Data Processing Agreement
1. Scope and parties
This Data Processing Agreement ("DPA") forms part of the Terms of Service between you (the "Customer") and Portfoliobox Stockholm AB ("Portfoliobox"). It applies whenever the Customer uses the ironwire service (the "Service") to process personal data within the meaning of the GDPR — in particular data stored on, or received by, the Customer's virtual machines ("Customer Data"). With respect to Customer Data, the Customer is the controller (or a processor acting on behalf of another controller) and Portfoliobox is the processor. This DPA applies automatically; no separate signature is required.
2. Subject matter, duration, and nature of processing
Portfoliobox processes Customer Data solely to provide the Service: storing it on the Customer's virtual machines and associated storage, transmitting it over the Customer's network endpoints, and creating operational copies at the Customer's instruction. Processing lasts for the duration of the Terms of Service. The categories of data subjects and of personal data are determined solely by the Customer; Portfoliobox has no knowledge of, and does not inspect, the contents of Customer Data.
3. Instructions
Portfoliobox processes Customer Data only on the Customer's documented instructions — which are given through the Customer's use of the Service (for example, creating, copying, or deleting machines) — unless processing is required by Union or Member State law, in which case Portfoliobox informs the Customer of that legal requirement before processing, unless the law prohibits it. Portfoliobox will inform the Customer if, in its opinion, an instruction infringes the GDPR.
4. Confidentiality
Portfoliobox ensures that persons authorised to process Customer Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that access to Customer Data is limited to what is necessary to operate the Service.
5. Security
Pursuant to Art. 32 GDPR, Portfoliobox implements appropriate technical and organisational measures, including: hardware-virtualised isolation between customers' machines; encrypted transport (SSH, HTTPS) for all access to the Service; encryption at rest for stored secrets; access to production systems restricted to authorised operators over authenticated channels; and monitoring of the production environment.
6. Sub-processors
The Customer grants Portfoliobox general authorisation to engage sub-processors for hosting and operating the Service. The current sub-processors are Hetzner Online GmbH (server hosting, Germany, EU) and Stripe Payments Europe, Ltd. (payment processing, Ireland, EU), as listed in the Privacy Policy. Portfoliobox will update that list before adding or replacing a sub-processor, giving the Customer the opportunity to object on reasonable data-protection grounds; if the objection cannot be resolved, the Customer may terminate the affected part of the Service. Portfoliobox imposes data-protection obligations on each sub-processor equivalent to those in this DPA and remains liable for its sub-processors' performance. The push notification provider named in the Privacy Policy (Expo, United States) processes only account-side notification data for which Portfoliobox is the controller — device tokens and machine names — and never receives Customer Data; it is therefore not a sub-processor of Customer Data under this DPA.
7. Assistance
Taking into account the nature of the processing, Portfoliobox assists the Customer with appropriate technical and organisational measures in fulfilling the Customer's obligations to respond to data-subject requests (Art. 12–23 GDPR), and in ensuring compliance with the Customer's obligations regarding security, breach notification, and data-protection impact assessments (Art. 32–36 GDPR). In practice, the Service gives the Customer direct access to Customer Data, so the Customer can ordinarily fulfil such requests without Portfoliobox's involvement.
8. Personal data breaches
Portfoliobox notifies the Customer without undue delay after becoming aware of a personal data breach affecting Customer Data, providing the information reasonably available to it under Art. 33(3) GDPR.
9. Deletion and return
Upon termination of the Service, or upon the Customer's deletion of a machine or account, Portfoliobox deletes the associated Customer Data, unless Union or Member State law requires its storage. Prior to deletion, the Customer may export Customer Data through the Service's standard features.
10. Audit
Portfoliobox makes available to the Customer the information necessary to demonstrate compliance with Art. 28 GDPR and allows for and contributes to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer, upon reasonable notice and at the Customer's expense, no more than once per year unless a supervisory authority requires otherwise or a personal data breach has occurred.
11. International transfers
Customer Data is processed exclusively within the EU/EEA. Portfoliobox will not transfer Customer Data outside the EU/EEA without the Customer's prior authorisation and a valid transfer mechanism under Chapter V GDPR.