GDPR Data Processing Agreement

Introduction

This DPA is concluded under Article 28 of Regulation (EU) 2016/679 (“GDPR”). For Customer Data in hosted Odoo environments, Cloudpepper is the Customer’s processor. This DPA does not make the Customer’s own use of Odoo, its infrastructure choices, its configuration, the rules of its industry or its legal basis compliant. Those remain the Customer’s responsibility.

1. Definitions

“Agreement” means the Customer Terms of Service or another written agreement under which Cloudpepper provides the Services. “Customer Data” means personal data that the Customer or its users submit to the Services or that Cloudpepper processes on the Customer’s behalf, including such data in logs, diagnostics, support records and backups. “Data Protection Laws” means the GDPR, the Belgian Act of 30 July 2018 and other data protection laws that apply to the processing. “Personal Data”, “Personal Data Breach”, “processing” and “Supervisory Authority” have the meaning given in the GDPR. “Services” means the managed Odoo hosting and related services under the Agreement. “Sub-processor” means a third party that Cloudpepper engages to process Customer Data on the Customer’s behalf. “Sub-processor List” means the dated list published at https://cloudpepper.io/subprocessors/.

2. Scope and roles

2.1 This DPA applies to the processing of Customer Data that Cloudpepper performs on the Customer’s behalf to provide the Services.

2.2 The Customer is the controller and Cloudpepper is the processor. Where the Customer acts as a processor for its own clients, Cloudpepper is a sub-processor and the Customer warrants that it holds the authorisations needed to engage Cloudpepper on these terms and transmits lawful instructions. The Customer coordinates its clients’ instructions and requests, passes relevant information from Cloudpepper on to them, and does not promise them obligations of Cloudpepper beyond this DPA. Cloudpepper accepts instructions through the Customer only.

2.3 Annex C describes the subject matter, nature, purpose and duration of the processing, the types of personal data and the categories of data subjects.

2.4 Cloudpepper is an independent controller, not a processor, for account data, billing records, support interactions and communications, website analytics and aggregated usage statistics. The Privacy Policy governs that data. Section 2.5 governs Customer Data that appears in support interactions.

2.5 Cloudpepper operates the Services with monitoring, diagnostics, error-tracking, support and communication tools. Fragments of Customer Data can appear in those tools. Cloudpepper processes such fragments only to provide, secure, monitor, troubleshoot and support the Services. Providers of such tools that process Customer Data appear on the Sub-processor List.

3. Instructions and Customer obligations

3.1 Cloudpepper processes Customer Data only on the Customer’s documented instructions, including instructions on international transfers, unless Union or Member State law requires otherwise. In that case Cloudpepper informs the Customer before processing, unless the law prohibits it on important grounds of public interest.

3.2 The Agreement, this DPA and the Customer’s configuration of the Services are the Customer’s complete documented instructions. An instruction that goes beyond the Services is a change request. Cloudpepper may decline a change request that is incompatible with its shared platform, and may charge for change requests it accepts. Where an instruction makes continued provision of the affected Services unlawful or technically incompatible with the shared platform, Cloudpepper may suspend the affected processing and terminate those Services on reasonable notice. Charges for those Services stop when they end, and Section 12 applies.

3.3 Cloudpepper informs the Customer immediately if, in its opinion, an instruction infringes Data Protection Laws. Cloudpepper may suspend that instruction until the Customer confirms or changes it.

3.4 The Customer is responsible for the lawful collection of Customer Data, for its legal basis, for the notices and consents that Data Protection Laws require, for the lawfulness of its instructions, for the configuration and use of its Odoo environment, for the fit of the Services with its activities and the rules that apply to them, and for keeping its own copies of data that it needs beyond the Services. The Customer keeps a current contact e-mail address in its account. The Customer reports to Cloudpepper without delay any irregularity it discovers in the processing, and gives Cloudpepper the information and cooperation it reasonably needs to investigate and to defend claims concerning Customer Data. Cloudpepper has no duty to inspect Customer Data for legality, accuracy or suitability. The Customer documents its instructions, keeps its own records of processing and, on request, documents its legal basis in writing. The Customer provides and updates the processing details that Cloudpepper reasonably needs for its own records under Article 30(2) GDPR. On the basis of Annex B, the Customer has assessed that Cloudpepper offers sufficient guarantees for the Customer’s processing. Requirements beyond Annex B apply only if agreed in writing; Cloudpepper is not obliged to accept them and may charge for those it accepts.

3.5 A third-party service that the Customer connects to the Services, including an AI assistant, is engaged by the Customer, not by Cloudpepper, and is not a Sub-processor. Its requests are the Customer’s instructions under Section 3.2.

4. Cloudpepper’s obligations

4.1 Cloudpepper ensures that persons authorised to process Customer Data are bound by contractual or statutory confidentiality and have access only as needed to provide the Services.

4.2 Cloudpepper complies with the obligations that Data Protection Laws impose on processors. Each party implements the additional safeguards that applicable law imposes on its own processing.

4.3 Taking into account the nature of the processing and the information available to it, Cloudpepper gives the Customer reasonable assistance with the Customer’s obligations under Articles 32 to 36 GDPR, for the aspects of the processing for which Cloudpepper is responsible under this DPA. Standard documentation is included in the Services. Customer-specific assistance is chargeable at Cloudpepper’s standard rates; Cloudpepper states the expected cost before it starts. Charges do not prevent assistance that Data Protection Laws require. Customer-specific return formats and deletion work beyond Cloudpepper’s standard procedures are chargeable in the same way.

5. Sub-processors

5.1 The Customer gives Cloudpepper general written authorisation to engage Sub-processors. The Sub-processor List identifies each Sub-processor, its role, its processing locations and the transfer mechanism that applies. The version of the Sub-processor List published on the date the Customer enters into this DPA forms part of this DPA. Only the identities, roles, locations, transfer mechanisms and version date on that page are incorporated; other text on the page does not amend this DPA.

5.2 Providers that do not process Customer Data, such as payment, accounting, telecommunications and postal providers, are not Sub-processors.

5.3 Cloudpepper imposes on each Sub-processor, in substance, the same data protection obligations as this DPA imposes on Cloudpepper for the processing delegated to it, through a written contract. Cloudpepper remains liable to the Customer for the performance of those obligations, subject to Section 13.

5.4 Before Cloudpepper adds or replaces a Sub-processor, it e-mails the Customer’s contact address and updates the Sub-processor List. The notice identifies the provider, its role, its locations and the transfer mechanism, and allows at least fourteen (14) days before the new Sub-processor processes Customer Data. For an urgent replacement needed to protect security or service continuity, Cloudpepper may give shorter reasonable notice, stating its reasons; the Customer keeps the opportunity to object before the new Sub-processor processes Customer Data.

5.5 The Customer may object in writing within the notice period, stating reasonable grounds relating to data protection. Cloudpepper may withdraw the change. Otherwise, either party may terminate the affected Services by written notice before the new Sub-processor processes the Customer’s data, without penalty. Cloudpepper does not entrust the objecting Customer’s data to the disputed Sub-processor before the objection is resolved or the affected Services end, and charges for those Services stop when they end. Cloudpepper is not obliged to provide an alternative to the notified change.

6. Customer-chosen infrastructure

6.1 Where the Services run on infrastructure that the Customer procures from a provider of its choice, that provider is engaged by the Customer, not by Cloudpepper. The Customer enters into its own data processing agreement with that provider, ensures an adequate level of protection, and implements any transfer mechanism that Data Protection Laws require.

6.2 Where the Customer selects a deployment tier that Cloudpepper offers, the infrastructure provider for that tier is a Sub-processor of Cloudpepper and appears on the Sub-processor List. The Customer selects the region.

6.3 On Customer-chosen infrastructure, Cloudpepper remains processor for its own management, support and operational activities, and Sections 4, 7 and 8 apply to those activities. Cloudpepper is not responsible for the security, availability or compliance of the underlying infrastructure.

7. Security

7.1 Cloudpepper implements the technical and organisational measures in Annex B, which provide a level of security appropriate to the risk in accordance with Article 32 GDPR. This is an obligation of means. Cloudpepper does not warrant that the Services prevent every Personal Data Breach; this does not limit its obligations under Article 32 GDPR and Annex B.

7.2 Cloudpepper may update Annex B to reflect technical progress or new threats, provided the level of protection that Article 32 GDPR requires is maintained. The current version is published with this DPA.

7.3 The Customer is responsible for the secure configuration and use of the Services, including access credentials, user permissions, multi-factor authentication, the security of application logic it deploys, the activation of optional security features such as encrypted backups, and the security of infrastructure and storage that the Customer controls.

8. Personal Data Breach

8.1 Cloudpepper notifies the Customer’s contact address without undue delay after it has established with reasonable certainty that a Personal Data Breach affects Customer Data processed under this DPA, including by a Sub-processor. The notification contains the information that Cloudpepper has at the time, and Cloudpepper provides further information in phases as it becomes available.

8.2 Cloudpepper reasonably cooperates with the Customer’s investigation. The Customer decides on, and is responsible for, its own notifications to Supervisory Authorities and data subjects.

8.3 A notification or response under this Section is not an admission of fault or liability.

9. Information and audits

9.1 On request, Cloudpepper makes available the information necessary to demonstrate compliance with Article 28 GDPR, first through documentation and written answers. Cloudpepper may demonstrate compliance through a recognised certification or an independent audit report where it holds one. Information provided under this Section is Cloudpepper’s confidential information.

9.2 Where documentation is not sufficient, and the Customer states the reasons why, the Customer, or an independent auditor it mandates who is not a competitor of Cloudpepper and is bound by confidentiality, may audit Cloudpepper’s compliance with this DPA once in any twenty-four (24) month period, on at least thirty (30) days’ written notice, during business hours, with the scope notified in advance, and in a way that does not disrupt Cloudpepper’s operations or affect other customers. Audits take place remotely, through document review, interviews and screen-sharing sessions with Cloudpepper personnel. Data centres are operated by Sub-processors; Cloudpepper provides their certifications and audit reports where it holds them. Cloudpepper may refuse an audit step that would breach the law or compromise the security of the Services or of other customers. The Customer bears its own costs. Cloudpepper may charge its time for audit assistance beyond providing its standard documentation at its standard rates.

9.3 The frequency and notice limits in Section 9.2 do not apply where a Supervisory Authority requires an audit, after a Personal Data Breach that affects the Customer, or on documented evidence of non-compliance with this DPA. Where documentation and remote verification are not sufficient for an audit that Article 28(3)(h) GDPR requires, the parties agree on a proportionate form of inspection, with safeguards for the security of the Services and other customers’ data. The other conditions of Section 9.2 apply only insofar as they do not prevent or unduly delay an audit that Article 28(3)(h) GDPR requires. Audit charges are reasonable and do not make that right ineffective.

10. International transfers

10.1 Cloudpepper hosts its management platform and Cloudpepper-managed backup storage in the EEA. Processing locations of Sub-processors follow the Sub-processor List and the deployment the Customer selects.

10.2 Where a Sub-processor processes Customer Data outside the EEA, an adequacy decision or another appropriate safeguard under Chapter V GDPR applies between the actual exporter and importer, as shown on the Sub-processor List.

10.3 Where the Customer procures a provider outside the EEA, the Customer is responsible for that transfer under Section 6.1. Where the Customer selects a region outside the EEA for a deployment tier that Cloudpepper offers, that selection is the Customer’s instruction, and Section 10.2 applies to the Sub-processor concerned.

11. Data subject rights

11.1 Taking into account the nature of the processing, Cloudpepper assists the Customer, insofar as possible, with appropriate measures to respond to data subject requests, primarily through the functions of the Services. Section 4.3 applies to costs.

11.2 If Cloudpepper receives a request from a data subject about Customer Data, it forwards the request to the Customer and does not respond, unless the law requires it or the Customer instructs it. The Customer remains responsible for handling data subject requests. Cloudpepper is not liable to the extent that a late, incorrect or missing response results from the Customer’s acts or omissions rather than from a breach of this DPA by Cloudpepper.

12. Return or deletion

12.1 Before termination, the Customer can export its data through the export functions and formats of the Services; other formats and migration work require separate agreement under Section 4.3. Unless the Customer requests return before termination, termination is the Customer’s standing instruction to delete Customer Data.

12.2 After termination, Cloudpepper deletes Customer Data from the production systems it operates within thirty (30) days. All other copies, including backup copies on Cloudpepper-managed storage and copies held by Sub-processors, are deleted no later than twelve (12) months after termination, and earlier on the Customer’s written request. Union or Member State law that requires retention is an exception.

12.3 Copies in storage that the Customer controls remain the Customer’s responsibility. Statutory rights to retrieve data remain unaffected. Where Chapter VI of Regulation (EU) 2023/2854 (Data Act) applies, its switching, retrieval and erasure rights prevail over Sections 4.3 and 12, and charges for statutory switching assistance do not exceed what that Regulation permits.

12.4 On request, Cloudpepper confirms completed deletion in writing.

13. Liability and term

13.1 Each party’s liability under this DPA is subject to the limitations and exclusions of liability in the Agreement. Those limitations also govern, between the parties, the allocation of compensation paid to third parties under Article 82 GDPR. A fine that a Supervisory Authority imposes on the Customer cannot be recovered from Cloudpepper, except in case of intentional fault of Cloudpepper or of persons for whom it is responsible. The Customer reimburses Cloudpepper for reasonable defence costs and compensation payable to third parties to the extent caused by the Customer’s breach of this DPA or by unlawful instructions; this excludes amounts attributable to Cloudpepper or its Sub-processors. To the extent permitted by law, the Customer brings claims for non-performance of this DPA against Cloudpepper and not against its personnel or Sub-processors, and the limitations in the Agreement apply to contractual and extra-contractual claims alike. Nothing in this DPA limits liability that applicable law does not allow to be limited, the rights of data subjects, or liability under transfer clauses that apply.

13.2 This DPA takes effect with the Agreement and remains in effect for as long as Cloudpepper or its Sub-processors hold Customer Data.

14. Governing law and jurisdiction

Belgian law governs this DPA. The competent courts of Brussels, Belgium, have exclusive jurisdiction between the parties, without prejudice to mandatory jurisdiction rules, to transfer clauses that apply, and to a data subject’s rights under Article 79 GDPR.

15. Miscellaneous

15.1 For the processing of Customer Data, this DPA prevails over the Agreement, and transfer clauses that apply prevail over this DPA. Section 13.1 remains effective.

15.2 Cloudpepper may amend this DPA where reasonably necessary to comply with Data Protection Laws or guidance of Supervisory Authorities, or to reflect changes to the Services that do not materially reduce the Customer’s protection. Cloudpepper notifies material amendments at least thirty (30) days before they take effect. This DPA may be replaced by a new data processing agreement that the Customer accepts, without ending the Agreement.

15.3 If a provision is invalid, the rest of this DPA remains in force.

15.4 Cloudpepper’s logs and records are admissible evidence of the facts they record, subject to proof to the contrary by any lawful means.

15.5 The Customer’s own data processing terms do not apply unless Cloudpepper accepts them in writing.

15.6 This DPA and the Agreement are the entire agreement between the parties on the processing of Customer Data.

15.7 Notices under this DPA go to privacy@cloudpepper.io and to the Customer’s contact address.

Annex A — Sub-processors

The Sub-processor List at https://cloudpepper.io/subprocessors/ identifies each Sub-processor, its purpose, its processing locations and the transfer mechanism that applies. The version published on the date the Customer enters into this DPA forms part of this DPA. Cloudpepper updates the list and notifies the Customer under Section 5.

Annex B — Technical and organisational measures

These measures cover Cloudpepper’s platform and its managed-service operations. Components, storage and backup settings that the Customer controls, and infrastructure the Customer procures, are outside their scope.

• Access control: administrative access to Customer environments is limited to authorised Cloudpepper personnel with individual credentials, for service needs, and is removed when no longer needed.
• Separation: Customer environments are separated by access controls and separate credentials per environment.
• Transport security: connections to the platform and to hosted environments use TLS.
• Maintenance: managed operating systems and Odoo runtimes receive security updates through the platform.
• Backups and recovery: backups run as the Customer configures them; a restore procedure exists.
• Personnel: personnel are bound to confidentiality.
• Incidents: incidents are assessed, contained and notified under Section 8.
• Review: Cloudpepper reviews its measures regularly.
• Cloudpepper may replace measures with alternative measures that maintain the overall level of protection.

Annex C — Description of processing