This Data Processing Addendum (“DPA”) applies when CoreGPU processes personal data on behalf of a business customer (the “Customer”) in connection with the Service. It supplements the Terms of Service. For a countersigned copy, write to our contact form.
Roles
The Customer is the controller of personal data contained in Customer Data. CoreGPU acts as a processor and processes it only on the Customer's documented instructions, which consist of providing the Service under the Terms.
Nature of the processing
Servers are dedicated to the Customer and operated by the Customer with root access. CoreGPU does not routinely access Customer Data; processing is limited to hosting the hardware, storage handling at the end of a rental, and support the Customer requests.
Security measures
- Dedicated, single-tenant hardware; no sharing of GPUs between customers.
- Physical security and access control at the data-center facilities we use.
- Key-based SSH access only; administrative access by CoreGPU staff limited to support and maintenance.
- Secure erasure of local storage before a server is assigned to another customer.
- Confidentiality obligations for all personnel with access to systems.
Sub-processors
CoreGPU uses sub-processors for data-center hosting, content delivery, payment processing and email. We impose data protection obligations equivalent to this DPA on them and inform customers of changes on request.
Personal data breaches
CoreGPU will notify the Customer without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Data, with the information reasonably available.
Assistance and audits
CoreGPU assists the Customer with data subject requests and impact assessments where reasonably required, and provides information necessary to demonstrate compliance with this DPA on written request.
Return and deletion
At the end of the rental, Customer Data on local storage is securely erased. Customers are responsible for exporting data they wish to keep before that date.
International transfers
Where personal data is transferred to a country without an adequacy decision, the parties rely on the applicable standard contractual clauses.