that hold your data. Each of them is bound to confidentiality. Access to a customer’s data needs a ticket and a second engineer, and each session is recorded.

5. Where the data stays

Your data stays in the region you choose. Each region is one data centre, and every one is inside the EU:

Region	Data centre
`ee1`	Tallinn, Estonia
`lv1`	Riga, Latvia
`dk1`	Copenhagen, Denmark
`at1`	Vienna, Austria
`it1`	Milan, Italy
`pt1`	Lisbon, Portugal

Backups and snapshots stay in the region of the resource they copy. We move data to another region only when you do, for example by copying a snapshot. We don’t transfer it outside the European Economic Area, and our support staff work from inside the EU.

6. Sub-processors

Sub-processor	Location	What it provides
The operator of the `ee1` data centre	Tallinn, Estonia	Space, power, cooling and site security
The operator of the `lv1` data centre	Riga, Latvia	Space, power, cooling and site security
The operator of the `dk1` data centre	Copenhagen, Denmark	Space, power, cooling and site security
The operator of the `at1` data centre	Vienna, Austria	Space, power, cooling and site security
The operator of the `it1` data centre	Milan, Italy	Space, power, cooling and site security
The operator of the `pt1` data centre	Lisbon, Portugal	Space, power, cooling and site security

Each operator runs the building, and our own staff run the racks inside it. No operator has logical access to your data. A payment provider processes billing data, which is not data you store on the platform, so the privacy policy covers it.

We keep this list up to date and email you 30 days before we add a sub-processor. If you object on reasonable grounds and we can’t resolve it, you may end the contract at no cost.

7. Security

We keep the technical and organisational measures on the security page in place. They include encryption at rest and in transit, isolation between customers, access by role and an audit log for every project. We review them every year.

8. Personal data breaches

If a breach affects your data, we tell you without undue delay, and within 24 hours of confirming it. The notice says what happened, which data it affects and what we are doing about it. We help you meet your own duty to notify the authorities and the people concerned.

9. Deletion

When you delete a resource, we erase its data, and its backups follow within 30 days. When the contract ends, we delete all your data within 30 days. You can export it at any time before then.

10. Help and audits

We help you answer requests from data subjects and carry out impact assessments, as far as the service allows. Independent audit reports are available under NDA. If they don’t answer your question, you may audit us once a year, at your own cost and with 30 days’ notice.

Data processing agreement.