This Data Processing Agreement (the "DPA") supplements the Terms of Service between you (the "Customer" or "Controller") and TAKEHOST OÜ (the "Processor" or "Lofenta") and applies when you process personal data of third parties (e.g. your own end users) using the Lofenta service. By using Lofenta on a paid plan you accept this DPA. If your organisation requires a signed version, email [email protected].
1. Definitions
Capitalised terms not defined here have the meaning in Regulation (EU) 2016/679 ("GDPR"). "Personal Data" means personal data processed by Lofenta on Customer's behalf in the course of providing the Service. "Subprocessor" means a third party engaged by Lofenta to process Personal Data.
2. Subject matter, duration and purpose
Lofenta processes Personal Data only to provide the Service described in the Terms, which includes: hosting and operating Customer's applications, storing application environment variables, routing requests, issuing TLS certificates, capturing deployment and runtime logs, and billing for the Service.
Processing lasts for the duration of the Terms. Within 30 days of termination, Lofenta deletes or, at Customer's request, returns all Personal Data unless retention is required by law (tax records, etc).
3. Nature and categories of Personal Data
The categories of data subjects are Customer's end users, employees and any contacts whose data Customer chooses to process via the Service. The types of Personal Data depend on what Customer stores: typically email addresses, IP addresses, application user identifiers, content uploaded to projects, environment variable values, deployment logs.
4. Processor obligations
- Process Personal Data only on documented instructions from Customer, which include the use of the Service in the ordinary course.
- Ensure persons authorised to process Personal Data are under appropriate confidentiality obligations.
- Implement technical and organisational measures appropriate to the risk (see Section 7).
- Assist Customer in fulfilling data subject rights requests (Art. 15-22 GDPR).
- Assist Customer in security, breach notification and impact assessment obligations (Art. 32-36 GDPR).
- Make available all information necessary to demonstrate compliance and allow audits as set out in Section 9.
5. Subprocessors
Customer authorises Lofenta to engage the subprocessors listed in our Privacy Policy. We commit to giving Team-plan customers 30 days' prior written notice before adding or replacing a subprocessor. Customer may object on reasonable data-protection grounds; if a workaround cannot be agreed within 30 days, Customer may terminate the Service with a pro-rata refund of unused prepaid fees.
6. International transfers
Application workloads and Customer Data are hosted within the European Economic Area (Romania and the Netherlands) on infrastructure operated by TAKEHOST OÜ, with payments processed by Stripe in Ireland. Transfers to non-EEA subprocessors (GitHub, Cloudflare, Let's Encrypt) rely on the European Commission's Standard Contractual Clauses (Implementing Decision 2021/914). Customer joins these SCCs as data exporter and Lofenta as data importer where applicable.
7. Security measures
Lofenta maintains the following measures, reviewed at least annually:
- Encryption in transit for all external traffic (TLS 1.2+).
- Encryption at rest for environment variables and access tokens (AES-256-GCM).
- Role-based access control for internal systems with least-privilege defaults.
- Multi-factor authentication on all administrator accounts.
- Centralised logging with retention aligned to Customer plan tiers.
- Network isolation between tenant workloads via container runtime.
- Quarterly review of subprocessor security posture.
- Documented incident-response playbook including 72-hour breach notification.
- Encrypted backups of the platform database.
8. Data breaches
Lofenta notifies Customer without undue delay, and in any event within 72 hours, of becoming aware of a Personal Data breach affecting Customer Data. The notification includes the nature of the breach, categories and approximate number of data subjects and records affected, likely consequences, and measures taken or proposed.
9. Audits
On reasonable written notice and no more than once per year (unless required by a supervisory authority), Customer may audit Lofenta's compliance with this DPA by reviewing third-party audit reports we make available. On-site audits are available for Enterprise customers subject to a separate scoping agreement and at Customer's expense.
10. Liability
Each party's liability under this DPA is governed by the limitation of liability clauses in the Terms of Service.
11. Governing law and jurisdiction
This DPA is governed by the same law as the Terms of Service, except that mandatory data protection law, including the GDPR where it applies, prevails. The courts named in the Terms have jurisdiction, except where mandatory law gives data subjects rights to bring proceedings in their place of habitual residence.
12. Order of precedence
In the event of any conflict, this DPA prevails over the Terms of Service with respect to the processing of Personal Data. All other matters remain governed by the Terms.
13. Contact
For DPA execution requests, security questions, audit reports or data subject coordination, email [email protected].