Data Processing Agreement

1. Scope, Roles & Definitions

This DPA applies to all personal data that the Processor processes on behalf of the Controller in the course of providing the OTA-Pulse Cloud Services under the Terms ("Customer Personal Data"). The Controller is the controller (or, where it acts for its own customers, a processor) within the meaning of Art. 4 GDPR; the Processor processes the data as its processor (or sub-processor). Terms such as "personal data", "processing", "controller" and "supervisory authority" have the meaning given in the GDPR. Where the Processor processes personal data as controller (for example account and billing data of the customer's contact persons), the Privacy Policy applies instead.

2. Subject Matter, Duration, Nature & Purpose

Subject matter and purpose: hosting and operating the OTA-Pulse Cloud (over-the-air firmware deployment, fleet and device monitoring, crash and diagnostic reporting, remote SSH access) for the Controller. Nature of processing: collection, storage, organisation, retrieval, transmission, deletion and other operations required to provide those Services. Duration: the term of the contract under the Terms, plus the period needed for return and deletion under section 10. Details are in Annex I.

3. Data & Data Subjects

Types of personal data and categories of data subjects are listed in Annex I. The Controller determines which data it sends to the Services and must not transmit special categories of personal data (Art. 9 GDPR) unless it has agreed this with the Processor in advance.

4. Instructions

The Processor processes Customer Personal Data only on the Controller's documented instructions, unless required to do otherwise by Union or Member State law (in which case it informs the Controller beforehand, unless the law prohibits this). The Terms, this DPA and the Controller's configuration and use of the Services (including settings such as retention periods) are its complete initial instructions. Further instructions must be given in text form and, if they exceed the agreed Services, may be charged. The Processor will inform the Controller without undue delay if it considers an instruction to violate data protection law; it may suspend execution until the Controller confirms or changes the instruction.

5. Confidentiality & Personnel

The Processor ensures that persons authorised to process Customer Personal Data are bound to confidentiality or are under an appropriate statutory obligation of confidentiality, and that they process the data only as instructed. Access is limited to personnel who need it to provide the Services.

6. Technical & Organisational Measures

The Processor implements the measures described in Annex II, appropriate to the risk (Art. 32 GDPR). The measures are subject to technical progress; the Processor may implement alternative adequate measures provided the security level is not reduced materially.

7. Sub-processors

The Controller gives the Processor general written authorisation to engage sub-processors. The sub-processors engaged at the time this DPA takes effect are listed in Annex III. The Processor imposes on each sub-processor the same data protection obligations as set out in this DPA (Art. 28(4) GDPR) and remains liable to the Controller for their performance.

The Processor will inform the Controller of any intended addition or replacement of sub-processors at least 30 days in advance, in text form (for example by email to the account owner or by notice in the console) and by updating Annex III. The Controller may object on reasonable data-protection grounds within 30 days of the notice. If the parties cannot resolve the objection in good faith, the Controller may terminate the affected Services with effect from the date the change takes effect, without penalty; prepaid fees for the period after termination are refunded pro rata.

8. Assistance

Taking into account the nature of the processing, the Processor assists the Controller by appropriate technical and organisational measures in responding to requests from data subjects (Art. 12 to 22 GDPR). If a data subject contacts the Processor directly about Customer Personal Data, the Processor will refer them to the Controller and will not respond itself except on the Controller's instruction. The Processor also assists the Controller with its obligations under Art. 32 to 36 GDPR (security, breach notification, data protection impact assessments and prior consultation), taking into account the information available to it. Assistance beyond the standard functions of the Services may be charged at reasonable cost.

9. Personal Data Breaches

The Processor notifies the Controller without undue delay, and in any case within 48 hours after becoming aware of a personal data breach affecting Customer Personal Data (Art. 33(2) GDPR). The notification contains, as far as known, the nature of the breach, the categories and approximate numbers of data subjects and records concerned, the likely consequences and the measures taken or proposed. Where not all information is available at once, it is provided in phases. The Processor takes reasonable measures to contain the breach and to mitigate adverse effects.

10. Deletion & Return

After the end of the Services, the Processor makes Customer Personal Data available for export on request for a period of 30 days. After that period it deletes the data, including existing copies, unless Union or Member State law requires storage; data that must be retained is blocked from other use. Data covered by the Controller's configured retention settings (for example remote SSH recordings) is deleted automatically in accordance with those settings during the term. On request the Processor confirms the deletion in text form.

11. Audits & Information

The Processor makes available to the Controller the information necessary to demonstrate compliance with Art. 28 GDPR, in particular by answering reasonable written questions and providing available documentation, such as descriptions of its security measures. The Controller may, with at least 30 days' notice, no more than once a year (unless a supervisory authority requires otherwise or a personal data breach occurred) and during normal business hours, carry out or have carried out by a bound independent auditor an inspection of the Processor's compliance. Inspections must not disturb operations or compromise the confidentiality or security of other customers' data; the Processor may request reasonable reimbursement of its own effort. Where a sub-processor's own security infrastructure is concerned, the audit rights are exercised through the information that the sub-processor makes available.

12. International Transfers

Customer Personal Data is processed in the European Union/EEA unless Annex III states otherwise. Where a sub-processor processes data in a third country, the Processor ensures that an adequate level of protection is provided, in particular through an adequacy decision (such as the EU-US Data Privacy Framework for certified recipients) or the EU standard contractual clauses (Art. 44 ff. GDPR) with supplementary measures where required.

13. Liability & Precedence

Liability under this DPA is governed by the liability provisions of the Terms of Service (section 10); this does not affect the liability of the parties towards data subjects under Art. 82 GDPR. In case of conflict between this DPA and the Terms regarding the processing of personal data, this DPA prevails. German law applies, as stated in the Terms.

Annex I – Processing Details

Annex II – Technical & Organisational Measures

The following measures are implemented in the OTA-Pulse Cloud.

• Encryption in transit: all console and API traffic is served over HTTPS/TLS with HTTP Strict Transport Security.
• Encryption of sensitive fields: multi-factor-authentication secrets and payment-provider references are stored with application-level (Fernet) encryption; passwords are stored only as salted bcrypt hashes; payment card data is never stored by the Processor.
• Authentication: multi-factor authentication (TOTP) is supported and is mandatory for users with owner or administrator roles; session tokens are short-lived (access token 60 minutes) and delivered in HttpOnly, SameSite cookies; login, MFA and registration endpoints are rate limited; cross-site request forgery protection for cookie-authenticated requests.
• Access control: role-based access control per organisation; tenant data is scoped to the owning organisation; remote SSH access is tiered (standard, elevated, break-glass) with configurable approval workflows, recent-MFA requirements for elevated tiers, and mandatory recording for break-glass sessions.
• Integrity and logging: remote-access audit events are written to a tamper-evident, hash-chained audit log; privileged and billing actions are recorded in an audit log; uploaded firmware artifacts are checked against trusted signing keys configured for the deployment.
• Separation: billing and payment data is held in a separate database from operational data; the Controller's organisations are logically separated from those of other customers.
• Data minimisation and deletion: automatic deletion of remote SSH recordings after the configured retention period (default 90 days); redaction of personal content in stored billing webhook payloads after 90 days; log rotation of server access logs.
• Abuse and load protection: rate limiting, upload size and concurrency limits, and plan enforcement protect the availability of the Services.
• Physical and infrastructure security: servers are operated at the hosting provider's data centres, whose physical access control, power and network security are governed by the provider's own measures; access to our systems is restricted to authorised personnel.
• Organisation: personnel with access are bound to confidentiality; there is a published vulnerability-disclosure process (see our Security page).

The Processor does not currently hold third-party security certifications such as ISO 27001 or SOC 2; SOC 2 Type II is in progress as described on the Security page. Further measures may be added; the list above describes the measures in place when this version was published.

Annex III – Sub-processors

The current list is also published at /subprocessors, where you can find how to be notified of changes. Grafana, the object storage for recordings and the databases are operated by the Processor itself on the hosting infrastructure and are not separate sub-processors. Google (an independent controller for Sign-In) and the processors we use only for our own website (Formspree, Plausible) are not sub-processors for Customer Personal Data. Billing and payment data (Stripe) is the Processor's own controller data under section 1 and is therefore not listed here.

Contact

Questions about this DPA or requests for the current sub-processor list: binaryblack21@gmail.com.