1. Parties and scope
This agreement is between the customer who holds a Nuvlo account (“controller”) and Wolfgang Wachelhofer, trading as Terrapixel, Heiligenstädter Straße 80/3/3, 1190 Wien, Austria (“processor”). It is part of the terms of service and is concluded when the customer accepts them. It meets the requirements of Art. 28 GDPR.
It applies wherever Nuvlo processes personal data on the customer’s behalf while providing the service. It does not apply to the account, billing and usage data Nuvlo processes as controller, which the privacy policy covers.
2. Subject, nature and purpose
Nuvlo sets up and manages servers and websites in cloud accounts that belong to the controller. In doing so it may access personal data that the controller keeps on those servers. This happens in particular when Nuvlo:
- relays sessions of the browser terminal, the file manager and the database tool, and uploads of site files;
- reads web server access logs to show visitor numbers, without storing them;
- stores environment variables, database and application passwords, and deploy logs;
- serves traffic for temporary nuvlo.link site addresses through Cloudflare;
- captures a preview image of each site’s homepage;
- sends repository files to the AI provider when the controller asks for suggested code fixes;
- checks the controller’s public URLs for uptime and security.
The purpose is solely to provide the Nuvlo service to the controller. Processing lasts as long as the customer’s contract.
3. Types of data and data subjects
Types of data: whatever the controller keeps on its servers and sites, for example contact and account data of its own users, content, order data, IP addresses and user agents in access logs, and credentials in environment variables.
Data subjects: visitors, users and customers of the controller’s websites and applications, and the controller’s own staff and team members.
The controller decides what data is on its servers. Special categories of data (Art. 9 GDPR) are only processed if the controller stores them there.
4. Instructions
The processor processes personal data only on documented instructions of the controller, including with regard to transfers to third countries, unless EU or Austrian law requires otherwise; in that case it informs the controller beforehand unless the law prohibits this. The terms, this agreement and the actions the controller, its team members or its agents start in Nuvlo are the controller’s instructions. Further instructions can be given in writing or by email.
The processor tells the controller without delay if it believes an instruction infringes data protection law.
5. Confidentiality
Everyone the processor authorises to process the data is bound to confidentiality, by contract or by law.
6. Security
The processor takes the technical and organisational measures required by Art. 32 GDPR, described in the annex. It may update them as long as the level of protection does not decrease.
7. Subprocessors
The controller generally authorises the processor to engage the subprocessors listed on the subprocessors page. The processor informs the controller by email at least 30 days before adding or replacing a subprocessor. The controller may object for important data protection reasons within that period; if the parties cannot agree, the controller may end the contract before the change takes effect.
The processor imposes the same data protection obligations on each subprocessor by contract and remains liable to the controller for their compliance.
8. Transfers outside the EU
Where a subprocessor processes data outside the EU or EEA, the transfer is based on an adequacy decision of the European Commission, in particular the EU-U.S. Data Privacy Framework, or on the European Commission’s standard contractual clauses.
9. Assistance
Taking into account the nature of the processing, the processor helps the controller with appropriate measures to respond to requests from data subjects (Chapter III GDPR), and with security, breach notification, data protection impact assessments and prior consultation (Art. 32 to 36 GDPR). Requests from data subjects that reach the processor are forwarded to the controller without delay.
10. Personal data breaches
The processor notifies the controller without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting the controller’s data, with the information the controller needs to meet its own obligations.
11. Deletion at the end
When the contract ends, the processor deletes the controller’s data it holds, unless the law requires it to keep them. Data on the controller’s servers stays where it is: it is in the controller’s own cloud account. Before the account is deleted, the controller can download what it needs; its servers and backups remain available to it.
12. Information and audits
The processor gives the controller all information needed to show compliance with Art. 28 GDPR and allows audits, including inspections, by the controller or an auditor it appoints. Audits are announced at least 30 days in advance, take place during normal business hours, must not disclose other customers’ data or security details, and are at the controller’s cost unless they reveal a material breach.
13. Term and precedence
This agreement runs as long as the customer’s contract. If it conflicts with the terms of service on data protection, this agreement takes precedence. Liability follows Art. 82 GDPR and the liability rules of the terms.
Annex: technical and organisational measures
- Encryption: TLS for all connections; access tokens, SSH keys, passwords, environment variables and certificates are additionally encrypted with AES-256-GCM before storage; API tokens are stored only as hashes.
- Access control: account sign-in with optional two-factor authentication; roles within workspaces; row-level security in the database so each account only reaches its own records; typed confirmation for destructive actions.
- Server access: SSH with a dedicated key per account and pinned host keys, so connections fail if a server’s identity changes; secrets are not passed on command lines.
- Separation: customer data is separated by account in the database and in storage paths.
- Traceability: an activity log records actions with the person or agent who took them.
- Minimisation: visitor logs are evaluated live and not stored; backups and migrations run directly between the controller’s own servers and storage.
- Availability: managed database with regular backups; the controller’s sites keep running if Nuvlo is unavailable.
- Limiting abuse: rate limits on sign-in and other sensitive endpoints.