Legal - Data Processing Agreement

Featured AI Products
Build, deploy, and scale cloud compute resources
Containers and Images
Safely store and manage containers and backups
Fully managed resources running popular database engines
Management and Dev Tools
Control infrastructure and gather insights
Secure and control traffic to apps
Help protect your account and resources with these security features
Store and access any amount of data reliably in the cloud
Security and Networking
Web and App Platforms
1.1 This Data Processing Agreement (“DPA”) is an addendum to the Customer Terms of Service (“Agreement”) between DigitalOcean, LLC (“DigitalOcean”) and the Customer. DigitalOcean and Customer are individually a “party” and, collectively, the “parties.”
1.2 This DPA applies where and only to the extent that DigitalOcean processes Personal Data on behalf of the Customer in the course of providing the Services and such Personal Data is subject to Data Protection Laws of the appropriate jurisdiction, including the State of California, the European Union, the European Economic Area and/or its member states, Switzerland and/or the United Kingdom. The parties agree to comply with the terms and conditions in this DPA in connection with such Personal Data.
1.3 The duration of the Processing covered by this DPA shall be in accordance with the duration of the Agreement.
2.1 The following terms have the meanings set forth below. All capitalized terms not defined in this DPA will have the meanings set forth in the Agreement.
2.2 The following terms have the definitions given to them in the CCPA: “Business,” “Sell,” “Service Provider,” and “Third Party.”
2.3 “Controller” means the entity that determines the purposes and means of the Processing of Personal Data. “Controller” includes equivalent terms in other Data Protection Law, such as the CCPA-defined term “Business” or “Third Party,” as context requires.
2.4 “Data Protection Law” means all data protection and privacy laws applicable to the processing of Personal Data under the Agreement as it relates to the Customer, including Regulation 2016/679 (General Data Protection Regulation) (“GDPR”), and Cal. Civ. Code Title 1.81.5, § 1798.100 et seq. (California Consumer Privacy Act) (“CCPA”).
2.5 “Data Subject” means an identified or identifiable natural person.
2.6 “De-identified Data” means data that cannot be reasonably linked to a person and is excluded from the definition of Personal Data under applicable Data Protection Law. Aggregated data is De-identified Data. To “De-identify” means to create De-identified Data from Personal Data.
2.7 “EEA” means the European Economic Area.
2.8 “Standard Contractual Clauses” means the European Union standard contractual clauses for international transfers from the European Economic Area to third countries, Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
2.9 “Personal Data” means Services Content that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a Data Subject or their household or device in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. “Personal Data” includes equivalent terms in other Data Protection Law, such as the CCPA-defined term “Personal Information,” as context requires.”
2.10 “Personal Data Breach” means a breach of security of the Services leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data.
2.11 “Process” or “Processing” means any operation or set of operations which is performed upon Personal Data, whether by automatic means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction.
2.12 “Processor” means an entity that processes Personal Data on behalf of another entity. “Processor” includes equivalent terms in other Data Protection Law, such as the CCPA-defined term “Service Provider,” as context requires.
2.13 “Sensitive Data” means the following types and categories of data: data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership; genetic data; biometric data; data concerning health; data concerning a natural person’s sex life or sexual orientation; government identification numbers (e.g., SSNs, driver’s license); payment card information; nonpublic personal information governed by the Gramm Leach Bliley Act; an unencrypted identifier in combination with a password or other access code that would permit access to a data subject’s account; and precise geolocation.
2.14 “Subprocessor” means a Processor engaged by a party who is acting as a Processor.
2.15 “UK Addendum” means the United Kingdom International Data Transfer Agreement Addendum to the EU Standard Contractual Clauses issued by the United Kingdom Information Commissioner on March 21, 2022.
3.1 Schedules 1-3 attached hereto describe the purposes of the parties’ Processing, the types or categories of Personal Data involved in the Processing, and the categories of Data Subjects affected by the Processing.
3.2 Schedules 1-3 list the parties’ statuses under relevant Data Protection Law.
4.1 If DigitalOcean processes Personal Data of Data Subjects located in the EEA, Switzerland, or the United Kingdom in a country that has not received an adequacy decision from the European Commission or Swiss or UK authorities, as applicable, such transfer shall take place on the basis of DigitalOcean’s certification under the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, or the Swiss-U.S. Data Privacy Framework (Swis