Data Processing Agreement
This Data Processing Agreement ("DPA") forms part of the Terms of Service between you ("Customer") and [Legal entity name] ("Thunderclap"). It applies whenever Thunderclap processes personal data on the Customer's behalf through the service, and sets out the terms required by Article 28 of the EU General Data Protection Regulation (GDPR) and, where they apply, the UK GDPR and the Swiss Federal Act on Data Protection. It needs no signature: accepting the Terms accepts this DPA.
1. Roles
The Customer is the controller of the personal data its apps send through the service ("Customer Personal Data"), or a processor acting for its own customers. Thunderclap is the Customer's processor, or sub-processor. Annex 1 describes the processing.
Personal data Thunderclap processes to run its relationship with the Customer, such as the Customer's account and billing data, is outside this DPA: Thunderclap is its controller, under the Privacy Policy.
2. Instructions
Thunderclap processes Customer Personal Data only on the Customer's documented instructions, unless the law requires otherwise, in which case it will tell the Customer first, unless the law forbids it. The Terms, this DPA, the Customer's configuration of its apps, and its use of the service and its APIs are the Customer's complete instructions. Thunderclap will tell the Customer if it believes an instruction infringes data protection law.
The Customer is responsible for the lawfulness of the instructions and of the data it sends, including having a legal basis and informing its end users.
3. Confidentiality
Thunderclap ensures that everyone authorised to process Customer Personal Data is bound by confidentiality, and gives access only to those who need it to provide, secure or support the service.
4. Security
Thunderclap implements the technical and organisational measures in Annex 2, appropriate to the risk, and may update them provided the overall level of security is not reduced.
5. Subprocessors
The Customer authorises Thunderclap to use the subprocessors listed below. Thunderclap imposes on each one data protection obligations no less protective than this DPA, and remains liable for their performance.
| Subprocessor | Purpose | Location | Transfer safeguards |
|---|---|---|---|
| Cloudflare, Inc. | Hosting of the website and the realtime engine (Workers, Durable Objects, D1, KV, Queues, Analytics Engine), logs, DNS and network protection | Global edge network; company in the United States | EU–US Data Privacy Framework; Standard Contractual Clauses |
| Resend, Inc. | Sending sign-in codes and service emails | United States | Standard Contractual Clauses |
Thunderclap will announce a new subprocessor on this page and by email to the owners of the Customer's organisations at least 30 days before it starts processing Customer Personal Data. The Customer may object on reasonable data protection grounds within that period. The parties will then discuss it in good faith; if they find no solution, the Customer may terminate the affected service without penalty and receive a refund of prepaid fees for the remaining period.
6. International transfers
Thunderclap's infrastructure runs on Cloudflare's global network, so Customer Personal Data may be processed in any country where Cloudflare operates, including outside the European Economic Area. Transfers rely on an adequacy decision where one exists, such as the EU–US Data Privacy Framework for certified recipients, and otherwise on the European Commission's Standard Contractual Clauses (2021/914), Module 2 (controller to processor) or Module 3 (processor to processor) as the case may be, which are incorporated into this DPA by reference. For those clauses, the optional clause 7 does not apply, clause 9 option 2 (general authorisation) applies with the notice period in section 5, clause 11's optional language does not apply, and clauses 17 and 18 refer to the law and courts of [Country].
7. Assistance
Taking into account the nature of the processing, Thunderclap will:
- help the Customer answer requests from data subjects exercising their rights, mostly through the service itself, and forward to the Customer any request it receives directly about Customer Personal Data, without answering it;
- give the Customer the information it reasonably needs for data protection impact assessments and prior consultations with supervisory authorities.
8. Personal data breaches
Thunderclap will notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences, and the measures taken or proposed. Thunderclap will update the Customer as it learns more and take reasonable steps to contain the breach. Notifying a breach is not an admission of fault.
9. Deletion and return
The service doesn't store message history: messages are delivered and discarded. When the agreement ends, or an app is deleted, the app stops working at once, and Thunderclap deletes the app's records and the Customer Personal Data in its configuration within 30 days, except where the law requires it to keep it. The little data the service's channels hold, cached events and presence membership, is retained as described in Annex 1. Because the service keeps no history, there is no message data to return; the Customer keeps its own copies.
10. Audits
Thunderclap will make available the information necessary to demonstrate compliance with this DPA, including its subprocessors' security certifications and audit reports where they can be shared. If that information isn't enough, the Customer may audit Thunderclap's compliance, at its own cost, once a year and with at least 30 days' notice, during business hours and without disrupting the service, through an independent auditor bound by confidentiality. Audits required by a supervisory authority are not limited to once a year.
11. Liability and precedence
Each party's liability under this DPA is subject to the limitations in the Terms, except where data protection law does not allow it. If this DPA conflicts with the Terms on the processing of personal data, this DPA prevails; if it conflicts with the Standard Contractual Clauses, the clauses prevail.
Annex 1: details of the processing
| Subject matter | Delivering realtime messages between the Customer's backend and its end users' devices |
| Duration | For the term of the agreement, plus the deletion period in section 9 |
| Nature of the processing | Receiving, routing and delivering messages; authorising connections and channel subscriptions; tracking presence; temporarily keeping the latest event of cache channels; sending webhooks to the Customer's endpoints |
| Purpose | Providing the service to the Customer |
| Data subjects | The Customer's end users, and any person whose data the Customer includes in messages |
| Categories of data | User identifiers and the user information the Customer puts in access tokens; presence membership; channel names; message and client event contents; IP addresses and technical data of connecting devices; webhook payloads |
| Special categories | None intended. The Customer must not send special categories of data unless agreed in writing |
| Retention | Messages are not stored: they are delivered and discarded. A cache channel's latest event is kept for 30 minutes, then deleted. Presence membership is kept while the member is connected; if the connection ends without the service seeing it close (for example when the service restarts for maintenance), until the next publish on the channel. Webhook events awaiting delivery are kept for up to 4 days. Technical logs are kept for up to 7 days |
Annex 2: technical and organisational measures
- Encryption. All connections to the service use TLS. App secrets are stored encrypted with AES-GCM, and are shown to the Customer only once.
- Isolation. Every app's connections and channels run in separate actors, named after the app, so one app can never reach another's data. Private and presence channels require tokens signed with the app's secret.
- Minimisation. No message history is stored. Data needed to run a connection or channel is kept only while it is in use, except as listed in Annex 1.
- Access control. Access to production systems and the control-plane database is restricted to the people who operate the service, using individual accounts protected by multi-factor authentication. The dashboard grants each organisation member only the rights of their role.
- Infrastructure. The service runs on Cloudflare, whose data centres and services are certified against ISO/IEC 27001 and SOC 2 Type II, with protection against network attacks.
- Resilience. The service is distributed across Cloudflare's network; the control-plane database has point-in-time recovery.
- Monitoring. Logs are kept for up to 7 days to detect faults and abuse. Usage is metered per app without personal data.
- Development. Every change runs the automated test suites in continuous integration, and dependencies are pinned to exact versions released at least two weeks earlier.
- Incidents. Thunderclap follows a documented procedure to assess, contain and notify personal data breaches, as described in section 8.
Contact
Questions about this DPA: thunderclap@bside-tech.com.