Data Processing Agreement
This Data Processing Agreement (“DPA”) is part of the vbtnl Terms of Service between ZANTEMARK LIMITED, Arch. Makariou III, 195, NEOCLEOUS HOUSE 3030, Limassol, Cyprus (“vbtnl”, the processor) and you, the customer (the “Customer”, the controller). It applies whenever the Customer’s applications hosted on vbtnl process personal data of other people (“Customer Data”). It implements Article 28 of Regulation (EU) 2016/679 (the “GDPR”) and the equivalent provisions of the UK GDPR. It is accepted together with the Terms; an electronic acceptance is a written form for the purposes of Article 28(9). A countersigned copy is available on request at [email protected].
If the Customer uses vbtnl purely for personal purposes and processes no one else’s personal data, this DPA has no effect until that changes.
1. Roles and scope
1.1 The Customer is the controller of Customer Data and decides why and how it is processed. vbtnl is the processor and processes Customer Data only to provide the Service as described in Annex I.
1.2 For the Customer’s own account data (email, billing, usage) vbtnl is an independent controller; the Privacy Policy applies to that data, not this DPA.
1.3 Where the Customer is itself a processor for a third party, the Customer warrants that its controller has authorised vbtnl as sub-processor on these terms.
2. Instructions
2.1 vbtnl processes Customer Data only on the Customer’s documented instructions, including with regard to transfers to a third country, unless required by EU or Member State law, in which case vbtnl informs the Customer of that requirement before processing, unless the law prohibits it on important grounds of public interest.
2.2 The Customer’s instructions are: the Terms, this DPA, the configuration of the Customer’s Projects (code, databases, settings), and the commands the Customer or its AI Assistant gives through the dashboard, the API or the MCP server. Further instructions must be in writing (email counts) and may be charged where they go beyond the Service.
2.3 vbtnl informs the Customer immediately if, in its opinion, an instruction infringes the GDPR or other data protection law. vbtnl may suspend the instruction until the Customer confirms or changes it.
2.4 AI Assistants. The Customer’s AI Assistant and its provider (for example Anthropic for Claude) are chosen and engaged by the Customer. They are recipients of the Customer, not sub-processors of vbtnl, and are not listed in Annex III. When vbtnl returns Customer Data to the AI Assistant in response to its commands, it discloses that data to a recipient the Customer has designated, on the Customer’s instruction. To limit such disclosures, by default:
(a) vbtnl does not return the contents of the Customer’s production databases to the AI Assistant, only their structure (tables, columns, approximate row counts);
(b) vbtnl masks personal data and secrets in production logs returned to the AI Assistant, by pattern matching (email addresses, IP addresses, phone numbers, card-like numbers, tokens and credentials). This is a risk-reduction measure, not anonymisation, and does not detect every kind of personal data.
The Customer may instruct vbtnl, per Project in the dashboard, to return production data to the AI Assistant without these limits, and may withdraw that instruction at any time. vbtnl records each such instruction with the user, time, IP address and user agent, and makes the record available to the Customer on request. Where the Customer gives that instruction, the Customer is responsible for the lawfulness of the disclosure to its AI Assistant’s provider and of any resulting transfer to a third country (Chapter V GDPR), and for informing data subjects. Data the Customer or its AI Assistant places in the sandbox or the development database is processed there as any other Customer Data.
3. Confidentiality
vbtnl ensures that every person authorised to process Customer Data (its staff, and the staff of its infrastructure provider with administrative access) has committed to confidentiality in writing or is under a statutory duty of confidentiality, has been instructed in data protection, and accesses Customer Data only to the extent needed to provide, secure and support the Service.
4. Security
4.1 vbtnl implements and maintains the technical and organisational measures in Annex II, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, to ensure a level of security appropriate to the risk (Article 32).
4.2 vbtnl may update Annex II as technology changes, provided the overall level of security does not decrease. Material changes are announced like changes to the Terms.
4.3 The Customer is responsible for the security of its own applications: the code, the authentication of its End Users, the data it collects and the secrets it stores, and for using the Service’s security features.
5. Sub-processors
5.1 The Customer gives general authorisation to vbtnl’s use of sub-processors. The current list, with purpose, location and transfer mechanism, is the Subprocessor list published at vbtnl.com/legal/subprocessors (Annex III refers to it).
5.2 vbtnl informs the Customer of any intended addition or replacement of a sub-processor at least 30 days in advance by email and in the dashboard. The Customer may object on reasonable data protection grounds within that period by writing to [email protected]. If vbtnl cannot accommodate the objection, the Customer may terminate the affected Projects or the contract without penalty before the change takes effect, with a refund of prepaid fees for the unused period.
5.3 vbtnl imposes on each sub-processor, by contract, data protection obligations at least as protective as this DPA, and remains fully liable to the Customer for the sub-processor’s performance.
6. Assistance to the Customer
6.1 Data subject requests. Taking into account the nature of the processing, vbtnl assists the Customer by appropriate technical and organisational measures in fulfilling the Customer’s obligation to respond to requests from data subjects (access, rectification, erasure, restriction, portability, objection). The Service provides database access and export tools for this; where a request reaches vbtnl directly, vbtnl forwards it to the Customer without undue delay and does not answer it itself, unless the Customer instructs otherwise.
6.2 Security, breaches, impact assessments. vbtnl assists the Customer in meeting its obligations under Articles 32 to 36 (security, breach notification, data protection impact assessments and prior consultation), taking into account the information available to vbtnl. Assistance beyond what the Service and this DPA already provide may be charged at reasonable rates.
7. Personal data breaches
7.1 vbtnl notifies the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Data. The notification describes, as far as known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. Information may be provided in phases.
7.2 vbtnl documents breaches and cooperates with the Customer in its investigation and in any notification to supervisory authorities or data subjects. The Customer decides whether and how to notify; vbtnl does not notify authorities or data subjects on the Customer’s behalf unless instructed.
8. Deletion and return
8.1 The Customer can export Customer Data at any time (Terms, Section 8) and delete it at any time by deleting the data, the Project or the account.
8.2 At the end of the provision of the Service, vbtnl deletes all Customer Data from live systems after the 30-day transition period (Terms, Section 8.2) and from backups within the backup cycle (14 days for databases), unless EU or Member State law requires storage. On request made before the end of the transition period, vbtnl provides a final export instead of, or before, deletion. vbtnl confirms deletion in writing on request.
9. Audits
9.1 vbtnl makes available to the Customer all information necessary to demonstrate compliance with Article 28: this DPA, Annex II, the Subprocessor list, summaries of security tests and incident reports, and answers to a reasonable written security questionnaire once a year.
9.2 Where that is not sufficient, the Customer, or an independent auditor bound by confidentiality and mandated by the Customer, may audit vbtnl’s processing of Customer Data once in any 12-month period (more often after a breach or when a supervisory authority requires it), on 30 days’ written notice, during business hours, without disrupting operations or compromising other customers’ data, at the Customer’s cost. vbtnl may charge its reasonable costs for audits beyond one day per year.
9.3 The infrastructure provider’s facilities are audited through the provider’s own certifications and reports, which vbtnl obtains and shares under confidentiality.
10. International transfers
10.1 Customer Data is stored and processed in the European Union (Cyprus). vbtnl does not transfer Customer Data to a third country except through the sub-processors listed in Annex III, each under a transfer mechanism named there (adequacy decision, EU-US Data Privacy Framework certification, or Standard Contractual Clauses with supplementary measures).
10.2 Where Standard Contractual Clauses apply between vbtnl and a sub-processor, vbtnl uses the Commission’s clauses (Decision 2021/914), Module 3 (processor to processor), and the UK Addendum where UK GDPR applies.
10.3 vbtnl notifies the Customer before processing Customer Data outside the EU/EEA in any other way, and the Customer may object under Section 5.2.
11. Liability and term
11.1 Each party’s liability under this DPA is governed by the Terms of Service (Section C.4: three times the fees paid in the 12 months before the claim). Nothing limits either party’s liability to data subjects under Article 82 GDPR.
11.2 This DPA lasts as long as vbtnl processes Customer Data, including the transition and deletion period.
11.3 In case of conflict between this DPA and the Terms regarding the processing of Customer Data, this DPA prevails. In case of conflict between this DPA and Standard Contractual Clauses, the Clauses prevail.
Annex I: Details of the processing
Subject matter. Hosting and operating the Customer’s web applications: storing and executing code, running managed databases, serving traffic, storing logs and backups, and enabling the Customer and its AI Assistant to develop, deploy and operate those applications. Returning production data to the Customer’s AI Assistant only as set out in Section 2.4.
Duration. The term of the Customer’s account, plus the transition and deletion period in Section 8.
Nature and purpose. Storage, retrieval, transmission, execution and backup of data as part of providing a platform-as-a-service, exclusively for the purpose of providing the Service to the Customer.
Categories of data subjects. The Customer’s End Users: visitors and users of the Customer’s applications; the Customer’s own staff, contractors and collaborators who use those applications; any other persons whose data the Customer chooses to process in them.
Categories of personal data. Whatever the Customer’s applications process: typically identification and contact data, account credentials (hashed by the Customer’s application), usage and technical data (IP addresses, logs), content submitted by End Users, and transaction data. vbtnl does not determine these categories and does not inspect Customer Data except as needed for security, support at the Customer’s request, or legal compliance.
Special categories of data. Not intended. The Customer must tell vbtnl in writing before processing data under Article 9 or 10 (health, biometric, criminal records, etc.) at scale, so that the appropriateness of Annex II can be reviewed.
Annex II: Technical and organisational measures
Infrastructure and physical security - Servers of Bolton Technologies Ltd in 195 Makarios III Avenue, 3608 Limassol, Cyprus, a datacenter with controlled physical access. The servers are reached only over the provider’s private network and a VPN.
Isolation between customers - Each Project runs in its own Kubernetes namespace with resource quotas; network policies allow only the traffic the application needs; no network path between customers’ Projects. - Customer code runs in a sandboxed container runtime (gVisor) that separates it from the host kernel. - Each Project’s databases are separate instances with separate credentials.
Encryption - All traffic between End Users and applications, and between the Customer and the platform, is encrypted with TLS 1.2 or higher, terminated at Cloudflare’s edge and carried to the platform through an authenticated, encrypted tunnel. - Secrets (passwords, keys, tokens) are encrypted at rest in the orchestrator and injected at runtime; they are never written to logs. - Passwords of the Customer’s account are stored only as salted hashes; personal access tokens only as hashes.
Access control - No inbound ports from the internet: all access goes through Cloudflare’s network and an authenticated tunnel. - Administrative access to servers only through a VPN with multi-factor authentication and with personal SSH keys; no shared accounts. The infrastructure provider’s administrators have privileged access for maintenance, governed by our contract with them and a duty of confidentiality. - Administrative access to platform data only through the internal admin tools: a login at Cloudflare Access for named people, then a per-person account with a password and multi-factor authentication; every access to a customer’s data is written to an append-only audit log. - Customer access to their Projects by password with strength rules, Google sign-in, personal access tokens (hashed) or OAuth; sessions with short-lived tokens and rotating refresh tokens; anti-bot checks on signup.
Logging and monitoring - Platform metrics and logs kept up to 30 days; administrative actions on customer data kept in the append-only audit log. - Monitoring of resource use and availability, with alerts to our team.
Availability and backups - Daily backups of managed databases, retained 14 days, stored on separate storage from the databases. - Releases are versioned; the previous version can be restored on failure. - Resource quotas prevent one Project from starving another.
Secure development and operations - Changes to the platform are tested before deployment; dependencies and the operating system are updated regularly. - A written incident response procedure with the 48-hour customer notification in Section 7 and the 72-hour supervisory authority assessment.
People - Confidentiality undertakings and data protection instructions for everyone with access to Customer Data, including the infrastructure provider’s administrators. - Access rights are reviewed when roles change and removed when people leave.
Data minimisation and deletion - vbtnl collects no Customer Data for its own purposes; deletion of a Project removes its namespace, storage, databases and secrets; account deletion removes the Customer’s data as described in the Terms and the Privacy Policy.
Annex III: Sub-processors
The authorised sub-processors, with purpose, location and transfer mechanism, are listed in the Subprocessor list at vbtnl.com/legal/subprocessors, which forms part of this Annex. Changes follow Section 5.
Version 2026-11-09.1, part of the Terms of Service of ZANTEMARK LIMITED.