Draft. This document is awaiting legal review and may change before Galactus Cloud opens to all customers.
This Data Processing Agreement ("DPA") is part of the Galactus Cloud Terms of Service and applies when we process personal data on your behalf in providing Galactus Cloud. "Data Protection Law" means the UK GDPR, the Data Protection Act 2018 and, where it applies, the EU GDPR. "Personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meanings given in Data Protection Law.
1. Roles
For personal data you store in your Deployments ("Customer Personal Data") you are the controller and we are your processor. For account, billing and support information about you and your users we are a controller, as described in our privacy notice.
2. Our obligations
We will:
- process Customer Personal Data only on your documented instructions, which are the Agreement and your use and configuration of the service, unless the law requires otherwise (in which case we will tell you first unless the law forbids it);
- tell you if we believe an instruction breaks Data Protection Law;
- ensure the people we authorise to process it are bound by confidentiality;
- implement the technical and organisational measures in Annex 2;
- use sub-processors only as described in section 3;
- taking into account the nature of the processing, help you respond to data subjects exercising their rights, and with security, breach notification, data protection impact assessments and prior consultation, as far as reasonably possible and at your reasonable cost where the help goes beyond the normal service;
- notify you without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data, with the information reasonably available to us then and as it becomes available;
- at the end of the service, delete Customer Personal Data as described in section 5;
- make available the information reasonably needed to demonstrate compliance with this DPA, and allow audits as described in section 6.
3. Sub-processors
You give us general authorisation to use the sub-processors listed on our sub-processors page. We impose data protection terms on each that are no less protective than this DPA, and we remain responsible for them. We will give at least 30 days' notice of a new sub-processor of Customer Personal Data by email or in your account. If you object on reasonable data protection grounds and we cannot address the objection, you may delete the affected Deployments and end the Agreement for them, with a refund of any prepaid fees for the unused period.
4. Location and transfers
Customer Personal Data in a Deployment, and its backups, are stored in the AWS region you choose for it. Choosing a region outside the UK or EEA (such as N. Virginia, Sydney or Tokyo) is your instruction to process the data there. Where a transfer outside the UK or EEA is a restricted transfer, it is made under the UK International Data Transfer Addendum or the EU Standard Contractual Clauses incorporated in the relevant provider's terms, or another safeguard Data Protection Law allows. [TO CONFIRM: transfer mechanism wording.] We and our staff may access Customer Personal Data from the UK to provide support you request.
5. Deletion
When you delete a Deployment, its machine and disk are deleted immediately. Its backups are deleted when their retention period ends (at most the period you chose, up to 30 days), or straight away if you choose to delete them. After the Agreement ends we delete all remaining Customer Personal Data within that period, unless the law requires us to keep it. You are responsible for exporting any data you need before deleting a Deployment. If we retire a size or region or stop providing Galactus Cloud, sections 7.4 to 7.6 of the Terms apply: you can download your backups during the notice period and for 30 days after it, and we then delete all Customer Personal Data.
6. Audits
On reasonable written notice, no more than once in any 12 months (unless a supervisory authority requires otherwise or there has been a personal data breach), we will answer your reasonable written questions about our compliance with this DPA. Where that is not enough to demonstrate compliance, you may carry out an audit, at your cost, during business hours, through an independent auditor bound by confidentiality, in a way that does not compromise the security of other customers. The physical data centres are operated by AWS and audited under AWS's own certifications, which we can direct you to.
7. Liability
Each party's liability under this DPA is subject to the limitations in the Terms, except where Data Protection Law does not allow it.
Annex 1: Details of processing
| Subject matter | Hosting Galactus DB databases you create on Galactus Cloud. |
| Duration | The term of the Agreement plus the deletion period in section 5. |
| Nature and purpose | Storage, hosting, backup, restore, transmission and deletion, and support you request. |
| Types of personal data | Whatever you choose to store in your Deployments. |
| Categories of data subjects | Whoever your data relates to, as determined by you. |
| Special category data | Only if you choose to store it, under your own legal basis and safeguards. |
Annex 2: Security measures
- Isolation: each Deployment has its own virtual machine, encrypted disk and firewall (security group); only port 7687 is open, from anywhere or only from the addresses you allow.
- Encryption: connections to your Deployment require TLS with a publicly trusted certificate for its own hostname; disks are encrypted at rest with AES-256; backups are encrypted at rest in S3 and transferred over TLS.
- Access: there is no SSH or password login to the machines; administration is through AWS Systems Manager, with access limited to authorised staff and logged. Database access requires a username and password; the administrator password you choose is passed directly to the machine's setup and is not stored by our website.
- Backups: daily backups to S3 in the Deployment's region, kept for the period you choose and then deleted automatically.
- Accounts: our website stores passwords as salted Argon2 hashes, supports password changes that sign out other sessions, and records account actions in an audit log.
- Operations: infrastructure is defined in code and reviewed before changes; secrets are held in AWS Systems Manager Parameter Store, not in images or source code.
- [TO CONFIRM before launch: per-deployment AWS permissions for each machine, and external availability monitoring.]