Data Processing Addendum

This addendum is part of the Terms of Service between you and Helios One Oy, Business ID 3596623-5. You are the controller, or a processor acting with your controller's authority; we are your processor or subprocessor. This addendum takes precedence for its subject matter.

The subject is hosting and operating your workspaces for the service term and the time needed to return or delete data. Processing includes receiving, storing, executing, retrieving, transmitting and deleting data as your workloads require. Data may include contact details, identifiers, communications and other personal data in your files, commands and outputs, relating to your users, staff, customers or other people you choose. Do not submit special-category or criminal-offence data without a separate written agreement.

Your use, configuration and written support requests are your documented instructions, including the disclosed hosting locations. You are responsible for a lawful basis, notices and instructions. We process data only on those instructions, including for transfers, unless law requires otherwise. We notify you of that requirement unless prohibited, and tell you if we believe an instruction infringes data-protection law.

We ensure authorized personnel are bound by confidentiality and limit access to service needs. We maintain measures appropriate to the risk, including TLS for service connections, access controls, credential protection, tenant authorization, microVM isolation, operational monitoring and incident response. Customers control their workspace code, permissions, outbound connections and independent backups. We do not use your content to train AI models.

We notify you without undue delay after becoming aware of a personal-data breach affecting your content, with available information about its nature, likely impact, mitigation and a contact. We provide updates as information becomes available and help you meet notification obligations.

You authorize Amazon Web Services for workspace hosting, compute, storage and related infrastructure in US West (Oregon), with global network delivery. Scaleway provides transactional email from Paris and may process content included in service notifications. Stripe handles account billing as described in the Privacy Policy, rather than hosting workspace content.

We bind subprocessors to equivalent data-protection obligations and remain responsible for their performance. We give at least 30 days' notice by email before adding or replacing a subprocessor. You may object on reasonable data-protection grounds during that period. We will work to resolve the objection; if we cannot, you may terminate the affected service and receive a refund of its unused prepaid fees.

Transfers outside the EEA use an applicable adequacy decision or appropriate safeguards, including the European Commission's standard contractual clauses in provider data-processing terms. You can request details and copies of applicable safeguards.

Taking account of the processing and information available, we help with data-subject requests, security obligations, breach notifications, impact assessments and regulator consultations. We forward requests concerning your content and do not answer on your behalf without instructions unless law requires it.

We provide information needed to demonstrate compliance and allow reasonable audits and inspections by you or an independent auditor you appoint, subject to confidentiality and safeguards for other customers. These arrangements do not restrict a regulator's powers.

At the end of the service, you choose return or deletion of personal data through the service or by contacting us. We delete remaining copies unless law requires retention; backup copies are isolated from ordinary use and deleted through backup rotation. This addendum continues to protect data until deletion.

Contact for instructions, security incidents and data requests: shardflux@heliosone.fi.