1. Scope and Roles
This Data Processing Addendum (“DPA”) forms part of the Agreement when MSPClouds processes Personal Data contained in Customer Data on behalf of Customer and applicable Data Protection Law requires processor/service-provider terms. Customer is controller/business or processor as applicable; MSPClouds is processor/service provider or subprocessor as applicable.
2. Documented Instructions
MSPClouds will process Customer Personal Data only on documented instructions from Customer, including instructions inherent in Customer’s configuration and use of the Services, to provide, secure, support, and maintain the Services, and as required by law. MSPClouds will inform Customer if, in its reasonable view, an instruction violates applicable Data Protection Law unless prohibited from doing so.
3. Confidentiality and Security
Personnel authorized to process Customer Personal Data are subject to confidentiality obligations. MSPClouds will maintain appropriate technical and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, taking into account the nature of processing and risk.
4. Subprocessors
Customer generally authorizes MSPClouds to use subprocessors to provide the Services. MSPClouds will require subprocessors that process Customer Personal Data to protect it under written terms materially consistent with applicable processor obligations. MSPClouds remains responsible for its subprocessors to the extent required by applicable law. On request, MSPClouds will provide current subprocessor information and a reasonable process for legally required objections.
5. Security Incidents
MSPClouds will notify Customer without undue delay after becoming aware of a confirmed personal-data breach affecting Customer Personal Data where notification is required by applicable law. Notification does not constitute an admission of fault. MSPClouds will provide reasonably available information and cooperation appropriate to its role.
6. Data Subject Requests
Taking into account the nature of processing, MSPClouds will provide reasonable assistance through available functionality or support so Customer can respond to legally valid data-subject requests. If MSPClouds receives a request relating to Customer Personal Data, it may direct the requester to Customer unless law requires otherwise.
7. DPIAs and Regulatory Cooperation
Taking into account the nature of processing and information available to MSPClouds, MSPClouds will provide reasonable information needed for Customer’s legally required data-protection impact assessment or consultation with a supervisory authority, subject to confidentiality and reasonable scope.
8. Return and Deletion
During the Service term, Customer may export Customer Data using available tools. Following termination, MSPClouds will delete or return Customer Personal Data in accordance with the Agreement, normal backup cycles, and applicable law, unless retention is legally required.
9. Audits
MSPClouds will make available information reasonably necessary to demonstrate compliance with applicable processor obligations. Where legally required and documentation is insufficient, Customer may request an audit no more than annually, during normal business hours, on reasonable advance notice, by an independent auditor bound by confidentiality, without accessing other customers’ data or creating security risk. Customer bears its audit costs unless law requires otherwise.
10. International Transfers
For Restricted Transfers of Customer Personal Data from the EEA to a country without an adequacy decision, the applicable modules of the European Commission Standard Contractual Clauses adopted by Implementing Decision (EU) 2021/914 are incorporated by reference where required. For UK Restricted Transfers, the applicable UK International Data Transfer Addendum to the EU SCCs applies where required. For Switzerland, references are adapted as required by Swiss law. The parties will cooperate on supplementary measures reasonably required by law.
11. CCPA/State Service Provider Terms
Where the CCPA/CPRA or similar U.S. state law applies and MSPClouds acts as a service provider/processor, MSPClouds will process covered personal information for the limited business purposes specified in the Agreement, will not sell or share it except as permitted by law, will not retain/use/disclose it outside the direct business relationship except as permitted, and will provide required assistance and contractual protections.
12. Processing Details
Subject matter: provision of cloud infrastructure, storage, networking, migration, and support. Duration: the Service term plus limited retention/deletion periods. Nature/purpose: hosting, storage, transmission, backup if purchased, support, security, and administration. Data subjects may include Customer personnel, Customer end users, clients, suppliers, and other persons whose data Customer submits. Categories are determined by Customer and may include identifiers, contact data, account data, business data, application content, logs, and other data submitted by Customer. Customer must not submit regulated/special-category data unless the Service and Agreement expressly support it.
13. Precedence and Liability
If this DPA conflicts with the Agreement on processing of Customer Personal Data, this DPA controls for that subject. SCCs control over conflicting terms to the extent legally required. Liability under this DPA is subject to the Agreement’s liability provisions except where applicable law or incorporated SCCs prohibit that limitation.