Data Processing Agreement
How CloudTally processes personal data on the Customer's behalf as a processor.
Last updated: 2026-09-13
1. Scope and roles
This Data Processing Agreement (DPA) forms part of the CloudTally Terms and Conditions between the Customer and Agapios sp. z o.o., providing the CloudTally service.
It applies where CloudTally processes personal data in Customer Data on the Customer's behalf (Customer Personal Data). The Customer is the controller and CloudTally is the processor. If the Customer is itself a processor, CloudTally acts as its subprocessor.
The Privacy Policy covers CloudTally's separate controller activities, including marketing, accounts, billing and security.
2. Processing
| Item | Details |
|---|---|
| Subject matter, duration and purpose | Providing the Service during the Customer agreement and deletion period by hosting, analysing, displaying, securing and deleting data |
| Data subjects | Customer Users, invited members, notification recipients and people identifiable in Customer-supplied Hetzner project data |
| Data | Names, business email addresses, roles, notification details, User activity, and Hetzner resource names, labels, descriptions, public IP addresses or other metadata where they identify a person |
Most infrastructure, cost, usage and metric data is technical rather than personal. This DPA applies only where information is personal data.
3. Instructions and security
CloudTally will process Customer Personal Data only on documented instructions in the agreement or given through the Service. It will notify the Customer if law requires other processing, unless prohibited, or if an instruction appears unlawful.
CloudTally will ensure authorised personnel are bound by confidentiality and maintain appropriate technical and organisational measures. The principal controls are summarised in the Security section of the Privacy Policy.
The Customer is responsible for lawful instructions, a legal basis and required notices.
4. Assistance and breaches
CloudTally will notify the Customer without undue delay after becoming aware of a breach affecting Customer Personal Data and provide available information needed for the Customer's obligations.
CloudTally will reasonably assist with data-subject requests, breach obligations, impact assessments and regulatory consultation. It will not answer for the Customer unless authorised or legally required.
5. Subprocessors
The Customer gives general authorisation for these subprocessors:
| Subprocessor | Service | Location or transfer basis |
|---|---|---|
| Cloudflare, Inc. | Traffic proxy, TLS and security | Global network, including the United States; EU-US Data Privacy Framework, with SCC fallback |
| Hetzner Online GmbH | Application, database and object storage | European Union |
| Scaleway S.A.S. | Object storage and encrypted backups | European Union |
| SEOHost | Transactional and service email | Poland |
CloudTally will impose equivalent relevant duties on each subprocessor and remains responsible as required by law.
CloudTally will give 30 days' notice before adding or replacing a subprocessor. The Customer may object on reasonable data-protection grounds. If no reasonable alternative exists, either party may terminate the affected Service.
The application, database and object storage are in the European Union. Cloudflare may process data through its global network, including the United States. Eligible transfers are covered by its active EU-US Data Privacy Framework certification, with SCC fallback. Other transfers outside the EEA require a lawful mechanism.
6. Deletion and audit
At the end of processing, CloudTally will return or delete Customer Personal Data at the Customer's choice unless law requires retention. Deleted data remains recoverable for 30 days, then is permanently deleted from active systems. Backups expire through the normal cycle and are used only for recovery.
CloudTally will demonstrate Article 28 compliance by written response or report. If insufficient, the Customer may request a proportionate audit on reasonable notice, subject to confidentiality, security and other customers' rights.
7. General
This DPA applies while CloudTally processes Customer Personal Data. It prevails over conflicting Terms about that processing. Liability between the parties is governed by the Terms, without limiting any data subject's rights under Article 82 GDPR or other applicable law. The DPA is accepted electronically with the Terms.
Questions may be sent to [email protected].