Data Processing Agreement (DPA)

1. Parties and Background

1.1. This Data Processing Agreement ("DPA") is entered into between TULPAR OÜ, registry code 14927152, Estonia (the "Processor" or "TULPAR") and the customer identified in the applicable account or Order (the "Controller" or "Customer").

1.2. This DPA forms an integral part of the Terms of Service between the parties (the "Agreement") and applies whenever TULPAR processes personal data on behalf of the Customer in the course of providing VPS, VDS, cloud server, hosting, and related software services (the "Services").

1.3. This DPA is concluded to meet the requirements of Article 28(3) of Regulation (EU) 2016/679 ("GDPR"). In case of conflict between this DPA and the Agreement regarding the processing of personal data, this DPA prevails.

1.4. Where the Customer acts as a processor for a third-party controller, the Customer warrants that its instructions to TULPAR are consistent with that controller's instructions, and TULPAR acts as a sub-processor.

2. Definitions

"Personal data", "processing", "controller", "processor", "data subject", "personal data breach", and "supervisory authority" have the meanings given in the GDPR. "Customer Personal Data" means personal data contained in Customer Data (as defined in the Agreement) that TULPAR processes on behalf of the Customer. "Sub-processor" means any third party engaged by TULPAR to process Customer Personal Data.

3. Subject Matter, Duration, Nature and Purpose

3.1. Subject matter and nature: hosting, storage, transmission, and related technical processing of Customer Personal Data on TULPAR's infrastructure as part of the Services. TULPAR provides infrastructure; it does not determine the purposes or means of the processing and, as a rule, has no knowledge of the content of Customer Personal Data.

3.2. Purpose: the provision of the Services as described in the Agreement and any Order.

3.3. Duration: the term of the Agreement, plus the retention period set out in Section 10 of this DPA and Section 8 of the Terms of Service.

3.4. The categories of data subjects and personal data are described in Annex A. Because the Customer controls what data is stored on its server instances, the Customer is responsible for the accuracy of Annex A as applied to its own use.

4. Processor Obligations and Instructions

4.1. TULPAR shall process Customer Personal Data only on the Customer's documented instructions, including with regard to transfers to third countries, unless required to do otherwise by Union or Member State law; in such a case, TULPAR shall inform the Customer of that legal requirement before processing, unless the law prohibits such information on important grounds of public interest.

4.2. The Agreement, this DPA, and the Customer's use of the Services' configuration options and control panels constitute the Customer's complete documented instructions. Additional instructions require the parties' written agreement and may be subject to additional fees if they exceed the scope of the Services.

4.3. TULPAR shall inform the Customer without undue delay if, in its opinion, an instruction infringes the GDPR or other applicable data protection law; TULPAR may suspend execution of such instruction until it is confirmed or modified.

4.4. The Customer warrants that it has a valid legal basis for the processing, that it has provided data subjects with the required information, and that its instructions comply with applicable law. The Customer shall not use the Services to process special categories of data (Article 9 GDPR) or data subject to heightened sectoral requirements unless the parties have agreed appropriate additional safeguards in writing.

5. Confidentiality and Security

5.1. TULPAR ensures that persons authorized to process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

5.2. Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risks to data subjects, TULPAR implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, as described in Annex B (Article 32 GDPR).

5.3. The parties acknowledge a shared responsibility model: TULPAR secures the infrastructure layer (physical security via its data center providers, network, virtualization host); the Customer is responsible for security within its server instances — operating system patching, firewall configuration, application security, access management, encryption of its own data, and backups (unless a backup service is included in the Order).

5.4. TULPAR may update Annex B from time to time, provided the updates do not materially reduce the overall level of security.

6. Sub-processors

6.1. The Customer grants TULPAR a general authorization to engage Sub-processors for the provision of the Services. The current list of approved Sub-processors is set out in Annex C and/or published on the Website.

6.2. TULPAR shall inform the Customer of any intended addition or replacement of a Sub-processor at least 14 days in advance (via the Website, Control Panel, or e-mail), giving the Customer the opportunity to object on reasonable, data-protection-related grounds. If the parties cannot resolve a justified objection, the Customer may terminate the affected Service as of the date the change takes effect; prepaid fees for undelivered periods are refunded pro rata.

6.3. TULPAR shall impose on each Sub-processor, by contract, data protection obligations materially equivalent to those in this DPA, and remains fully liable to the Customer for the performance of the Sub-processor's obligations.

7. Assistance to the Controller

7.1. Data subject rights. Taking into account the nature of the processing, TULPAR shall assist the Customer by appropriate technical and organizational measures, insofar as this is possible, in fulfilling the Customer's obligation to respond to data subject requests (access, rectification, erasure, restriction, portability, objection). As an infrastructure provider, TULPAR's assistance normally consists of maintaining the Customer's access to its own server instances and data. If a data subject contacts TULPAR directly regarding Customer Personal Data, TULPAR will refer the request to the Customer without undue delay.

7.2. Breach notification. TULPAR shall notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, providing — as information becomes available — the nature of the breach, categories and approximate numbers of data subjects and records concerned, likely consequences, and measures taken or proposed. Notification is made to the Customer's registered e-mail address. TULPAR's notification is not an acknowledgment of fault or liability; notifying the supervisory authority and data subjects is the Customer's responsibility as controller.

7.3. DPIA. TULPAR shall provide reasonable assistance with data protection impact assessments and prior consultations (Articles 35–36 GDPR), insofar as they relate to the Services and the information is available to TULPAR.

8. International Transfers

8.1. Customer Personal Data is processed in the data center location(s) selected by the Customer at ordering or stated in the service description or Order. Unless the Customer expressly selects a location outside the EU/EEA, Customer Personal Data is processed in EU/EEA data centers.

8.2. TULPAR shall not transfer Customer Personal Data to a third country or international organization except: (a) on the Customer's documented instructions; (b) where required by Union or Member State law (clause 4.1); or (c) to a Sub-processor in accordance with Section 6, provided the transfer complies with Chapter V GDPR — an adequacy decision (Article 45), standard contractual clauses (Article 46(2)(c)), or another valid transfer mechanism. Where the Customer expressly selects a service location outside the EU/EEA, this constitutes the Customer's documented instruction to process Customer Personal Data in that location, and the transfer to the relevant Sub-processor takes place under the mechanism stated in the Sub-processor list.

8.3. Requests by authorities of third countries for access to Customer Personal Data are handled in accordance with Article 48 GDPR and clause 9.7 of the Terms of Service.

9. Audit and Information Rights

9.1. TULPAR shall make available to the Customer all information reasonably necessary to demonstrate compliance with Article 28 GDPR, and shall allow for and contribute to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer.

9.2. Audit requests must be made with at least 30 days' written notice, no more than once per 12 months (except after a personal data breach or where required by a supervisory authority), during business hours, without unreasonably disrupting TULPAR's operations, and subject to confidentiality undertakings. Audits do not extend to data of other customers or to third-party data center facilities beyond the attestations and certifications those providers make available.

9.3. TULPAR may first satisfy an audit request by providing recent third-party certifications, audit reports, or security documentation. The Customer bears its own audit costs and reimburses TULPAR's reasonable costs of supporting on-site audits that exceed the documentation-based review.

10. Return and Deletion

10.1. During the term of the Services, the Customer can retrieve its data at any time through its server instances and the Control Panel; export is the Customer's responsibility.

10.2. Upon termination or expiry of the Services, TULPAR shall, at the choice of the Customer exercised before the end of the retention grace period in the Terms of Service (14 days), delete or enable the return of all Customer Personal Data, and delete existing copies after that period, unless Union or Member State law requires further storage.

10.3. Deletion is performed so that the data can no longer be restored by ordinary means; residual copies in backup media are overwritten in the normal backup rotation cycle and are not accessed in the meantime except where required by law.

11. Liability, Term, Governing Law

11.1. The liability provisions of the Terms of Service (Section 13) apply to this DPA, save that nothing limits either party's liability for amounts a party is required to pay under Article 82 GDPR to data subjects or under final decisions of supervisory authorities, to the extent such limitation is not permitted.

11.2. Each party is liable for administrative fines imposed on it in accordance with Article 83 GDPR corresponding to its own role and fault.

11.3. This DPA enters into force upon acceptance of the Agreement and remains in force for as long as TULPAR processes Customer Personal Data.

11.4. This DPA is governed by the law specified in the Terms of Service (Estonian law); mandatory provisions of the GDPR prevail over any conflicting term.

Annex A — Details of Processing

Annex B — Technical and Organizational Measures (TOMs)

• Physical security: Services hosted in professional data centers (Annex C) with access control, video surveillance, redundant power and cooling; security attestations and certifications (e.g., ISO/IEC 27001) as made available by the respective data center operator.
• Access control: administrative access to the virtualization layer restricted to authorized personnel; individual accounts; strong authentication (MFA) for administrative interfaces; access granted on a need-to-know basis and revoked on role change.
• Transmission security: management interfaces and client portal served over TLS; customer traffic isolation at the virtualization/network layer.
• Separation: logical separation of customers' virtual servers (hypervisor isolation); separate storage volumes per instance.
• Availability and resilience: redundant network uplinks; monitoring and alerting of host infrastructure; where a backup service is included in the applicable plan or Order, backups are performed with the frequency and retention specified in that plan; otherwise backups remain the Customer's responsibility.
• Logging: infrastructure-level logging of administrative actions and IP assignments; logs protected against tampering and retained per legal requirements.
• Incident management: documented procedure for detecting, assessing, and notifying personal data breaches (clause 7.2).
• Organizational measures: confidentiality undertakings of personnel; sub-processor contracts per Section 6; periodic review of these measures.

Annex C — Approved Sub-processors

TULPAR provides the Services using third-party infrastructure providers in the categories below. The current, provider-level list of Sub-processors — including the specific data center operators used for each service location — is published at https://tulparsoft.com/legal/sub-processors and forms an integral part of this Annex. Changes to that list are announced in accordance with clause 6.2.

Note: Providers that process personal data for TULPAR's own purposes — such as payment providers processing billing and payment data — act as independent controllers or as TULPAR's own processors. They do not process Customer Personal Data and are therefore not Sub-processors under this DPA; they are described in the Privacy Policy.

Version 1.2 — effective as of 01.09.2026