Data Processing Terms

Current position

This page is a transparency notice, not a contract. No statement here creates controller, processor, subprocessor, service-level, security, residency, or data-transfer obligations between Subkit and a visitor.

Before managed Cloud launches

Any future managed offering that processes customer personal data will require reviewed terms covering at least:

• the subject matter, duration, nature, and purpose of processing;
• documented controller instructions and processor obligations;
• security measures, incident notification, deletion, and return of data;
• subprocessors, hosting locations, and international transfer mechanisms;
• audit, assistance, and data-subject request procedures.

Self-hosted deployments

Self-hosting changes the technical and contractual relationship, but it does not by itself determine whether a DPA is required. Operators must evaluate all parties that process personal data in their complete deployment.

Contact

Questions about the planned contractual model can be sent to: