Data Processing Agreement

1. Introduction

This Data Processing Agreement ("DPA") forms part of the Terms of Service between TwanIT, trading as deploybase ("Processor", "we", "us"), and the customer ("Controller", "you") who uses the deploybase platform.

This DPA applies when deploybase processes personal data on your behalf in the course of providing the hosting service. It applies on every plan, the free plan included. You accept it when you create an account or a team.

Each team is a separate customer. Whoever creates a team, or accepts this DPA for it, does so for the person or organization that the team belongs to, and confirms they may bind it.

When you act for someone else

Usually you are the controller of the personal data and we are your processor. If you process the data on behalf of another organization, for example as an agency that runs a team for a client, that organization is the controller, you are its processor and we are your sub-processor (Article 28(4) GDPR). In that case:

• you confirm that the controller has authorized you in writing to engage us and the sub-processors listed in section 5;
• your instructions to us include the controller's instructions;
• you pass on to the controller, without undue delay, the notices we send you under this DPA, such as sub-processor changes and data breaches;
• "Controller" and "you" in this DPA mean you, acting for that controller.

Changes on October 17, 2026: section 1 covers teams run for someone else, section 3 now lists form submissions and function requests, section 5 commits to notifying you by email of sub-processor changes, and section 9 shortens the breach notice from 72 to 48 hours. New: section 13, on how we change this DPA. Earlier the same month, section 6 began describing EEA-only edge delivery and section 8 corrected the retention of server logs to 7 days and of build logs to the life of their deployment.

The part of section 1 on acting for someone else applies from November 30, 2026, after 30 days' notice by email. The other changes add only to our obligations or correct how we describe what we already did, so they apply since October 17, 2026.

2. Definitions

"Personal Data"

Any information relating to an identified or identifiable natural person that the Controller uploads to or processes through the Service.

"Processing"

Any operation performed on Personal Data, including storage, retrieval, transmission, and deletion.

"Sub-processor"

A third party engaged by the Processor to process Personal Data on behalf of the Controller.

"Data Breach"

A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data.

Terms not defined here have the meaning given in the GDPR (Regulation (EU) 2016/679) or the Terms of Service.

3. Scope and purpose

Nature of processing

deploybase builds, hosts and serves websites on your behalf, receives the submissions of your forms and runs your functions. In doing so, we may process personal data that your end-users submit through your websites, or that is contained in the content you deploy.

Types of personal data

• Content you deploy through the Service (HTML, JavaScript, assets)
• Build logs and deployment metadata
• CDN access logs of site visitors (IP addresses, user agents, requested URLs and referrers), kept by Bunny.net for 3 days
• Form submissions: the fields your visitors fill in, their user agent, a shortened IP address and a keyed hash of it. Submissions are kept until you delete them or until the retention period you set on the form ends.
• Function requests and responses. A request queued for a function is stored for 7 days, without the caller's IP address.

Site statistics

Unless you switch it off, we derive daily statistics for each production site from its CDN access logs: page views per page, referring sites (the host name only), countries, pages that were not found, and requests from named crawlers. Only daily totals are stored. They contain no IP addresses, no identifiers and no user agents. We keep them for at most 25 months on every plan; your plan sets how far back you can view them. Switching analytics off for a site stops the counting and deletes that site's statistics.

Categories of data subjects

• Your end-users who visit sites hosted on deploybase
• People who submit your forms or call your functions
• Your team members who use the deploybase platform

Duration

Processing continues for the duration of the service agreement between you and deploybase, plus any retention period specified in section 11.

4. Obligations of the processor

deploybase will:

• Process Personal Data only on your documented instructions, unless required by EU or member state law. If such a legal requirement exists, we will inform you before processing (unless prohibited by law).
• Tell you immediately if, in our opinion, an instruction infringes the GDPR or other EU or member state data protection law.
• Ensure that persons authorized to process Personal Data have committed to confidentiality.
• Implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk (see section 8).
• Assist you in fulfilling your obligations regarding data subject requests (see section 7).
• Assist you in ensuring compliance with your obligations under GDPR Articles 32 to 36 (security, breach notification, impact assessments).
• At your choice, delete or return all Personal Data after the end of the service, and delete existing copies unless EU or member state law requires storage (see section 11).
• Make available information necessary to demonstrate compliance with GDPR Article 28 obligations (see section 10).

5. Sub-processors

You provide general authorization for us to engage the sub-processors listed below. We maintain the canonical, always-current list at deploybase.eu/subprocessors.

We will notify you by email, at the addresses of your team's owners and admins, at least 30 days before adding or replacing a sub-processor. Updating the list on this site alone is not notice. You may object within those 30 days. If we cannot resolve the objection, you may terminate the affected service, and we refund any fees you paid in advance for the period after termination.

We bind each sub-processor by written contract to data protection obligations that are no less protective than those in this DPA, and we remain fully liable to you for its performance of them. On request, we send you a copy of those data protection terms (commercial details may be removed) and the names and addresses of the sub-processors that our sub-processors use for your data, as far as they are known to us.

6. International data transfers

We store Personal Data in the European Union. Our servers run in Scaleway's datacenter in Paris, France, and every sub-processor listed in section 5 is established in the EU.

Edge delivery

Requests from your site visitors are answered by edge servers of Bunny.net's CDN, which receive the visitor's IP address and user agent. By default, under normal operating conditions, only edge servers in the European Economic Area (EEA: the EU plus Iceland and Norway) answer them, for production sites, previews and custom domains alike. Visitors outside the EEA can still reach your site, from the nearest edge server in the EEA. Our routing code runs on the edge server that answers the request.

Worldwide delivery for custom domains

An admin of your team can switch a custom domain to worldwide delivery. Custom domains that existed before EEA-only delivery became the default were left on worldwide delivery, so that nothing changed without notice, and can be switched to EEA only at any time. On a domain with worldwide delivery, a request can be answered by a Bunny.net edge server outside the EEA, and the visitor's IP address and user agent are then processed in that server's country. Bunny.net (BUNNYWAY d.o.o., Slovenia) is established in the EU and is the sole processor across its whole network, so this processing is not a transfer to a recipient in a third country under Chapter V of the GDPR. Bunny.net's data processing agreement does not rely on Standard Contractual Clauses for it; the processing remains subject to the GDPR and to the technical and organizational measures of that agreement.

DNS and CDN access logs

DNS lookups for site domains are answered by Bunny.net's global DNS network, which is not limited to the EEA. Bunny.net keeps the raw access log of each CDN zone for 3 days, stored and processed in Germany. We read it to measure bandwidth and to count site statistics, and we keep neither IP addresses nor user agents from it.

One qualification applies to billing. Creem acts as an independent controller for payment processing, and its own provider chain can include US payment infrastructure (Stripe) under standard contractual clauses. The billing relationship, invoicing and VAT handling stay in the EU.

If a transfer of Personal Data outside the EEA ever becomes necessary, we will ensure appropriate safeguards are in place (such as Standard Contractual Clauses approved by the European Commission) and will inform you in advance.

7. Data subject rights

We will assist you in responding to data subject requests under GDPR Articles 15 to 22 (access, rectification, erasure, portability, restriction, objection).

If we receive a request directly from one of your data subjects, we will promptly redirect them to you, unless we are legally required to respond directly.

8. Security measures

We implement the following technical and organizational measures. For full details, see our Security page.

• Encryption in transit: TLS 1.2+ for all communications.
• Encryption at rest: Database and storage encryption via Scaleway managed encryption.
• Access control: Role-based access (Owner, Admin, Member, Viewer) with multi-tenant isolation.
• Authentication: Self-hosted Zitadel (OIDC) with passkey support. No third-party credential access.
• Build isolation: Each build runs in a dedicated Kubernetes pod with resource limits, destroyed after completion.
• Secrets management: Encrypted via Scaleway Secret Manager, never logged.
• Monitoring: Structured logging with audit trails. Log retention: 7 days (server logs, which include IP addresses), 90 days (API key audit log). Build logs are kept for as long as their deployment exists and are deleted with it.
• Infrastructure: Hosted in Scaleway ISO 27001 certified datacenters, Paris, France.

9. Data breach notification

We will notify you of a Data Breach without undue delay and no later than 48 hours after becoming aware of it, by email to your team's owners and admins. Where we do not yet have all the information, we send what we have and follow up as we learn more. The notification will include:

• The nature of the breach, including categories and approximate number of data subjects affected
• The likely consequences of the breach
• The measures taken or proposed to address the breach
• Contact details for further information

We will cooperate with you and take reasonable steps to assist in mitigating the effects of the breach.

10. Audits

Upon reasonable request and subject to confidentiality obligations, we will provide you with information necessary to demonstrate compliance with our obligations under this DPA and GDPR Article 28.

We will allow and contribute to audits, including inspections, conducted by you or an auditor mandated by you. Audit requests should be submitted with at least 30 days' notice to support@deploybase.eu. We may charge reasonable fees for time spent assisting with audits beyond initial compliance verification.

11. Data deletion

Upon termination of the service agreement, you have 30 days to export your data. After this period, we will delete all Personal Data processed on your behalf, including backups, within 30 additional days.

Exceptions: We may retain data where required by EU or member state law (e.g., billing records retained for 7 years under Dutch tax law, Art. 52 AWR). We will inform you of any such retention and limit processing to the legally required purpose.

12. Duration and termination

This DPA is effective for the duration of the service agreement between you and deploybase, as governed by the Terms of Service. It automatically terminates when the service agreement ends, subject to any surviving obligations (particularly data deletion under section 11).

13. Changes to this DPA

We email the owners and admins of every team at least 30 days before a change to this DPA takes effect, and say what changes. If you object, you may terminate the affected service before the change takes effect, and we refund any fees you paid in advance for the period after termination. Changes that only add to our obligations, or that the law requires, can take effect sooner. Earlier versions are available on request.

14. Governing law

This DPA is governed by and construed in accordance with the laws of the Netherlands, consistent with the Terms of Service. Any disputes shall be submitted to the competent court in Zwolle, Netherlands.

15. Contact

For questions about this DPA or data processing:

Email

support@deploybase.eu

Postal address

KVK

71667415