1. Purpose and scope
1.1 Purpose. This Data Processing Agreement (the "DPA") forms part of the Master Services Agreement between DCXPS SE ("DCXPS") and the Customer (the "Agreement"). It is the contract required by Article 28(3) of Regulation (EU) 2016/679 (the "GDPR") for the processing of personal data contained in Customer Data that DCXPS, as processor, carries out on behalf of the Customer, as controller, in providing the Services.
1.2 Annexes. Annex A describes the processing. Annex B sets out the technical and organizational measures. Annex C lists the authorized sub-processors. Annex D sets out the additional rules for requests from public authorities. The Annexes form part of this DPA.
1.3 Customer acting as processor. Where the Customer acts as a processor on behalf of its own controllers, the Customer warrants that it is authorized to engage DCXPS as a sub-processor on the terms of this DPA and that its instructions to DCXPS reflect the instructions of those controllers. The Customer is the sole point of contact of DCXPS for those controllers.
1.4 Account Data. Account Data is outside this DPA. DCXPS processes Account Data as a controller under the Privacy Notice (Annex 06) (clause 12.1 of the Agreement).
2. Interpretation and precedence
2.1 Interpretation. Terms defined in the GDPR have the same meaning in this DPA. Capitalized terms not defined in this DPA have the meaning given in the Agreement, and clause 1.2 of the Agreement applies to this DPA. In this DPA a reference to a clause is to a clause of the Agreement, a reference to a section is to a section of this DPA, and a reference to Annex A, B, C or D is to that Annex to this DPA.
2.2 Precedence. In the event of conflict, this DPA prevails over the Agreement and over the other Annexes to the Agreement in respect of personal data (clause 2.3(a) of the Agreement). No provision of this DPA or of the Agreement limits or reduces the protection that the GDPR gives to data subjects.
2.3 Platform Terms of Service. Where the Customer has accepted the Platform Terms of Service (Annex 07) without concluding the Agreement, this DPA applies to the Orders placed under those Terms, and references in this DPA to the Agreement and to its clauses are read in accordance with clause 1.3 of the Platform Terms of Service.
3. Description of the processing
3.1 Processing details. The subject matter and duration of the processing, the nature and purposes of the processing, the types of personal data and the categories of data subjects are set out in Annex A, as completed by the Customer in the Order.
3.2 Scope of DCXPS's processing. DCXPS processes personal data in Customer Data only by hosting, storing, transmitting and performing computation on Customer Data on the servers and the dedicated storage allocated to the Customer, by backing it up where the Order includes managed backup, by operating the Platform and by maintaining the servers and the Platform. DCXPS personnel access Customer Data only where strictly necessary for provisioning, security or support, under ticketed, logged and time-bound elevation of privileges, and only within the documented instructions under section 4.1 (clause 4.6 of the Agreement).
3.3 Obligations and rights of the Customer. The Customer determines the purposes and means of the processing of personal data in Customer Data and is responsible for its lawfulness, including the legal basis for the processing and the information of data subjects (clause 7.2 of the Agreement). The Customer gives DCXPS its instructions under section 4.1 and has the rights set out in this DPA, including the rights to object under section 5.2, to audit under section 8.3 and to suspend and withdraw under section 10.
3.4 Duration. This DPA applies from the Effective Date for as long as DCXPS processes personal data in Customer Data, including during the Retrieval Period, and until all copies have been deleted under section 7.
4. Instructions, confidentiality and security (Article 28(3)(a) to (c) of the GDPR)
4.1 Documented instructions (Article 28(3)(a) of the GDPR). DCXPS shall process personal data only on documented instructions from the Customer, including with regard to transfers of personal data to a Third Country or an international organization, unless Union or Member State law to which DCXPS is subject requires it to do so. In that case DCXPS shall inform the Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest. The documented instructions are the Agreement, the Order, the configuration choices the Customer makes through the controls of the Platform and the further instructions the Customer gives in writing, including through the Platform ticketing system, during the processing. An instruction that would change the scope of the Services ordered takes effect only through a new or amended Order.
4.2 Unlawful instructions (Article 28(3), second subparagraph, of the GDPR). DCXPS shall immediately inform the Customer if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions. DCXPS may suspend the execution of that instruction until the Customer withdraws it, amends it or confirms it in writing, and is not obliged to execute an instruction that would infringe the law. Where the Customer maintains the instruction, section 10.3 applies.
4.3 Purpose limitation. DCXPS shall process personal data only for the purposes set out in Annex A. DCXPS shall not process Customer Data for its own purposes and shall not use Customer Data to train, fine-tune, evaluate or improve any AI model or system, whether its own or a third party's (clause 6.8 of the Agreement).
4.4 Location and transfers. DCXPS shall process personal data only in the Union. DCXPS shall not transfer personal data to a Third Country or an international organization and shall not permit access to personal data from a Third Country, whether by DCXPS, its Affiliates or its sub-processors (clauses 6.1, 6.3 and 12.2 of the Agreement). Where Union or Member State law to which DCXPS is subject requires a transfer, section 4.1 applies to the information of the Customer, section 9 applies to the handling of the request, and DCXPS makes the transfer only under Chapter V of the GDPR.
4.5 Confidentiality (Article 28(3)(b) of the GDPR). DCXPS shall ensure that every person it authorizes to process personal data has committed to confidentiality in writing or is under an appropriate statutory obligation of confidentiality. DCXPS grants access to personal data only to personnel who satisfy clause 6.7 of the Agreement and the personnel criteria in Annex 08, Part B, section B.5, and only to the extent strictly necessary for the Services.
4.6 Security of processing (Article 28(3)(c) of the GDPR). DCXPS shall implement and maintain the technical and organizational measures set out in Annex B to ensure a level of security appropriate to the risk, as required by Article 32 of the GDPR, taking into account the factors listed in Article 32(1) of the GDPR. The measures include, as appropriate:
(a) the pseudonymization and encryption of personal data;
(b) the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;
(c) the ability to restore the availability of and access to personal data in a timely manner in the event of a physical or technical incident; and
(d) a process for regularly testing, assessing and evaluating the effectiveness of the measures.
4.7 Changes to the measures. DCXPS may strengthen a measure in Annex B by notice through the Platform. Any other change to Annex B requires the written agreement of the Parties (clause 26.2 of the Agreement).
4.8 Responsibilities of the Customer. The Customer is responsible for the security of the software, workloads and configurations it operates on its servers above the Pre-installed AI Stack, for the encryption keys and credentials it holds and, unless the Order includes managed backup, for the backup of Customer Data (clauses 7.4, 7.5 and 13.3 of the Agreement).
4.9 Special categories of personal data. Where the processing involves special categories of personal data under Article 9 of the GDPR or personal data relating to criminal convictions and offenses under Article 10 of the GDPR, the Customer shall state so in the Order, and DCXPS shall apply the additional measures in Annex B, item 11.
5. Sub-processors (Article 28(2), (3)(d) and (4) of the GDPR)
5.1 General authorization. The Customer gives DCXPS its general written authorization under Article 28(2) of the GDPR to engage the sub-processors listed in Annex C. Each sub-processor is established in the Union, processes personal data only in the Union and is not controlled by a person established in a Third Country (clause 12.3 of the Agreement; Annex 08, Part B, section B.4).
5.2 Changes and objection. DCXPS shall inform the Customer through the Platform and by e-mail at least thirty (30) days before engaging a new sub-processor or replacing a listed sub-processor, stating its identity (or, for a sub-processor that Annex C identifies by its function, that function, with its identity available under Annex C), registered seat, service, location of processing and the personal data to which it has access. The Customer may object within that period on reasonable grounds relating to data protection, security or the Sovereignty Commitments. If the objection is not resolved before the end of the notice period, the Customer may terminate the affected Order under clause 23.2 of the Agreement by notice through the Platform, and DCXPS refunds the Term Fee pro rata for the unused part of the Service Period (clause 8.8(a) of the Agreement). Clause 10 of the Agreement applies to the retrieval of Customer Data.
5.3 Flow-down (Article 28(4) of the GDPR). DCXPS shall impose on each sub-processor, by a written contract, the same data protection obligations as those set out in this DPA, in particular sufficient guarantees to implement appropriate technical and organizational measures, the obligations on location, personnel and confidentiality and the prohibition of training on Customer Data. DCXPS remains fully liable to the Customer for the performance of each sub-processor's obligations as for its own, and section 11 applies to that liability. DCXPS provides the Customer on request with a copy of each sub-processor contract, with commercial terms and other confidential information redacted. DCXPS notifies the Customer of any failure by a sub-processor to fulfil its data protection obligations that affects personal data in Customer Data.
5.4 Physical access. A sub-processor whose role is limited to facility or hardware maintenance has no logical access to Customer Data and works on the Customer's servers only under escort by DCXPS personnel who satisfy Annex 08, Part B, section B.5.
5.5 Position of DCXPS Inc. DCXPS Inc. is not a sub-processor, has no access to personal data in Customer Data and performs no function in the processing (clause 6.3 of the Agreement).
6. Assistance to the Customer (Article 28(3)(e) and (f) of the GDPR)
6.1 Data subject requests (Article 28(3)(e) of the GDPR). DCXPS shall inform the Customer without undue delay of any request it receives directly from a data subject concerning personal data in Customer Data and shall not respond to the request except on the Customer's documented instruction. Taking into account the nature of the processing, DCXPS shall assist the Customer by appropriate technical and organizational measures, insofar as this is possible, in fulfilling the Customer's obligation to respond to requests for the exercise of the data subject's rights under Chapter III of the GDPR. The Customer carries out the access to, and the rectification, restriction, erasure and export of, personal data in Customer Data itself through the controls of its servers and the Platform. Where the Customer cannot do so, DCXPS executes the Customer's written instruction within ten (10) Business Days.
6.2 Compliance with Articles 32 to 36 of the GDPR (Article 28(3)(f) of the GDPR). Taking into account the nature of the processing and the information available to DCXPS, DCXPS shall assist the Customer in ensuring compliance with its obligations under Articles 32 to 36 of the GDPR by:
(a) implementing the measures in Annex B and providing the information, reports and certifications under section 8;
(b) notifying personal data breaches under section 6.3 and cooperating in their handling;
(c) providing the information on the processing that the Customer reasonably requires for a data protection impact assessment under Article 35 of the GDPR; and
(d) providing the information that the Customer reasonably requires for a prior consultation of the supervisory authority under Article 36 of the GDPR.
6.3 Personal data breach. DCXPS shall notify the Customer of a personal data breach affecting personal data in Customer Data without undue delay and in any event within twenty-four (24) hours after becoming aware of it, through the Platform and by e-mail to the contacts designated in the Platform account (Article 33(2) of the GDPR; clause 13.2 of the Agreement). The notification contains the information then available on:
(a) the nature of the breach, including, where possible, the categories and approximate number of data subjects and of personal data records concerned;
(b) the likely consequences of the breach;
(c) the measures taken or proposed to address the breach and to mitigate its possible adverse effects; and
(d) a contact point for further information.
DCXPS supplements the notification without undue delay as further information becomes available, so that the Customer can meet the seventy-two (72) hour period in Article 33(1) of the GDPR. DCXPS cooperates with the Customer in investigating, containing and remedying the breach and delivers a final report within thirty (30) days. DCXPS notifies a breach affecting Customer Data to a supervisory authority or to data subjects only on the Customer's documented instruction or where the law requires it.
6.4 Costs of assistance. DCXPS provides at no charge the assistance under sections 6.1 to 6.3 that the functions of the Platform support and all assistance with a personal data breach attributable to DCXPS. DCXPS charges other assistance at the rates for additional engineering hours shown in the Platform or stated in the Order Schedule, after informing the Customer of the estimated charge, and draws the charge from the Prepaid Balance. For a Customer that is a financial entity, Annex 08, Part E applies to assistance with ICT-related incidents.
7. Deletion and return (Article 28(3)(g) of the GDPR)
7.1 Choice of the Customer. At the end of the provision of the Services under an Order, DCXPS shall, at the choice of the Customer made through the Platform under clause 10 of the Agreement:
(a) keep all personal data in Customer Data available for retrieval by the Customer in a structured, commonly used and machine-readable format during the Retrieval Period of at least thirty (30) calendar days under clause 10.4 of the Agreement, and delete it after the Retrieval Period; or
(b) delete all personal data in Customer Data without prior retrieval, from the date the Customer instructs.
7.2 Deletion periods and backups. Deletion extends to all existing copies, subject to the separate deletion period for backups. DCXPS completes the deletion within thirty (30) days after the end of the Retrieval Period or after the later date agreed in writing under clause 10.4 of the Agreement or, where the Customer elects erasure without switching, within thirty (30) days after termination of the affected Order. DCXPS deletes backup copies of Customer Data within ninety (90) days after the end of the Retrieval Period or, where the Customer elects erasure without switching, after termination of the affected Order (clause 10.4 of the Agreement; section 7.2 of the SLA).
7.3 Retention required by law. Where Union or Member State law to which DCXPS is subject requires DCXPS to store personal data in Customer Data, DCXPS informs the Customer of that requirement and stores the personal data only to the extent and for the period the law requires. DCXPS processes the stored personal data for no other purpose, and this DPA continues to apply to it.
7.4 Method and confirmation. DCXPS deletes personal data by cryptographic erasure of the encryption keys protecting the Customer's servers and dedicated storage and by overwriting the storage allocated to the Customer. DCXPS sanitizes every data-bearing medium that has held Customer Data by cryptographic erasure and purge in accordance with NIST Special Publication 800-88 Revision 2 before the medium is reused for another customer or leaves the DCXPS Facility, including before any return to a vendor under warranty, and confirms each sanitization in writing with the serial number of the device (Annex 08, Part B, section B.2.8). A medium that cannot be sanitized in that manner leaves the DCXPS Facility only after its physical destruction. DCXPS certifies the deletion under this section 7 in writing on request.
8. Information, records and audits (Article 28(3)(h) of the GDPR)
8.1 Information. DCXPS shall make available to the Customer all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR and in this DPA. DCXPS shall deal without undue delay and adequately with the Customer's enquiries about the processing.
8.2 Records. DCXPS maintains the record of all categories of processing activities carried out on behalf of the Customer required by Article 30(2) of the GDPR.
8.3 Audits. DCXPS shall allow for and contribute to audits, including inspections, of its compliance with this DPA, conducted by the Customer or by an auditor mandated by the Customer and bound by confidentiality, in accordance with clause 21.1 of the Agreement: once per calendar year and additionally after a security incident, including a personal data breach, or a Government Access Request affecting the Customer, on twenty (20) Business Days' notice, during Business Days, without disrupting the operations of DCXPS or the services of other customers, and at the Customer's cost. DCXPS may satisfy an audit request by providing the third-party audit reports and certifications listed in Annex 08, Part B, section B.6 that have been issued and that cover the scope requested. For a Customer that is a financial entity, Annex 08, Part E (DORA Addendum) applies in addition.
8.4 Supervisory authority. DCXPS cooperates, on request, with the competent supervisory authority in the performance of its tasks and makes the information under section 8.1 and the results of audits under section 8.3 available to it (Article 31 of the GDPR; clause 21.3 of the Agreement).
10. Suspension, withdrawal and termination
10.1 Suspension. If DCXPS is in breach of this DPA, the Customer may instruct DCXPS to suspend the processing concerned until DCXPS complies with this DPA or the affected Order ends. DCXPS shall inform the Customer without undue delay if it is unable to comply with this DPA for any reason.
10.2 Withdrawal by the Customer. The Customer may withdraw from the affected Order under clause 9.4 of the Agreement, by written notice with effect from its delivery, if:
(a) the processing has been suspended under section 10.1 and compliance with this DPA is not restored within a reasonable time and in any event within one (1) month after the suspension;
(b) DCXPS is in substantial or persistent breach of this DPA or of its obligations under the GDPR; or
(c) DCXPS fails to comply with a binding decision of a competent court or supervisory authority regarding its obligations under this DPA or the GDPR.
Each of these events is a substantial breach for the purposes of clause 9.4(iv) of the Agreement, in addition to the breaches listed there; the withdrawal is limited to the affected Order unless the event affects every Order, in which case the Customer may withdraw from the Agreement. The personal data are then dealt with under section 7, and DCXPS refunds the Term Fee under clause 8.8(a) of the Agreement.
10.3 Termination by DCXPS. DCXPS may terminate the affected Order by notice through the Platform, with effect thirty (30) days after delivery of the notice, where it has informed the Customer under section 4.2 that an instruction infringes the GDPR or other Union or Member State data protection provisions and the Customer maintains the instruction. Clause 10 of the Agreement applies to the retrieval of Customer Data.
11. Liability
11.1 Liability between the Parties. Clause 18 of the Agreement applies to the liability of the Parties arising out of or in connection with this DPA, including the cap in clause 18.1, the excluded damage in clause 18.2 and the unlimited liability in clause 18.3. Loss or corruption of Customer Data caused by a breach of this DPA or of Annex 08 by DCXPS is direct damage recoverable up to the cap in clause 18.1 (clause 18.2 of the Agreement).
11.2 Data subjects. Nothing in this DPA or in the Agreement limits the right of a data subject to receive compensation from either Party under Article 82 of the GDPR.
11.3 Recourse. Where a Party has paid full compensation for damage suffered by a data subject under Article 82(4) of the GDPR, that Party may claim back from the other Party the part of the compensation corresponding to the other Party's part of responsibility for the damage, in accordance with the conditions in Article 82(2) of the GDPR (Article 82(5) of the GDPR). DCXPS's part of responsibility extends only to damage caused by processing in which DCXPS has not complied with the obligations of the GDPR specifically directed to processors or has acted outside or contrary to the Customer's lawful instructions. The limits in section 11.1 apply to claims under this section 11.3.
11.4 Administrative fines. Each Party bears the administrative fines imposed on it under Article 83 of the GDPR. Neither Party may claim from the other Party, as damage, an administrative fine imposed on it.
12. Governing law and disputes
12.1 This DPA and all non-contractual obligations arising out of or in connection with it are governed by the laws of the Czech Republic, the Member State in which DCXPS is established. Clause 25 of the Agreement applies to any dispute arising out of or in connection with this DPA.
12.2 DCXPS may change this DPA under clause 26.4 of the Agreement, except Annex B, which changes only under section 4.7. No Change reduces the obligations of DCXPS below those that Article 28 of the GDPR requires of a processor, and changes to the sub-processors follow section 5.
Annex A. Description of the processing
| Item | Content (completed in the Order) |
|---|---|
| Subject matter | The processing of personal data contained in Customer Data in the provision of Managed Sovereign Capacity under the Order: dedicated bare-metal GPU servers allocated exclusively to the Customer, with private networking and dedicated storage, the Pre-installed AI Stack and the Platform, provided from the DCXPS Facility (clause 4.1 of the Agreement). |
| Duration | The Term of each Order, including any transitional period, and the Retrieval Period under clause 10 of the Agreement; backup copies until their deletion under section 7.2; personal data stored under section 7.3 for the period the law requires. |
| Nature of the processing | Hosting; storage on the dedicated storage; computation on the Customer's servers; transmission between the Customer's servers, the dedicated storage and the Customer-facing network endpoints of the Platform located in the Union; backup and restoration where the Order includes managed backup; operation of the Platform functions through which the Customer stores, processes and manages Customer Data (provisioning, orchestration, Chapek AI Studio and ticketing); maintenance of the servers and of the Platform; retrieval and deletion at the end of the Order. DCXPS does not analyze, profile, enrich, disclose or otherwise use the personal data for its own purposes. |
| Purposes | DCXPS processes personal data in Customer Data on the Customer's behalf only for the following purposes: (a) provisioning the servers ordered and allocating storage and network resources to the Customer; (b) running the Customer's workloads, including training, fine-tuning, inference and other data processing, on the Customer's servers under the Customer's control; (c) storing Customer Data on the dedicated storage and, where the Order includes managed backup, backing it up and restoring it (section 7 of the SLA); (d) transmitting Customer Data within the Services as the Customer directs; (e) orchestrating and scheduling the Customer's workloads through the Platform as the Customer directs; (f) providing technical support on the Customer's ticket, including the diagnosis of incidents affecting the Customer's servers; (g) detecting, containing and remedying security incidents affecting the Platform or the Customer's servers; (h) maintaining the servers, the Pre-installed AI Stack and the Platform; and (i) making Customer Data available for retrieval, and returning and deleting it, at the end of the Order (section 7). DCXPS processes personal data in Customer Data for no other purpose. |
| Categories of data subjects | As determined by the Customer and declared in the Order (for example its employees, customers, end users or research participants). DCXPS does not determine the categories. |
| Types of personal data | As determined by the Customer and declared in the Order, including whether the processing involves special categories of personal data (Article 9 of the GDPR) or personal data relating to criminal convictions and offenses (Article 10 of the GDPR). |
| Frequency | Continuous for the duration of the processing. |
| Location of the processing | The DCXPS Facility stated in the Order, in the Czech Republic. Sub-processors process personal data only at the locations in the Union stated in Annex C. No processing takes place outside the Union. |
| Retention | For the duration of the processing; deletion under section 7. |
| Sub-processors | As listed in Annex C. |
| Account Data (for information) | Processed by DCXPS as controller under the Privacy Notice; outside this DPA. |
Annex B. Technical and organizational measures
The measures below implement Article 32 of the GDPR and correspond to the cybersecurity risk-management measures in Article 21(2) of Directive (EU) 2022/2555, as transposed by Act No. 264/2025 Coll., on Cybersecurity; the last column identifies the point of Article 21(2) to which each item corresponds. Each measure is an obligation of DCXPS for the Services. The measures apply in addition to the commitments in Annex 08; where both address the same matter, the stricter commitment applies.
| No. | Category | Measures | Article 21(2) of Directive (EU) 2022/2555 |
|---|---|---|---|
| 1 | Physical access control | DCXPS Facility in the Czech Republic with perimeter security, access control with identity verification, access logging, video surveillance of common areas and escort of visitors; facility designed to be Tier II compliant (no Uptime Institute certification); access records for the hall in which the Customer's servers are installed available to the Customer on request and at audit | (i) |
| 2 | Logical access control | Role-based access, least privilege, named accounts, multi-factor authentication and privileged access management; DCXPS administrators access the Customer's servers only under ticketed, logged and time-bound just-in-time elevation of privileges; server and switch hardware managed only through the Out-of-Band Management Network from within the DCXPS Facility, with every management session logged (Annex 08, Part B, sections B.2.4 and B.2.5); quarterly access reviews; revocation of access on the day of offboarding | (i), (j) |
| 3 | Separation | Servers and dedicated storage allocated to one Customer for the Term; separation of tenants at the network (VLAN or VXLAN), storage (dedicated volumes) and identity layers; separate encryption keys for each Customer; separate production and test environments; no production data in test environments | (a), (i) |
| 4 | Transfer control | Encryption in transit (TLS 1.3 for the Customer-facing endpoints and the API; MACsec or IPsec on links between DCXPS sites where such links are used); Customer-facing endpoints located in the Union; no transfer of personal data to a Third Country and no remote access from a Third Country; no vendor remote-support tunnel or Third-Country access path to Customer Data, the Platform or the Management Plane (Annex 08, Part B, sections B.2.5 and B.2.7); export only through the export functions and interfaces of the Platform under the Customer's control | (h), (j) |
| 5 | Change control | Change management with approval, testing and rollback; signed images; infrastructure as code; audit trail of configuration changes; firmware updates only from images verified against the vendor's signature or published hash (Annex 08, Part B, section B.2.6); maintenance as Planned Maintenance announced under section 5.1 of the SLA or as emergency maintenance under section 5.2 of the SLA; patches that do not interrupt the Services deployed without notice (Annex 08, Part B, section B.7.7) | (e) |
| 6 | Encryption and key management | Encryption at rest on all storage; keys for each Customer managed by the DCXPS key-management service in systems located in the Union; key rotation; separation of duties; Customer-managed keys where selected in the Order | (h) |
| 7 | Availability and resilience | Redundant power distribution and cooling as built, in a facility designed to be Tier II compliant; fire detection and suppression; environmental monitoring; capacity management; documented disaster-recovery and business-continuity plans; recovery point objective of one (1) hour and recovery time objective of four (4) hours for the Platform and the Management Plane; managed backup not offered at launch (section 7 of the SLA) | (c) |
| 8 | Logging and monitoring | Centralized logging; security monitoring by a security operations center located in the Union; log retention of twelve (12) months; the access records and session logs concerning the Customer's servers under Annex 08, Part B, sections B.2.3 and B.2.4 are kept until twelve (12) months after the end of the last Service Period of the Order under which those servers were allocated; alerting; logs concerning the Customer's servers available to the Customer on request | (b) |
| 9 | Vulnerability and patch management | Monthly vulnerability scanning; security patches to the Platform, the Management Plane and the firmware within the periods stated in Annex 08, Part B, section B.7.7; annual penetration test by an independent tester (clause 13.4 of the Agreement); coordinated vulnerability disclosure | (e) |
| 10 | Personnel | Personnel with access satisfy clause 6.7 of the Agreement and Annex 08, Part B, section B.5 (authorization by DCXPS and, for logical access, background screening); written confidentiality undertakings; annual security training; disciplinary process | (g), (i) |
| 11 | Special categories of personal data | Where the Order declares special categories of personal data or personal data relating to criminal convictions and offenses: Customer-managed keys required; access restricted to named roles; support for the data protection impact assessment under section 6.2(c) | (a), (h) |
| 12 | Incident management | Incident response plan; notification to the Customer within twenty-four (24) hours (section 6.3); final report within thirty (30) days; post-incident review | (b) |
| 13 | Sub-processor governance | Written contracts under section 5.3; due diligence before engagement; annual review; thirty (30) days' notice of changes (section 5.2); subcontractor register in Annex 08, Part B, section B.4 | (d) |
| 14 | Deletion and media sanitization | Cryptographic erasure of the Customer's keys and overwriting of the storage allocated to the Customer after the Retrieval Period or, where the Customer elects erasure without switching, after termination of the affected Order; purge in accordance with NIST Special Publication 800-88 Revision 2 of every data-bearing medium before its reuse for another customer or before it leaves the DCXPS Facility, including for return to a vendor; physical destruction of a medium that cannot be sanitized in that manner before it leaves the DCXPS Facility; written confirmation with the serial number of the device (section 7.4; Annex 08, Part B, section B.2.8) | (h), (i) |
| 15 | Testing and evaluation | Information security management system aligned with ISO/IEC 27001, with the certification target stated in Annex 08, Part B, section B.6; internal audits; management review; third-party reports and certifications once issued (Annex 08, Part B, section B.6); annual review of these measures | (f) |
| 16 | Governance and supply chain | Risk analysis and information security policies; asset management; supply-chain security through the software bill of materials, the inventory of Third-Country components and the remote-feature controls in Annex 08, Part B, section B.7 | (a), (d) |
Annex C. Authorized sub-processors
| Sub-processor | Service | Registered seat and location of processing | Access to personal data | Ownership and control |
|---|---|---|---|---|
| Facility services provider | Facility maintenance (power, cooling, fire protection) | Czech Republic | Physical only, escorted; no logical access | Established and controlled in the Union; no ownership or control by a person established outside the EEA |
| Hardware maintenance partner | Field service for servers and network equipment | Czech Republic | Physical only, escorted; no logical access | Established and controlled in the Union; no ownership or control by a person established outside the EEA |
No sub-processor is established outside the Union, processes personal data outside the Union or is controlled by a person established in a Third Country. The Payment Processor processes payment data as part of Account Data, for which DCXPS is the controller (Privacy Notice, section 6), and is not a sub-processor. DCXPS keeps Annex C consistent with the subcontractor register in Annex 08, Part B, section B.4. Where this Annex identifies a sub-processor by its function, DCXPS discloses its identity, registered seat and ownership and control to the Customer within ten (10) Business Days after a request through the Platform, as Confidential Information under clause 14 of the Agreement; the Customer may disclose that information to the controllers for which it acts under section 1.3 and to a supervisory authority.
Annex D. Requests from public authorities
The Government Access Protocol in Annex 08, Part C applies to personal data in Customer Data with the following additions:
(a) DCXPS informs the Customer of every legally binding request for disclosure of personal data in Customer Data before complying with it and in any event within two (2) Business Days of receipt, unless the law prohibits the information, including a prohibition under criminal law to preserve the confidentiality of a law-enforcement investigation, in which case DCXPS informs the Customer as soon as the prohibition lapses (Annex 08, Part C, section C.4);
(b) DCXPS reviews the legality of each request and challenges it through the remedies available to it where, after careful assessment, it concludes that there are reasonable grounds to consider the request unlawful under Union or Czech law, including a request of a Third-Country authority that is not based on an international agreement in force (Article 48 of the GDPR);
(c) DCXPS documents its legal assessment, the handling of the request and the personal data disclosed, and makes the record available to the Customer and, on request, to the competent supervisory authority;
(d) DCXPS discloses the minimum amount of personal data permissible on a reasonable interpretation of the request; and
(e) DCXPS refers a request of a Third-Country authority that is not based on an international agreement in force to the Czech supervisory authority and makes no transfer in response to it, except where section 9.2 permits it.