Data Processing Agreement

Last updated: 24 October 2026

When I host or process data for you, I am your processor under the GDPR. I send you the full agreement on request. It covers:

1. Subject and duration

The processing needed to deliver the services in your accepted quote, for as long as those services run.

2. Location

I process your data within the European Union.

3. Sub-processors

I use the providers on the providers page: Hetzner, Cloudflare, Twingate, OpenRouter or Requesty, Stripe and Google (Workspace, for email). I announce changes in advance, so you can object.

4. Security

Access only for those who need it, encryption in transit, infrastructure managed as code, and monitoring.

5. Data breaches

I let you know without undue delay as soon as I find a breach that affects your data.

6. End of the service

When you cancel a service, I return or delete your data. You choose.