Data Processing Addendum

The customer processor terms that apply where Kupe Cloud processes data on your behalf.

Kupe Cloud Data Processing Addendum

Version: v1.0.0 Last updated: April 20, 2026

1. Parties

This Data Processing Addendum (“DPA”) forms part of the agreement between:

  • Core Solutions LTD, a company registered in England and Wales (company number 11659922, VAT number 310885805), with registered office at 3rd Floor 86-90 Paul Street, London, United Kingdom, EC2A 4NE (“Kupe Cloud”, “Processor”, “we”, “us”, and “our”); and
  • the customer entity that purchases or uses Kupe Cloud services under the applicable Terms of Service, order form, or other services agreement (“Customer” or “Controller”).

This DPA applies where Kupe Cloud processes Customer Personal Data on behalf of Customer in connection with the Kupe Cloud services.

In this DPA, “Customer Personal Data” means personal data that Kupe Cloud processes on behalf of Customer in the course of providing the services, where Customer determines the purposes and means of the processing. Terms such as “personal data”, “processing”, “controller”, “processor”, “data subject”, and “personal data breach” have the meanings given to them in the UK General Data Protection Regulation and the Data Protection Act 2018.

2. Order of Precedence

This DPA supplements the Kupe Cloud Terms of Service and any applicable order form or services agreement.

If there is a conflict between this DPA and the Terms of Service in relation to the processing of Customer Personal Data, this DPA will govern to the extent of that conflict.

3. Roles

The parties acknowledge that:

  • Customer is the controller of Customer Personal Data; and
  • Core Solutions LTD is the processor of Customer Personal Data.

If Kupe Cloud processes personal data for its own business purposes, such as account administration, billing, support, security monitoring, fraud prevention, or website analytics, Core Solutions LTD acts as a controller for that processing and this DPA does not apply to that controller activity.

4. Subject Matter and Duration

The subject matter of the processing is the provision of the Kupe Cloud managed Kubernetes platform and related support, administration, identity, monitoring, and billing-connected service operations.

The duration of the processing is the period during which Kupe Cloud provides the services to Customer and any limited post-termination period required to complete deletion, return, legal retention, or orderly service closure obligations.

5. Nature and Purpose of the Processing

Kupe Cloud processes Customer Personal Data only as necessary to:

  • provision and operate Customer tenants and related platform services;
  • manage tenant membership and access control;
  • authenticate users and support account recovery;
  • transmit service notifications, invitations, and operational emails;
  • support monitoring, troubleshooting, reliability, and security;
  • maintain service-related audit and operational records; and
  • follow Customer’s documented instructions consistent with the services.

6. Types of Personal Data and Categories of Data Subjects

The categories of data subjects may include:

  • Customer administrators;
  • Customer employees, contractors, and authorised users;
  • users invited into a Customer tenant; and
  • other individuals whose personal data Customer chooses to process through the services.

The types of personal data may include:

  • names;
  • email addresses;
  • usernames;
  • role and membership data;
  • tenant and account identifiers;
  • authentication and identity metadata;
  • service usage, operational, and audit data;
  • support and communication content; and
  • other personal data submitted by or on behalf of Customer through the services.

7. Customer Instructions

Kupe Cloud will process Customer Personal Data only on Customer’s documented instructions, unless required to do otherwise by applicable law.

The agreement between the parties, Customer’s configuration and use of the services, and Customer’s written support or administrative requests together constitute Customer’s documented instructions for the purposes of this DPA.

If Kupe Cloud believes an instruction infringes applicable data protection law, we will inform Customer unless prohibited by law from doing so.

8. Confidentiality

Kupe Cloud will ensure that personnel authorised to process Customer Personal Data are bound by confidentiality obligations or are under an appropriate statutory duty of confidentiality.

9. Security

Taking into account the state of the art, the costs of implementation, the nature, scope, context, and purposes of processing, and the risk to individuals, Kupe Cloud will implement appropriate technical and organisational measures designed to protect Customer Personal Data.

These measures include, as appropriate to the service:

  • access controls and role-based access restrictions;
  • encryption in transit (TLS) and encryption at rest as described in Annex B;
  • authentication and identity management controls;
  • service logging and security monitoring;
  • measures to detect and reduce abuse or unauthorised access;
  • backup and recovery controls for platform-managed systems where applicable; and
  • processes for incident response and remediation.

Customer acknowledges that no security measure is infallible and that security obligations are assessed against a reasonableness standard under applicable law.

10. Subprocessors

Customer gives general authorisation for Kupe Cloud to use subprocessors in connection with the services.

Kupe Cloud will:

  • maintain a current subprocessor list at /subprocessors and make it available on request;
  • impose data protection obligations on each subprocessor that are no less protective than the obligations in this DPA, as applicable to the nature of the services provided by that subprocessor; and
  • remain responsible to Customer for the performance of its subprocessors’ data protection obligations to the extent required by applicable law.

Kupe Cloud will give Customer at least 30 days’ prior notice of any new or replacement subprocessor that will process Customer Personal Data. Notice will be given by updating the subprocessor list at /subprocessors and, where Customer has subscribed to subprocessor updates, by email.

Customer may object on reasonable data protection grounds within the notice period. The parties will work in good faith to resolve the objection. If the parties cannot resolve the objection, Customer may, as Customer’s sole and exclusive remedy, terminate the affected services on written notice without further liability beyond accrued fees.

In urgent cases where a shorter notice period is necessary to maintain the security, integrity, or continuity of the services (for example, replacing a subprocessor that has suffered a security incident or service failure), Kupe Cloud may engage a replacement subprocessor on shorter notice and will inform Customer as soon as reasonably practicable.

11. International Transfers

Kupe Cloud may process Customer Personal Data outside the UK where necessary to provide the services.

Where a restricted transfer takes place, Kupe Cloud will ensure that an appropriate transfer mechanism is in place, such as an adequacy decision, the UK International Data Transfer Agreement, the UK Addendum to the EU standard contractual clauses, or another lawful safeguard.

12. Assistance to Customer

Taking into account the nature of the processing and the information available to Kupe Cloud, we will provide reasonable assistance to Customer to enable Customer to comply with its obligations relating to:

  • data subject rights requests;
  • security of processing;
  • personal data breach notifications;
  • data protection impact assessments; and
  • prior consultation with supervisory authorities where required.

13. Personal Data Breaches

If Kupe Cloud becomes aware of a personal data breach affecting Customer Personal Data, we will notify Customer without undue delay. Where reasonably practicable, we will provide initial notice within 72 hours of becoming aware of the breach. The notification will include the information reasonably available to us at the time, and we will provide further information as it becomes available, so Customer can meet its own breach-related obligations under applicable data protection law.

14. Audits and Information

Kupe Cloud will make available to Customer information reasonably necessary to demonstrate compliance with this DPA.

Where Customer reasonably believes that information made available is insufficient, Customer may request an audit or inspection no more than once in any 12-month period, subject to:

  • reasonable prior notice;
  • appropriate confidentiality obligations;
  • reasonable scope and timing restrictions to protect other customers and service security; and
  • reimbursement of Kupe Cloud’s reasonable costs where the audit is not required by law or regulator instruction.

Kupe Cloud may satisfy audit obligations through current third-party certifications, audit reports, security summaries, or comparable materials where appropriate.

15. Deletion or Return

On termination or expiry of the services, Kupe Cloud will, at Customer’s choice and unless applicable law requires retention, within 30 days of termination either:

  • delete Customer Personal Data; or
  • return Customer Personal Data and then delete remaining copies.

Customer acknowledges that certain data may remain in backups, logs, or statutory records for a limited period where retention is required for security, legal, accounting, or compliance purposes, after which it will be deleted in accordance with Kupe Cloud’s retention practices.

16. Liability

Liability under this DPA is subject to the liability limitations and exclusions set out in the applicable Terms of Service or other governing agreement, except to the extent such limitations are not permitted by applicable law.

17. Annex A: Details of Processing

Subject matter: Managed Kubernetes platform and related account, tenant, identity, support, and operational processing.

Duration: For the term of the services plus limited post-termination retention or deletion periods.

Purpose: Service delivery, tenant provisioning, user access management, support, security, monitoring, auditability, and related operational functions.

Categories of data subjects: Customer administrators, Customer users, invited users, and any individuals whose personal data Customer submits through the services.

Types of personal data: Names, email addresses, usernames, access roles, tenant membership, authentication metadata, operational records, support content, and other personal data submitted by Customer.

18. Annex B: Security Measures Summary

Kupe Cloud’s current security measures include:

  • role-based logical access controls;
  • managed identity and authentication controls;
  • encryption in transit (TLS) for service traffic;
  • encryption at rest, including:
    • persistent volumes provisioned through the underlying cloud provider, where the provider applies infrastructure-level encryption at rest to the storage layer;
    • Kubernetes Secrets encrypted at rest in etcd using AES-CBC, with per-cluster encryption keys managed through Kupe Cloud’s secrets management system; and
    • off-site cluster backups stored on object storage that applies at-rest encryption at the storage layer;
  • system and application logging;
  • service monitoring and incident response processes;
  • abuse-prevention controls such as rate limiting and access restrictions; and
  • provider and infrastructure controls appropriate to the hosted service environment.

19. Annex C: Subprocessors

The current list of Kupe Cloud subprocessors is available at /subprocessors and may also be provided on request.