English
Română
PortuguêsAcuerdo de tratamiento de datos
Las condiciones en las que TotulDigital trata datos personales por cuenta de sus clientes. Forma parte de las Condiciones del servicio.
La versión corta
Tu organización decide qué pasa con sus datos; nosotros solo los tratamos siguiendo tus instrucciones, en un servidor en Francia, con las medidas que se enumeran aquí tal como están hoy.
1. Parties and roles
This Data Processing Agreement (DPA) is between the Customer (the controller) and VDR Tech Limited (the processor), and forms part of the Terms of Service.
It applies whenever we process personal data on your behalf in providing the Services, and meets Article 28(3) GDPR and the UAE Personal Data Protection Law.
2. Details of the processing
| Item | Description |
|---|---|
| Subject matter | Hosting and operating Cloud Office, VPS and the compliance module |
| Duration | The term of the Terms of Service plus the 30-day retrieval period |
| Nature and purpose | Storage, transmission, display, indexing for search, synchronisation to devices, security monitoring, support at your request |
| Data subjects | Your Users, and people whose data appears in your mail, files, calendars, contacts, notes, servers and logs |
| Personal data | Names, email addresses, message content and metadata, files, calendar entries, contact details, IP addresses, log and event data |
| Special categories | Only if you store them; we do not require any |
| Location | France (OVHcloud, Strasbourg); access from the UAE as described in clause 7 |
3. Instructions
We process personal data only on your documented instructions — this DPA, the Terms, the configuration you choose in the Services and written requests — unless the law requires otherwise, in which case we tell you first where legally allowed. We tell you if we believe an instruction infringes data protection law.
4. Confidentiality of personnel
Everyone we authorise to process the data is bound by confidentiality and accesses Customer Data only as needed to provide, secure or support the Services.
5. Security measures
We implement the technical and organisational measures below. They reflect what is in place today, not intentions:
| Area | Measure in place |
|---|---|
| Encryption in transit | TLS on the website, Cloud Office, IMAP, SMTP submission, CalDAV/CardDAV/WebDAV; MTA-STS (enforce) for incoming mail |
| Authentication | strong password hashing; optional TOTP two-factor sign-in with single-use recovery codes; scoped, revocable device passwords for sync clients |
| Access control | Per-mailbox access grants checked on every request; administrative roles separated from users |
| Logging | Audit log of administrative actions; security monitoring deployed across our own servers |
| Network | Virtual machines on a private network without public addresses; only required ports forwarded |
| Mail integrity | SPF, DKIM (2048-bit) and DMARC with policy reject |
| Physical security | Provided by OVHcloud's Strasbourg datacentre |
| Availability and backups | No backups or second site currently. Planned measure; until then the controller should keep its own copies |
6. Subprocessors
You authorise the subprocessors below. We impose data protection obligations on them equivalent to this DPA and remain responsible for them. We give at least 30 days' notice by email before adding or replacing one; you may object on reasonable grounds, and if we cannot resolve the objection you may terminate the affected Service without penalty.
| Subprocessor | Service | Location of processing | Data involved |
|---|---|---|---|
| OVHcloud SAS (2 rue Kellermann, 59100 Roubaix, France) | Dedicated server and datacentre (Strasbourg, SBG3) | France (EU) | All customer data, at rest and in processing |
| Cloudflare, Inc. | Authoritative DNS for our domains (DNS only; traffic is not proxied) | Cloudflare's global network | Domain names and DNS queries; no customer content |
| Internet Security Research Group (Let's Encrypt) | TLS certificates | United States | Host names in certificates; no customer content |
7. International transfers
Customer Data is stored in France. Our staff may access it from the United Arab Emirates to provide support and administration. Such access is a transfer to a country without an EU adequacy decision and is made under the European Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two (controller to processor), which are incorporated into this Agreement by reference; we carry out and keep a transfer impact assessment and will provide it on request.
8. Assistance
Taking into account the nature of the processing, we help you respond to data subject requests, carry out data protection impact assessments and consult supervisory authorities. Most requests can be met directly with the Services' own export and deletion features.
9. Personal data breaches
We notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Data, with the information then available: what happened, the data and people likely affected, likely consequences, and the measures taken or proposed. We supplement it as we learn more.
10. Return and deletion
When the Services end you may retrieve Customer Data for 30 days (IMAP, WebDAV, CalDAV, CardDAV, or an export we provide). We then delete it from the live systems, unless law requires us to keep it. Because we keep no backups, no further copies remain.
11. Audits
We make available the information needed to demonstrate compliance with this DPA. You may audit us, or appoint an independent auditor bound by confidentiality, once a year with 30 days' notice, at your cost, without disrupting the Services or other customers' data.
12. Liability and precedence
Liability under this DPA is subject to the Terms of Service. If this DPA conflicts with the Terms on personal data, this DPA prevails.
VDR Tech Limited
que opera como TotulDigital · Licencia MC 14332 · Masdar City Free Zone, Abu Dabi, EAU
SHA-256: ae893129912b08c158dd7afb3d857e676d8e9d19266203c0e1ab0e8f1d6f2af4
La organización cliente
Forma parte de las Condiciones del servicio; se aplica sin firma aparte
Estado: en vigor junto con las Condiciones