Data Processing Agreement (DPA)
Data processing agreement pursuant to Article 28 of Regulation (EU) 2016/679 (GDPR).
1. Parties
The Customer (data controller) and khirucode SL (hereinafter, K3bone), Tax ID B01542018, registered office at Calle Lanciego, 52, bajo, 01015 Vitoria-Gasteiz (Araba, Spain), providing the service under the trade name K3bone ([email]), as data processor.
2. Subject matter and duration
K3bone processes personal data on behalf of the Customer in order to provide the hosting service and, where enabled, the backup service. This agreement lasts for as long as the contracted service.
3. Data and data subjects
The personal data that the Customer hosts in its account (files, databases and email accounts), relating to its users, customers, contacts and other data subjects. K3bone does not know or access its content except where technically necessary to provide the service.
4. Instructions
K3bone processes the data only on the Customer's documented instructions, which are this agreement, the contracting of the service and requests made through the support channels. If it considers that an instruction infringes the applicable regulations, it will inform the Customer. No transfers outside the European Economic Area take place in the hosting and backup service.
5. Confidentiality
K3bone staff with access to the data are bound by a duty of confidentiality.
6. Security
K3bone applies the technical and organisational measures described in Annex I.
7. Sub-processors
The Customer gives general authorisation for the sub-processors listed in Annex II. Any change will be notified 15 days in advance by email to the address registered in the client area. During that period the Customer may object; if no agreement is reached, the Customer may terminate the service. K3bone will impose obligations equivalent to those of this agreement on its sub-processors and will remain liable to the Customer for their compliance.
8. Assistance to the controller
K3bone will assist the Customer, to a reasonable extent, in responding to data subjects' requests and in complying with its obligations regarding security, breach notification and impact assessments.
9. Personal data breaches
K3bone will notify the Customer without undue delay, and in any case within [48 hours] of becoming aware of it, of any security breach affecting its data.
10. Backups
Backups are a complementary, free and non-contractual service. K3bone recommends that the Customer makes its own backups. The Customer may choose between (a) regular backups, (b) backups only on encrypted destinations, or (c) no backups, or request exclusion through the support channels. Retention: the last 30 daily incremental backups and the last 4 monthly backups.
11. Deletion and return
When the service ends, K3bone will immediately delete the data from the hosting servers and all account backups, on all destinations, 30 days after termination. Temporary suspension for non-payment does not imply deletion of data. Before termination, the Customer may request a copy of its data.
12. Audit
K3bone will make available to the Customer the information necessary to demonstrate compliance with this agreement and will allow reasonable audits, with prior notice and without affecting other customers.
Annex I. Security measures
- Monthly backups on an owned server in Vitoria-Gasteiz, encrypted, with access restricted to K3bone staff.
- Daily backups transferred via SSH (encrypted in transit) to a VPS in France.
- Direct administration of the servers by K3bone.
- Continuous monitoring of servers and services to detect and respond to security incidents.
- Regular software updates and security patches on all servers.
- Implementation of firewalls and intrusion detection systems to protect the servers and Customer data.
- Access control and two-factor authentication for personnel managing the servers.
- Periodic review of access and activity logs to detect potential security incidents.
- Continuous training of personnel in security best practices and data protection.
Annex II. Sub-processors
| Sub-processor | Service | Location |
|---|---|---|
| Arsys | Hosting server infrastructure | Logroño, Spain |
| OVH | Storage of daily incremental backups (customers with regular backups) | France |
Hosting and backup processing takes place within the European Economic Area.