This Data Processing Addendum (“DPA”) applies to Deployz, operated by Thalia Technologies Private Limited, Mumbai, India. It forms part of the Terms of Service or other agreement between Deployz and the customer (“Agreement”) when incorporated into that Agreement. It governs personal data Deployz processes on a customer’s behalf.
1. Roles and responsibilities
The customer is a Controller or Processor, as applicable, and Deployz is a Processor or Subprocessor for customer personal data. Each party complies with applicable data protection laws, including GDPR where relevant. The customer is responsible for lawful collection, use, and instructions. Deployz is an independent controller for its own account management, billing, security, and business operations.
2. Nature and purpose of processing
Deployz helps customers deploy and manage applications in their own AWS accounts. It may access and process authorized repository information, source code, application configurations, build artifacts, operational logs, deployment metadata, and personal information included in customer-submitted materials. Processing can involve collection, access, analysis, storage, transmission, modification, and deletion to provide services. Data subjects may include customer employees, developers, contractors, administrators, and others mentioned in submitted materials. Processing continues for the Agreement’s duration and any applicable retention period. Customer-deployed applications, databases, and storage remain within customer-controlled AWS infrastructure; Deployz does not automatically process all application end-user data.
3. Obligations of Deployz
-
Process customer personal data only on documented customer instructions, including instructions on international transfers, unless required by law, with legally permitted notice of that requirement.
-
Ensure authorized personnel are bound by appropriate confidentiality obligations.
-
Use security measures appropriate to the risks, including access controls and encryption where applicable.
-
Notify customers without undue delay after becoming aware of a personal data breach involving personal data processed under this DPA.
-
Provide reasonable assistance with data subject rights, security duties, breach obligations, and impact assessments, taking into account the processing and information available.
-
Inform customers if, in our opinion, their instructions infringe applicable GDPR requirements.
-
Make reasonably necessary compliance information available and allow and contribute to legally required audits, subject to reasonable safeguards.
4. Return and deletion
At the customer’s choice, upon service termination, Deployz will return or delete personal data processed on its behalf unless retention is legally required. Backup copies may follow retention schedules and remain protected until deletion. Customers manage resources and data in their own AWS accounts.
5. Subprocessors and service providers
The customer generally authorizes Deployz to use subprocessors necessary for its services. Where providers process customer personal data on Deployz’s behalf, Deployz will require appropriate contractual protections and remains responsible for their performance of those obligations. Deployz will notify affected customers of intended additions or replacements and provide a reasonable opportunity to object; unresolved objections may lead to termination of affected services.
The following providers support Deployz. Their specific legal roles may differ depending on the service and data processed:
| Provider | Purpose |
|---|---|
| Amazon Web Services (AWS) | Cloud infrastructure |
| Cloudflare | CDN and security |
| Zoho | Email and collaboration |
| Google Workspace | Business applications and collaboration |
| Paddle | Payments |
| Rollbar | Error logging |
| HubSpot | CRM |
| OpenAI | AI services |
| Anthropic | AI services |
| Brevo | Emails |
| PostHog | Analytics |
6. International transfers
Where applicable law requires safeguards for cross-border personal data transfers, the parties will implement an appropriate lawful mechanism. Any required Standard Contractual Clauses and annexes must be separately completed and validly incorporated; this DPA alone does not complete them.
7. Governing law
Indian law governs this DPA subject to mandatory data protection requirements. Disputes are subject to Mumbai courts unless applicable law requires otherwise.
8. Contact
Thalia Technologies Private Limited — Mumbai, India
Website: https://deployz.dev
DPA inquiries: https://share.hsforms.com/1dOsn_DJtRhq47DXIaRjeLw5auur