Data processing addendum

This DPA forms part of the agreement between the customer as controller (or processor for another controller) and Codara Solutions SL as processor. It applies to personal data processed by Codara to provide Codara Cloud, excluding data for which Codara acts independently as controller under the Privacy Policy.

• Subject: hosting, deployment, storage, networking, backup, support, security, and deletion of customer workloads.
• Duration: the service term plus the retrieval, deletion, backup, and legal-hold periods described in the agreement.
• Data and people: determined by the customer’s repositories, applications, databases, logs, and users. This can include contact, account, employee, customer, usage, financial or other application data about the customer’s staff, users, suppliers and other individuals it selects. The customer records any special-category data and additional safeguards in its order or processing instructions before that processing begins.
• Purpose: provide and secure the service according to documented customer instructions.

Codara will process personal data only on documented instructions, including transfers, unless EU or Member State law requires otherwise, in which case Codara informs the customer before processing unless that law prohibits notice; ensure authorized personnel are bound by confidentiality; maintain measures appropriate under GDPR Article 32; assist with rights requests, security, impact assessments, and regulator consultation; and notify the customer without undue delay after becoming aware of a personal-data breach affecting customer data.

Codara will immediately inform the customer if, in its opinion, an instruction infringes EU or Member State data-protection law. It will seek clarification and may suspend the affected instruction rather than knowingly perform unlawful processing.

Codara does not use customer personal data for its own advertising or train a general-purpose AI model on it unless the customer gives a separate documented instruction or agreement that satisfies applicable law. Anonymous information may be used only where it is no longer personal data; pseudonymized information remains protected by this DPA. Any anonymization of workload data must itself follow a lawful documented customer instruction.

• Individual accounts, role-based authorization, MFA for privileged access, session revocation, and audit logging.
• Tenant-aware control-plane queries, workload namespaces, service accounts, network policy, scoped database roles, and optional dedicated data planes.
• TLS in transit, encrypted secrets, restricted production access, vulnerability patching, monitoring, backups, and recovery procedures exercised for the supported systems; the agreement does not promise a recovery time or universal recovery coverage.
• Incident triage, containment, evidence preservation, customer communication, and corrective action.

The customer gives general written authorization for the providers in the Subprocessor Register when they process customer workload data on Codara’s behalf. Independent controllers for payment or identity services are not made subprocessors by being listed. Before adding or replacing a workload subprocessor, Codara will inform the account owner of the intended change and allow a reasonable opportunity to object on data-protection grounds before the new processing starts. Posting a list without notifying the customer is not a substitute for that notice.

Codara will impose equivalent applicable data-protection duties by written contract and remains responsible to the customer for the subprocessor’s performance of those duties. We will discuss reasonable objections in good faith and seek an alternative; if none is reasonably available, the customer can end the affected service before the new subprocessor processes its data and receive any refund required for the unused affected service. Restricted transfers require an applicable adequacy decision or other valid safeguard, including Standard Contractual Clauses with supplementary measures where appropriate.

At the customer’s choice and subject to the agreement, Codara will return or delete customer personal data after services end, unless law requires retention. Backup copies are isolated and expire on rotation. Codara will provide information reasonably necessary to demonstrate compliance and allow and contribute to audits, including inspections, by the customer or its authorized auditor. Reasonable confidentiality, scheduling and tenant-protection measures may apply, but they must not prevent an audit required by law. Available reports or remote evidence may be used where they are sufficient; they do not replace necessary inspection rights.

The customer is responsible for lawful instructions, notices, rights handling, and not placing data into the service contrary to law or the agreement. If this DPA conflicts with the Terms on personal-data processing, this DPA controls. Mandatory data-protection law controls over both.