Snapshot 307
Normalized text
Scripts and page chrome removed; this is what change detection compares.
turbopuffer Inc.
Data Processing Addendum
This Data Processing Addendum (“ DPA”) forms part of the turbopuffer Terms of Service available at
http://turbopuffer.com/tos, or if different, the other written agreement between turbopuffer and Customer for
turbopuffer’s provision of services to Customer (the “Agreement”). In the event of any conflict between the terms
of this DPA and the Agreement, the terms of this DPA shall prevail to the extent of any such conflict.
1. Definitions. For purposes of this DPA, the following terms shall have the meanings ascribed to them
herein. Other terms capitalized but not defined in this DPA shall have the meanings given to them in the
Agreement.
1.1. “CCPA” means the California Consumer Privacy Act of 2018, as amended by the California Privacy
Rights Act of 2020, and any regulations promulgated thereunder, in each case, as amended from
time to time.
1.2. “Controller” or “Business” shall have the meaning given to it under any applicable Privacy Law.
1.3. “Customer Personal Data” means Customer Data that constitutes Personal Data.
1.4. “Data Subject” means an identified or identifiable natural person to whom Customer Personal
Data relates.
1.5. “GDPR” means, as applicable and as amended from time to time (a) the General Data Protection
Regulation (Regulation (EU) 2016/679) (“EU GDPR”) in the European Union (“EU”) or (b) the EU
GDPR as it forms part of United Kingdom (“UK”) law by virtue of section 3 of the European Union
(Withdrawal) Act 2018 (as amended, including by the Data Protection, Privacy and Electronic
Communications (Amendments etc.) (EU Exit) Regulations 2019) (“UK GDPR”), in each case,
including any applicable national implementing or supplementary legislation (e.g., the UK Data
Protection Act 2018).
1.6. “Sale” shall have the meaning given to it under any applicable Privacy Law.
1.7. “Share” shall have the meaning given to it under the CCPA.
1.8. “Personal Data” means any information that constitutes “personal data,” “personal
information,” “personally identifiable information,” or information within the scope of any
analogous term under any Privacy Law.
1.9. “Personal Data Breach” means a breach of turbopuffer’s security leading to the accidental or
unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer
Personal Data in turbopuffer’s possession or control.
1.10. “Processor” or “Service Provider” shall have the meaning given to it under any applicable Privacy
Law.
1.11. “Privacy Laws” means the privacy and data protection laws and regulations of any jurisdiction
that apply to turbopuffer’s Processing of Customer Personal Data pursuant to the Agreement,
including, as applicable, the GDPR, CCPA and other U.S. state privacy laws.
1.12. “Processing,” “Process,” and “Processed” means any operation or set of operations that are
performed on Personal Data or on sets of Personal Data, whether or not by automated means.
Where applicable, Processing, Process, and Processed shall be interpreted consistent with the
same or similar term under the Privacy Laws.
1.13. “Restricted Transfer” means a transfer of Customer Personal Data to an importer located in (a)
where the EU GDPR applies, any country or territory outside the European Economic Area that
does not benefit from an applicable adequacy decision from the European Commission described
in Chapter 45 of the GDPR (an “EU Restricted Transfer”) or (b) where the UK GDPR applies, any
country or territory outside the UK that does not benefit from an applicable adequacy decision
from the UK Government (a “UK Restricted Transfer”).
1.14. “SCCs” means the clauses annexed to the EU Commission Implementing Decision 2021/914, as
amended or replaced from time to time. means the standard contractual clauses approved by
the European Commission pursuant to implementing Decision (EU) 2021/914, as implemented in
accordance with Section 6.
1.15. “Subprocessor” means any third-party engaged directly or indirectly by or on behalf of
turbopuffer to Process Customer Personal Data in turbopuffer’s possession or control.
1.16. “Supervisory Authority” has the meaning given to it in the GDPR.
1.17. “UK Addendum” means the template addendum to the SCCs issued by the UK Information
Commissioner under Section 119A(1) of the UK Data Protection Act 2018 (version B.1.0, in force
March 21, 2022), as it is revised under Section 18 of the Mandatory Clauses included in Part 2
thereof (the “UK Mandatory Clauses”).
2. Scope, Roles, and Termination.
2.1. Applicability. This DPA applies only to turbopuffer’s Processing of Customer Personal Data to
provide the Service to Customer pursuant to the Agreement as described in in Appendix A to this
DPA, and only to the extent such Processing is subject to the GDPR, CCPA or other Privacy Laws
that require a Controller to contractually impose data protection obligations on a Processor.
2.2. Roles of the Parties. For the purposes of the Agreement and this DPA, Customer is, or is a
Processor acting on behalf of, the Party responsible for determining the purposes and means of
Processing Customer Personal Data as the Controller or Business, as applicable, and appoints
turbopuffer as a Processor or Service Provider, as applicable, to Process Customer Personal Data
on behalf of Customer for the limited and specific purposes set forth in Appendix A.
3. Compliance.
3.1. Compliance with Obligations. Turbopuffer shall (a) comply with its obligations under Privacy
Laws, (b) provide the level of privacy protection required by Privacy Laws, and (c) notify
Customer of any determination by turbopuffer that turbopuffer can no longer meet its
obligations under Privacy Laws. Upon the reasonable request of Customer, turbopuffer shall use
commercially reasonable efforts to make available to Customer all information in turbopuffer’s
possession necessary to demonstrate turbopuffer’s compliance with this DPA and Privacy Laws.
3.2. Compliance Assurance. Customer has the right to take reasonable and appropriate steps in
accordance with this Section 3 to ensure that turbopuffer uses Customer Personal Data
consistent with Customer’s obligations under applicable Privacy Laws and this DPA and to stop
and remediate any unauthorized use of Customer Personal Data by turbopuffer.
3.3. Audit. turbopuffer shall cooperate with audits (including inspections) of turbopuffer’s technical
and organizational measures as mandated by a Supervisory Authority or to verify compliance
with Customer’s obligations under Privacy Laws and turbopuffer’s compliance with this DPA,
provided that such audits shall be performed (a) at Customer’s sole cost and expense, (b) by
Customer or a qualified and independent third-party auditor appointed by Customer, (c)
according to a recognized audit standard or framework, (d) subject to a non-disclosure
agreement acceptable to turbopuffer in respect of information made available to audit
participants, (e) during normal business hours and no more than once in any calendar year
during the term of the Agreement unless Customer is required to perform the audit under
Privacy Law, (f) in accordance with turbopuffer’s safety, security or other relevant policies, and
(g) without unreasonably interfering with turbopuffer’s business activities. turbopuffer may
suspend the audit or inspection or withhold requested information until Customer has confirmed
the lawfulness of its audit requests and instructions in writing. Customer shall not conduct any
scans or technical or operational testing of turbopuffer’s applications, websites, Service,
networks, or systems without turbopuffer’s prior approval. Customer shall promptly provide
turbopuffer with a copy of any report created by an independent auditor engaged by Customer
in respect of such an audit. This Section shall not be construed to require turbopuffer to violate a
duty of confidentiality to any third-party. If the controls or measures to be assessed in the
requested audit are assessed in an audit performed by a qualified and independent third-party
auditor pursuant to a recognized audit control standard or framework within twelve (12) months
of Customer’s audit request and turbopuffer has confirmed in writing that there have been no
known material changes to the controls audited by such audit, Customer agrees to accept the
auditor’s report regarding such audit (“Audit Report”) in lieu of requiring an audit of such
controls or measures. Such Audit Report and any other information obtained by Customer in
connection with an audit under this DPA shall constitute confidential information of turbopuffer,
which Customer shall use only for the purposes of confirming compliance with the requirements
of this DPA or performing Customer’s obligations under Privacy Laws. turbopuffer shall provide
Customer with any relevant Audit Report upon Customer’s written request.
4. Restrictions on Processing.
4.1. Limitations on Processing. turbopuffer will Process Customer Personal Data solely in accordance
with Customer’s instructions and the Agreement or as required by applicable laws (or in the case
of Customer Personal Data subject to the GDPR, the laws of the UK or EU, as applicable, to which
turbopuffer is subject). The Agreement and Customer’s use of the Service’s settings and features
in accordance with the Agreement are the complete expression of such instructions, and
Customer’s additional instructions shall be binding on turbopuffer only pursuant to an
amendment to this DPA signed by both Parties. turbopuffer shall immediately notify Customer if,
in turbopuffer’s opinion, Customer’s instructions infringe Privacy Laws. Except as permitted by
applicable Privacy Laws, the Agreement, or this DPA, turbopuffer is prohibited from (i) selling or
sharing Customer Personal Data, (ii) retaining, using, or disclosing Customer Personal Data for
any purpose (including any “commercial purpose”, as defined by the CCPA) other than for the
specific purpose of carrying out Customer’s instructions described in this Section 4.1, (iii)
retaining, using, or disclosing Customer Personal Data outside of the direct business relationship
between the Parties, and (iv) combining Customer Personal Data with Personal Data obtained
from, or on behalf of, sources other than Customer.
4.2. Confidentiality. turbopuffer shall ensure that its personnel, agents, and Subprocessors are
subject to a duty of confidentiality with respect to Customer Personal Data.
4.3. Subprocessors. Customer hereby authorizes turbopuffer to engage Subprocessors. turbopuffer’s
current Subprocessors are listed on at https://turbopuffer.com/docs/security or such other web
page as turbopuffer may make available to Customer from time to time (the “Subprocessor
Page”). Th Subprocessor Page is incorporated into this DPA by this reference. Turbopuffer shall
notify Customer of any intended changes concerning the use of new Subprocessors not listed on
the Subprocessor Page as of the date Customer accepted the Agreement. turbopuffer may give
such notification by updating the Subprocessor Page, provided turbopuffer makes available a
mechanism by which Customer can subscribe to receive automated notifications of such
updates. turbopuffer shall ensure that turbopuffer's Subprocessors who Process Customer
Personal Data on turbopuffer’s behalf agree in writing to the same or equivalent restrictions and
requirements that apply to turbopuffer in this DPA with respect to Customer Personal Data.
Customer may object in writing to turbopuffer’s appointment of a new Subprocessor on
reasonable data protection grounds by notifying turbopuffer in writing within ten (10) business
days of receipt of notice in accordance with this Section 4.3. In the event of such Customer
objection, the Parties shall discuss Customer’s concerns in good faith with a view to achieving a
commercially reasonable resolution of Customer’s objection. If the Parties have not resolved
such objection to their mutual satisfaction within a timeframe acceptable to Customer,
Customer’s sole and exclusive remedy shall be to terminate the Agreement and cancel the
Service no later than 90 days after Customer’s receipt of the initial notice of Subprocessor
engagement by notifying turbopuffer in writing of such termination and paying turbopuffer for
all amounts due and owing under the Agreement as of the date of such termination. Such
termination shall take effect on the first date as of which turbopuffer has received such timely
notice and payment.
5. Compliance Assistance
5.1. Customer is solely responsible for responding to requests of Data Subjects to exercise their rights
under Privacy Laws with respect to Customer Personal Data (“Data Subject Request”). Taking
into account the nature of the Processing, and the information available to turbopuffer,
turbopuffer shall provide Customer, including, as appropriate, by implementing technical and
organizational measures, with such information and assistance as Customer may reasonably
request to fulfill its own obligations under Privacy Laws in relation to turbopuffer’s Processing of
Customer Personal Data, including in relation to (a) the security of Customer Personal Data, (b)
the investigation and reporting of Personal Data Breaches, (c) the demonstration of turbopuffer’s
compliance with this DPA, (d) compliance with Data Subject Requests; and (e) the performance
of any data protection assessments and consultations with Supervisory Authorities or other
government authorities, including those required under Articles 35 and 36 of the GDPR.
5.2. turbopuffer shall not be obligated to respond to any Data Subject Request but may instruct the
Data Subject to submit the request to Customer.
6. International Data Transfers
6.1. By signing this DPA, the Parties enter into, and with respect to any EU Restricted Transfer
resulting from the performance of the Agreement, agree to comply with their obligations under,
Module 2 (controller-to-processor) of the SCCs and, to the extent Customer is a Processor on
behalf of a third-party Controller, Module 3 (Processor-to-Subprocessor) of the SCCs, which
Modules 2 and 3 are hereby incorporated by this reference and completed as follows: the “data
exporter” is Customer; the “data importer” is turbopuffer; the optional docking clause in Clause 7
does not apply; Option 2 of Clause 9(a) is implemented and the time period therein is as
specified in Section 4.3 of this DPA and the list of Subprocessors already authorized by the data
exporter shall be the list on the Subprocessor Page as of the date Customer accepted the
Agreement; the optional redress clause in Clause 11(a) is struck; in Clause 13, all square brackets
are removed with the text remaining; Option 1 in Clause 17 is implemented and the governing
law in relation to any EU Restricted Transfer is the law of Ireland; the courts in Clause 18(b) in
relation to an EU Restricted Transfer are the Courts of Dublin, Ireland; Annex I and II to module 2
of the SCCs are Appendix A and B to this DPA respectively; Annex III and Option 1 to the
Appendix to the SCCs do not apply; and Part C of Annex I to the Appendix to the SCCs is
populated to provide that the competent Supervisory Authority shall be (a) where Customer is
established in an EU Member State, the Supervisory Authority of that EU Member State; (b)
where Customer is not established in an EU Member State but is subject to the EU GDPR under
Article 3(2) and has appointed an EU representative under Article 27 of the GDPR, the
Supervisory Authority of the EU Member State in which Customer’s EU representative is based;
or (c) where Customer is not established in an EU Member State but is subject to the EU GDPR
under Article 3(2) and has not appointed an EU representative under Article 27 of the GDPR, the
Supervisory Authority of one of the EU Member States in which Data Subjects whose Personal
Data is transferred in the Restricted Transfer in relation to the offering of goods or services to
them, or whose behavior is monitored, are located, which Supervisory Authority must be
confirmed in a written notice from Customer to turbopuffer. Nothing in the Agreement shall limit
either Party’s liability to Data Subjects under the third-party beneficiary provisions of the SCCs.
6.2. The Parties agree to the following operational clarifications regarding the SCCs:
6.2.1. When complying with its transparency obligations under Clause 8.3 of the SCCs,
Customer agrees that it shall not provide or otherwise make available, and shall take all
appropriate steps to protect, turbopuffer’s and its licensors’ trade secrets, business
secrets, confidential information and/or other commercially sensitive information.
6.2.2. For the purposes of Clause 10(a) of Module Three of the SCCs, Customer acknowledges
and agrees that there are no circumstances in which it would be appropriate for
turbopuffer to notify any third-party Controller of any Data Subject Request and that
any such notification shall be the sole responsibility of Customer.
6.2.3. For the purposes of Clause 15.1(a) of the SCCs, except to the extent prohibited by
applicable law and/or the relevant public authority, as between the Parties, Customer
agrees that it shall be solely responsible for making any notifications to relevant Data
Subject(s) if and as required.
6.2.4. The terms and conditions of Section 4.3 of the DPA apply in relation to turbopuffer’s
appointment and use of Subprocessors under the SCCs. Any approval by Customer of
turbopuffer’s appointment of a Subprocessor that is given expressly or deemed given
pursuant to the DPA constitutes Customer’s documented instructions to effect
disclosures and onward transfers to any relevant Subprocessors as required under
Clause 8.8 of the SCCs.
6.2.5. The audits described in Clauses 8.9(c) and 8.9(d) of the SCCs shall be subject to any
relevant terms and conditions detailed in Section 3.3 of the DPA.
6.2.6. Certification of deletion of Customer Personal Data as described in Clauses 8.5 and 16(d)
of the SCCs, shall be provided only upon Customer’s written request.
6.3. In respect of any UK Restricted Transfer from Customer to turbopuffer, the Parties shall be
bound by the SCCs as set forth in Section 6.2 and such SCCs are hereby deemed to be modified to
address the requirements of the UK GDPR in accordance with UK Addendum, which the Parties
enter into by signing this DPA and which is hereby incorporated by this reference and populated
in accordance with this Section 6.3. As permitted by Section 17 of the UK Mandatory Clauses,
the Parties agree that the manner of the presentation of the information included in the UK
Addendum as set out in this Section 6.3 shall not operate or be construed to reduce the
Appropriate Safeguards (as defined in the UK Mandatory Clauses). With respect to Part 1 of the
UK Addendum, as permitted by Section 17 thereof, (A) Tables 1, 2 and 3 to the UK Addendum are
populated with the corresponding details set out in Annex A to this DPA, subject to the variations
effected by the UK Mandatory Clauses, and (B) Table 4 to the UK Transfer Addendum is
populated by the box labeled 'Data Importer' being ticked. With respect to Part 2 to the UK
Transfer Addendum, the Parties shall be bound by the UK Mandatory Clauses thereof.
6.4. If turbopuffer’s compliance with Privacy Laws applicable to international data transfers is
affected by circumstances outside of turbopuffer’s control, including if a legal instrument for
international data transfers is invalidated, amended, or replaced, then Customer and turbopuffer
will work together in good faith to reasonably resolve such non-compliance. In the event that
additional, replacement or alternative standard contractual clauses or UK standard contractual
clauses are approved by supervisory authorities, turbopuffer reserves the right to amend the
Agreement and this DPA by adding to or replacing, the standard contractual clauses or UK
standard contractual clauses that form part of it at the date of signature in order to ensure
continued compliance with Privacy Laws.
7. Deletion of Customer Personal Data.
7.1. Upon direction by Customer, and in any event no later than 30 days after receipt of a request
from Customer, turbopuffer shall promptly delete Customer Personal Data as directed by
Customer, unless turbopuffer is required by law to retain such data, in which case turbopuffer
shall, on an ongoing basis, isolate and protect the security and confidentiality of such Personal
Data and prevent any further processing except to the extent required by such law and shall
destroy or return to Customer all other Personal Data not required to be retained by turbopuffer
by law.
8. Security.
8.1. Turbopuffer and Customer shall implement and maintain technical and organizational measures
designed to protect Customer Personal Data from Personal Data Breaches that are appropriate
to the nature of the Customer Personal Data. Such measures shall include those listed in
Appendix B and any others that turbopuffer is required to maintain under Privacy Laws.
8.2. Upon becoming aware of a Personal Data Breach, turbopuffer shall notify Customer of the same
without undue delay and shall provide updates and information relating to the Personal Data
Breach as is reasonably requested by Customer. turbopuffer’s notification of or response to a
Personal Data Breach shall not be construed as turbopuffer’s acknowledgement of any fault or
liability with respect to the Personal Data Breach.
9. Sale of Data.
9.1. The Parties acknowledge and agree that the exchange of Personal Data between the Parties does
not form part of any monetary or other valuable consideration exchanged between the Parties
with respect to the Agreement or this DPA.
10. Changes to Applicable Privacy Laws.
10.1. The Parties agree to negotiate in good faith any additional agreements, or amendments to this
DPA, required to comply with any applicable Privacy Law.
Appendix A - Description of the Transfer and Processing Details
A. LIST OF PARTIES
Data exporter:
● Name: Customer, as identified in the Order
● Address: As identified in the Order
● Contact person’s name, position and contact details: As identified in the Order
● Activities relevant to the data transferred under these Clauses: Customer receives turbopuffer’s services
as described in the Agreement and turbopuffer Processes Personal Data on behalf of Customer in that
context.
● Signature and date: See Order
● Role (controller/processor): Controller, or Processor on behalf of third-party Controller
Data importer:
● Name: turbopuffer (as defined above)
● Address: 135 Laurier Ave, Ottawa, ON K1P 5J2, Canada
● Contact person’s name, position and contact details: Simon Eskildsen, CEO, simon@turbopuffer.com
● Activities relevant to the data transferred under these Clauses: Turbopuffer provides its services to
Customer as described in the Agreement and Processes Personal Data on behalf of Customer in that
context.
● Signature and date: See Order
● Role (controller/processor): Processor on behalf of Customer, or Subprocessor on behalf of third-party
Controller
Nature of the Processing Storage, indexing, search, and retrieval.
Purpose(s) of the Processing To provide the Service.
Categories of Data Subjects Customer’s current, former and/or prospective customers, partners,
vendors, and business contacts.
Categories of Personal Data Determined by Customer and may include any category of personal
data other than Prohibited Data
Types of Customer Personal Data Subject to Determined by Customer and may include any category of Customer
Processing Personal Data other than other than Prohibited Data
Duration of Processing For the term of the Agreement.
Categories of Sensitive Data (and applied N/A. See the provisions of the Agreement re Prohibited Data.
restrictions or safeguards).
● The frequency of the transfer (e.g., whether the data is transferred on a one-off or continuous basis): On a
continuous basis.
● Nature of the processing: Customer has requested that turbopuffer provides the Service in accordance with
the Agreement and the DPA.
● Purpose(s) of the data transfer and further processing: The purpose of the Processing is included in the
Agreement and the DPA.
● The period for which the personal data will be retained, or, if that is not possible, the criteria used to
determine that period: Personal Data will be retained for as long as necessary taking into account the
purpose of the Processing, and in compliance with applicable laws, including laws on the statute of
limitations and Privacy Laws.
● For transfers to (Sub)Processors, also specify subject matter, nature and duration of the processing: For the
subject matter and nature of the Processing, reference is made to the Agreement and this DPA. The
Processing will take place for the duration of the Agreement.
B. COMPETENT SUPERVISORY AUTHORITY
Except as otherwise provided in this DPA:
● The competent authority for the Processing of Personal Data relating to data subjects located in the EU is
the Supervisory Authority of Ireland.
● The competent authority for the Processing of Personal Data relating to data subjects located in the UK is
the UK Information Commissioner.
Appendix B – Security Measures
turbopuffer maintains security measures which are designed to protect the confidentiality, integrity, and
availability of Customer Personal Data. These measures are audited against the American Institute of Certified
Public Accountants (AICPA) Trust Services Criteria for security and availability.