Data Processing Agreement

This Data Processing Agreement (“DPA”) is between you, the customer, and WattleCloud Pty Ltd (ABN 97 703 308 605), trading as Wattle Cloud (“we”). It forms part of our Terms of Service and applies whenever we process personal information in your content on your behalf. If it conflicts with the Terms of Service about personal information, this DPA wins.

“Your content” means what you deploy, store or send through the services, such as code, files, databases and game worlds. “Data protection law” means the laws that apply to processing it, including the UK GDPR and Data Protection Act 2018, the EU GDPR, and the Australian Privacy Act 1988. Words like “controller”, “processor”, “personal data breach” and “data subject” have the meanings those laws give them.

This DPA doesn't cover information we collect about you to run your account. Our Privacy Policy does.

You're the controller of personal information in your content, or a processor acting for your own customer. We're your processor, or your sub-processor.

You decide what personal information goes into your content, why, and for how long. You're responsible for having a lawful basis for it, giving people the notices the law requires, and the instructions you give us. Annex 1 describes the processing.

When we process personal information in your content, we will:

• process it only to provide the services and on your documented instructions. Your instructions are our Terms of Service, this DPA, and the way you set up and use the services. If the law requires us to process it in another way, we'll tell you first, unless the law forbids that. If we think an instruction breaks data protection law, we'll tell you
• make sure everyone at Wattle Cloud who can access it is bound to keep it confidential, and can access it only when their work needs it
• protect it with the technical and organisational measures in Annex 2, and keep them at least that strong
• not access your content except as our Terms of Service allow: to provide the services, when you ask us to, to investigate abuse or a breach of our terms, or when the law requires it
• help you, as far as we reasonably can given what we know, to respond to people exercising their rights, and to meet your obligations on security, breach notification, impact assessments and consulting regulators
• not sell it, or use it for our own purposes, advertising, or to train AI models

If we become aware of a personal data breach affecting personal information in your content, we'll tell the owners and admins of the affected workspace without undue delay, and within 48 hours of confirming it. We'll tell you what we know: what happened, the kinds and rough amount of information involved, the likely consequences, and what we're doing about it. We'll keep you updated as we learn more.

Telling you about a breach isn't an admission of fault. Our help with a breach is free unless you caused it.

You agree that we can use the providers listed on our Service Providers page to help provide the services. We use each one under written terms that protect personal information at least as well as this DPA, and we're responsible for what they do.

Before we add or replace a provider that handles personal information in your content, we'll update that page and email your workspace's owners and admins at least 30 days ahead. If you object on reasonable data protection grounds, tell us within that time. We'll try to find a way to keep using the services without that provider. If we can't, you can stop using the affected service or close your account, and we'll refund anything you've prepaid for the time after that.

Your apps, databases and game servers, and their backups, stay in the region you choose, apart from the off-site backup copies described in Annex 2. Our team is in Australia, so personal information may be accessed from Australia, for example when we give you support.

Where data protection law restricts a transfer of personal information in your content out of the UK or the European Economic Area, including to Australia, the transfer is covered by:

• from the EEA: the standard contractual clauses approved by the European Commission in Decision 2021/914, Module Two (controller to processor) or Module Three (processor to processor), which are incorporated into this DPA by reference
• from the UK: those clauses together with the International Data Transfer Addendum issued by the UK Information Commissioner (version B1.0), also incorporated by reference, with the details in Annex 4

If those mechanisms change or stop being valid, we'll work with you to put another lawful safeguard in place.

You can export your databases and files at any time while your account is open. When your account closes, we keep your content for the export period our Terms of Service describe, then delete it. Copies in backups are deleted as those backups expire, within 7 days, and the off-site copies about a day after that. We keep personal information longer only where the law requires it.

We'll give you the information you reasonably need to show that we meet this DPA, such as answers to security questionnaires and descriptions of our measures.

If that isn't enough, you or an independent auditor you choose (who isn't our competitor and agrees to keep what they learn confidential) may audit our compliance once a year, on 30 days' notice, during business hours, at your cost, and without access to other customers' data. You can audit more often if a regulator requires it, or after a personal data breach affecting your content.

If the Privacy Act 1988 applies to you, we'll handle personal information in your content only to provide the services to you, take reasonable steps to protect it from misuse, interference, loss and unauthorised access, and help you meet your obligations under the Australian Privacy Principles and the Notifiable Data Breaches scheme.

The limits on liability in our Terms of Service apply to this DPA, except where data protection law doesn't allow them to.

Keeping customers apart

• Customers' apps run in gVisor sandboxes, inside virtual machines that run only customer workloads.
• Each environment has its own private network. A firewall on every server blocks traffic between customers, to our own systems, and to private networks, and blocks outgoing email on port 25.
• Customers' database accounts aren't superusers, and each database engine is locked down so its account can't run operating system commands or read the server's files.
• Builds run in throwaway micro-virtual machines that are deleted after each build, with build caches kept per app.

Protecting data

• Connections to the dashboard, the API and hosted apps are encrypted with TLS. Database connections from your computer go through an encrypted tunnel, with no database port open to the internet.
• Database passwords and your variables are encrypted in our control database (AES-256-GCM).
• Databases and volumes are backed up continuously or at least daily. Backups are kept on a separate backup server, and copied off site every hour, encrypted before they leave with keys only we hold, to storage that stops them being deleted or changed for 7 days.
• We test restoring a database of every engine every week.
• What your services print is kept for 7 days, in the same region, and only your workspace can read it.

Controlling access

• Our team signs in to staff tools with two-factor authentication. Every staff action is recorded in an audit log.
• Servers are managed only through a private network, with no management access from the internet.
• Inside your workspace, people have roles, sign-ins can use passkeys and two-factor authentication, and API tokens have scopes and can expire.
• A delete made with an API token, the command line tool or an AI agent waits 48 hours, so it can be undone.

Detecting and responding

• Servers and services are monitored, and our team is alerted at any hour when one stops answering.
• We check for abuse, such as phishing sites and cryptocurrency mining, and act on reports as our Acceptable Use Policy describes.
• We keep our servers' software up to date and apply security fixes promptly.
• We review our code and systems for security problems and fix what we find. We're also arranging an independent test of our security (a penetration test).

Our current providers, what each does and where, are listed on our Service Providers page, which forms part of this DPA.

For the International Data Transfer Addendum in International transfers:

• Table 1 (parties): the exporter is you, as described in your account; the importer is WattleCloud Pty Ltd, trading as Wattle Cloud, ABN 97 703 308 605, at the address below, contact support@wattlecloud.com
• Table 2 (selected clauses): the EU standard contractual clauses described in International transfers, Module Two or Three, with clause 7 (docking) applying, clause 9 option 2 (general written authorisation, with the notice in Our providers), and the optional wording in clause 11 not applying
• Table 3 (appendix information): Annex 1 and Annex 2 of this DPA, and our Service Providers page
• Table 4 (ending the Addendum when it changes): either party may end it, as section 19 of the Addendum allows

For a signed copy, security questions or anything about this DPA, email support@wattlecloud.com with “Privacy” in the subject line.

Business

WattleCloud Pty Ltd, trading as Wattle Cloud

ABN

97 703 308 605

Address

PO Box 827, Upper Coomera QLD 4209

Email

support@wattlecloud.com