Data Processing Addendum
How CloudIP processes personal data on your behalf.
Data Processing Addendum
How CloudIP processes personal data on your behalf as your service provider.
1. Roles and scope
This Data Processing Addendum ("DPA") is part of the Agreement. It applies when CloudIP processes personal data contained in Customer Data on your behalf ("Customer Personal Data"). You are the controller (or business) and CloudIP is your processor (or service provider).
2. Instructions and the data processed
CloudIP processes Customer Personal Data only to provide, secure and support the Service, according to the Agreement and your documented instructions, including the settings you choose in the Service, unless the law requires otherwise. CloudIP will tell you if it believes an instruction breaks the law.
The individuals concerned are your buyers, customers, employees, contractors, contacts and Users. The data includes contact details, shipping addresses, order and transaction details, communications, account information and any other data you choose to put into the Service. Do not put special categories of data (such as health information) into the Service unless a module is designed for them.
3. Service provider commitments
CloudIP will not sell or share Customer Personal Data, retain, use or disclose it for any purpose other than providing the Service, or combine it with personal data from other sources except as the law allows service providers to. CloudIP will comply with applicable privacy laws, including the California Consumer Privacy Act, and will tell you if it can no longer meet its obligations under them.
4. Personnel
CloudIP gives access to Customer Personal Data only to personnel who need it and who are bound by confidentiality obligations.
5. Security measures
- Encryption of data in transit, and encryption of stored data and backups where the storage systems support it.
- Role-based access, strong authentication for administrative access, and least-privilege access for personnel.
- Logging and monitoring of access and security events.
- Regular backups and recovery procedures.
- Network protections, including firewalls and Cloudflare security services.
- Secure development practices and timely security updates.
- Erasure of returned Equipment before it is reused.
6. Sub-processors
You authorize CloudIP to use the following sub-processors, and those it adds as described below:
- Stripe (United States): payment processing, billing and tax calculation.
- EasyPost (United States): shipping labels, rates and tracking.
- OVHcloud (data centers in the United States): server hosting and storage.
- Cloudflare (United States): DNS, network security, and content and image delivery.
Marketplaces, carriers and other services you connect process data under their own terms, as independent parties acting at your direction, and are not CloudIP's sub-processors.
CloudIP will give notice of a new sub-processor at least 15 days before it starts processing Customer Personal Data, by updating this DPA and notifying account administrators. If you object on reasonable data protection grounds, CloudIP will discuss it with you in good faith; if the objection cannot be resolved, you may end the affected Subscription and CloudIP will refund prepaid fees for the unused period.
CloudIP requires each sub-processor to protect the data at least as well as this DPA does, and remains responsible for its sub-processors.
7. Security incidents
CloudIP will notify you without undue delay, and where feasible within 72 hours, after confirming a breach of security that leads to unauthorized access to, or loss of, Customer Personal Data, and will give you the information you reasonably need to meet your own obligations.
8. Assistance
Taking into account the nature of the processing, CloudIP will help you respond to requests from individuals, and carry out data protection assessments and consultations with authorities where the law requires them. If CloudIP receives a request about Customer Personal Data directly from an individual, it will refer the individual to you.
9. Deletion and return
You can export Customer Personal Data during your Subscription and for 30 days after it ends. CloudIP then deletes it, and backup copies are overwritten within a further 90 days, unless the law requires CloudIP to keep it.
10. Audits
On reasonable written request, and no more than once a year, CloudIP will provide the information needed to demonstrate its compliance with this DPA, such as answers to security questionnaires and summaries of relevant policies, under confidentiality.
11. International transfers
Customer Personal Data is stored in the United States. Where the law requires a transfer mechanism, such as the EU Standard Contractual Clauses or the UK Addendum to them, it is incorporated into this DPA by reference, with CloudIP as the data importer.
12. Liability
Each party's liability under this DPA is subject to the limitations in the Terms of Service.