Data Processing Agreement

1. Scope & Parties

This Data Processing Agreement ("DPA") forms part of theTerms of Service between you ("Customer") andThanh Tung Nguyen, an individual trading as PocketBase Cloud, of 605 W Chapel Hill, Durham, NC 27701, United States ("PocketBase Cloud", "we"). It applies whenever we process personal data on your behalf under the EU General Data Protection Regulation ("GDPR"), the UK GDPR, or the Swiss Federal Act on Data Protection.

For personal data stored in or passing through your PocketBase instances, backends and frontends ("Customer Personal Data"), you are the controller and we are the processor. For your own account and billing details we are the controller, and ourPrivacy Policy applies instead.

2. Details of Processing

• Subject matter and purpose. Hosting, running, backing up and serving your applications as described in the Terms of Service.
• Nature. Storage, retrieval, transmission, backup, restoration and deletion, carried out automatically by the platform or on your instructions through the portal, CLI, API or a connected AI assistant.
• Duration. For as long as you use the service, plus the deletion period in section 9.
• Data subjects and categories of data. Decided by you: typically your application's end users and whatever personal data your application stores, such as names, email addresses, uploaded files and usage records. If you turn on Browser Errors, it also includes the visitor data described in section 4 of the Privacy Policy.
• Special categories. We do not ask for special category data (GDPR Article 9). If you store it, you are responsible for confirming these measures are adequate for it.

3. Our Obligations

We will:

• process Customer Personal Data only on your documented instructions, which are the Terms of Service, this DPA and your use of the service, unless the law requires otherwise, in which case we will tell you first unless the law forbids it;
• tell you if we believe an instruction infringes data protection law;
• ensure that anyone authorised to access Customer Personal Data is bound by confidentiality;
• not access the contents of your instances except to provide the service, to fix a problem you report, or where the law requires it;
• never sell Customer Personal Data or use it for advertising.

4. Sub-processors

You authorise us to use the sub-processors below. The infrastructure provider that hosts a given instance depends on the plan and region you chose.

Each sub-processor is bound by written terms that protect the data at least as well as this DPA. We remain responsible to you for their performance. We will give you at least 30 days' notice by email before adding or replacing a sub-processor. If you object on reasonable data protection grounds, and we cannot address the objection, you may close your account. If you do, we will refund any prepaid fees for the period after closure.

5. International Transfers

Your instance's data is stored in the region you chose. Copies may be held elsewhere when you use a feature that needs it, such as continuous backup to Cloudflare R2.

Where personal data subject to the GDPR is transferred to a country without an adequacy decision from the European Commission, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 apply. Module 2 governs transfers from you to us, and Module 3 governs transfers from us to a sub-processor. For the Clauses, Clause 7 (docking) applies, option 2 of Clause 9 (general authorisation, with the notice period in section 4) applies, and Clauses 17 and 18 select Irish law and the courts of Ireland. The details of processing in section 2 and the measures in section 6 complete the Annexes. For UK data, the UK International Data Transfer Addendum applies. For Swiss data, the Clauses apply with the references adapted to Swiss law.

6. Security Measures

We maintain the technical and organisational measures described on our Security & data page, including isolation of each instance in its own rootless container under its own system user, HTTPS for every instance, and encryption at rest of environment variables. We may change these measures if the overall level of protection does not decrease.

7. Personal Data Breaches

We will notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe what happened, the data and data subjects likely affected, the likely consequences, and what we have done or will do about it. Where we do not yet have all of this information, we will send it as it becomes available.

8. Assistance

Your instances give you direct access to your data, so you can answer most data subject requests (access, correction, deletion, portability) yourself. Where you cannot, we will help you, taking into account the nature of the processing. We will also give you reasonable help with data protection impact assessments, prior consultations with supervisory authorities, and your security obligations. If a data subject contacts us directly about Customer Personal Data, we will refer them to you.

9. Deletion & Return

You can download a complete backup of any instance at any time from its PocketBase admin or with the CLI. When you delete an instance, we delete its database, uploaded files, logs, PocketBase backups and continuous backups immediately. Copies held in its previews are deleted within an hour, and export files you created from it are deleted after 1 day. An account can only be closed once its instances are deleted.

10. Audits

We will make available the information you reasonably need to show that we meet Article 28 of the GDPR. If that information is not enough, you or an independent auditor bound by confidentiality may audit us once a year, at your own cost, with at least 30 days' written notice, in a way that does not disrupt the service or expose other customers' data.

11. General Terms

If this DPA conflicts with the Terms of Service on the processing of personal data, this DPA prevails. If it conflicts with the Standard Contractual Clauses, the Clauses prevail. Liability under this DPA is subject to the limitations in the Terms of Service, except where the law does not allow them. This DPA ends when we no longer process Customer Personal Data.

12. Signing

This DPA applies automatically to every customer who accepts the Terms of Service, with no signature needed. If your records require a signed copy, email[email protected] with your name or company name, address and account email, and we will send you a copy signed by us.