Data Processing Agreement (DPA) - Knowledgebase

======================================================================
DATA PROCESSING AGREEMENT (DPA)
======================================================================

This Data Processing Agreement ("DPA") sets out the terms on which
42U Networks L.L.C. processes personal data on behalf of its customers.
It is written to meet Article 28 of the EU General Data Protection
Regulation (GDPR), the UK GDPR, and the processor and service provider
requirements of applicable US state privacy laws.

This DPA is incorporated by reference into our Terms of Service and is
in effect at all times. It applies automatically, from the moment you
begin using our services, to every customer who stores, transmits, or
processes personal data on our infrastructure. No signature is needed
for it to bind us, but we will provide a countersigned copy on request.
See Section 19 ("How to execute this DPA").

DATA IMPORTER:
42U Networks L.L.C.
1 WTC, Suite 8500
New York, NY 10007
United States

IN EFFECT:
Immediately and continuously.
Last updated: October 30, 2026.

QUESTIONS, AUDIT REQUESTS, AND SIGNED COPIES:
Open a ticket from the client area, or contact our support team.

----------------------------------------------------------------------
TABLE OF CONTENTS
----------------------------------------------------------------------
1. Parties and definitions
2. How this DPA fits with our other terms
3. Roles of the parties
4. Scope of the processing
5. Our obligations as processor
6. Your obligations as controller
7. Confidentiality and government access
8. Security of processing
9. Sub-processors
10. International data transfers
11. Assistance with data subject requests
12. Personal data breaches
13. Impact assessments and prior consultation
14. Retention, return and deletion
15. Audit rights
16. Liability and indemnity
17. US state privacy laws
18. Term, changes and governing law
19. How to execute this DPA
- Annex I - Details of processing
- Annex II - Technical and organizational measures
- Annex III - Authorized sub-processors
- Annex IV - Transfer mechanism details

----------------------------------------------------------------------
1. PARTIES AND DEFINITIONS
----------------------------------------------------------------------

This DPA is between:
- The Processor: 42U Networks L.L.C., of 1 WTC, Suite 8500, New York,
NY 10007, United States ("42U Networks", "we", "us").
- The Controller: the person or entity named on the 42U Networks billing
account under which the services are purchased ("Customer", "you"). Your
registered account details identify you for the purposes of this DPA.

Where you are acting as a processor for your own clients, references to
you as "controller" should be read as "processor", and we act as your
sub-processor (see Section 3.4).

"Personal data", "processing", "controller", "processor", "sub-processor",
"data subject", "supervisory authority", and "personal data breach" have
the meanings given in the GDPR.

"Data Protection Laws" means all privacy and data protection laws applicable
to the processing under this DPA, including the EU GDPR, the UK GDPR, the UK
Data Protection Act 2018, the Swiss Federal Act on Data Protection, and
applicable US federal and state privacy statutes.

"Customer Data" means any data you or your users store on, transmit
through, or process using our services.

"Services" means the 42U Networks products on your account, including
virtual private servers, dedicated servers, colocation, web hosting, game
hosting, IP transit, and related technical support.

----------------------------------------------------------------------
2. HOW THIS DPA FITS WITH OUR OTHER TERMS
----------------------------------------------------------------------

This DPA forms part of your agreement with us. Where terms conflict, the
order of precedence is:
1. The Standard Contractual Clauses or the UK Addendum, where applicable
(Section 10);
2. This DPA;
3. Any signed order form or master services agreement between us;
4. Our Terms of Service and Privacy Policy.

Nothing here reduces the commitments in our Privacy Policy about the personal
data we hold on you as our direct customer.

----------------------------------------------------------------------
3. ROLES OF THE PARTIES
----------------------------------------------------------------------

Our role depends on the data, not on the product name:

3.1 ACCOUNT DATA - WE ARE THE CONTROLLER:
The information you give us to open and run an account (name, business name,
billing address, contact details, payment identifiers, support tickets,
authentication, and access logs) is processed by us as a controller for
billing, fraud prevention, support, and legal compliance. That processing
is governed by our Privacy Policy rather than this DPA. Specifically:
- We do not sell personal data. We do not sell, rent, share for cross-context
behavioral advertising, or otherwise monetize any personal data, in any
role, under any product.
- We do not disclose account data to third parties beyond the sub-processors
listed in Annex III, except where compelled by law under Section 7 or as
expressly permitted under Section 9.3. Payment data is handled by our
PCI-compliant payment processors.
- Identity and eligibility verification records (KYC) are collected only
where necessary to confirm identity and account security via our identity
verification partner, Didit Identity, Inc. Review is restricted to LLC
members/compliance officers, and records are redacted/purged post-validation.

3.2 CUSTOMER DATA - WE ARE THE PROCESSOR:
Any personal data inside your servers, containers, hosting accounts, databases,
or backups is processed by us as a processor, strictly on your instructions.
We do not decide why or how that data is processed, we do not use it for our
own purposes, and we do not index, mine, profile, or analyze its contents.

3.3 UNMANAGED SERVICES - PROCESSING WITHOUT ROUTINE ACCESS:
For unmanaged VPS, dedicated servers, and colocation, you hold root or
physical administrative control, and we do not routinely access the guest
operating system or its contents. Our processing is limited to hosting, powering,
storing, and transmitting the data, plus any access you specifically request
support to perform. You remain responsible for the configuration, patching,
and security of everything above the hypervisor or rack rail. This DPA still
applies to that processing.

3.4 WHERE YOU ARE A PROCESSOR:
If you host data for your own clients, you are a processor and we are your
sub-processor. You confirm that you are authorized to appoint us, that your
agreement with your controller permits it, and that your instructions to us
reflect that controller's instructions. Module Three of the Standard Contractual
Clauses applies to any restricted transfer.

----------------------------------------------------------------------
4. SCOPE OF THE PROCESSING
----------------------------------------------------------------------

The subject matter, duration, nature and purpose of the processing, types
of personal data, and categories of data subjects are set out in Annex I.

Because you control what you upload, we do not monitor the specific
categories of personal data in your environment. Annex I describes the outer
boundary of what our services are capable of processing. If your use case
involves special category data (health, biometric, racial or ethnic origin,
political opinions, religious beliefs, trade union membership, sex life, or
sexual orientation) or genetic data, open a ticket before uploading so we
can confirm whether the service is suitable and if additional terms are
required.

DATA WE DO NOT ACCEPT:
Accounts are limited to individuals aged eighteen (18) or over, and the
services are not intended for personal data regarding children. Storing or
processing Protected Health Information (PHI) under HIPAA without a specific
executed agreement is expressly prohibited.

----------------------------------------------------------------------
5. OUR OBLIGATIONS AS PROCESSOR
----------------------------------------------------------------------

42U Networks will:
1. Process only on your instructions: Process Customer Data only on your
documented instructions, including for international transfers, unless
required otherwise by law. Your instructions comprise: this DPA, our Terms
of Service, the configuration choices you make in our control panels, and
support requests submitted by an authorized account contact. If legally
required to process beyond your instructions, we will inform you first
unless prohibited by law.
2. Inform of unlawful instructions: Promptly inform you if we believe an
instruction infringes Data Protection Laws, and suspend execution of that
instruction until resolved.
3. Confidentiality: Keep data confidential and bind everyone authorized to
access it to strict confidentiality (Section 7).
4. Security: Secure data in line with Article 32 GDPR and the measures in
Annex II.
5. Sub-processors: Control sub-processors as described in Section 9.
6. Data subject requests: Help you respond to data subjects as described in
Section 11.
7. Compliance assistance: Assist you with security, breach notification,
impact assessments, and prior consultation under Articles 32 to 36 GDPR,
taking into account the nature of processing and information available.
8. Deletion or return: Delete or return data at the end of the services
(Section 14).
9. Demonstrate compliance: Make available information needed to demonstrate
compliance with Article 28 GDPR and allow for audits (Section 15).
10. Records of processing: Maintain records of processing categories carried
out on your behalf as required by Article 30(2) GDPR.

----------------------------------------------------------------------
6. YOUR OBLIGATIONS AS CONTROLLER
----------------------------------------------------------------------

You are responsible for:
1. Having a valid lawful basis for processing, and providing all required
notices or obtaining consents required under Data Protection Laws.
2. The accuracy, quality, integrity, and legality of Customer Data and your
instructions to us.
3. Configuring and securing everything under your direct control: guest
operating systems, software applications, databases, encryption keys, user
credentials, access rights, network firewalls, and independent backups.
4. Keeping technical and administrative contact information updated in the
client area so security notices reach the proper personnel promptly.
5. Not uploading personal data the service is not designed or authorized to
hold without prior written agreement under Section 4.
6. Directly responding to your own data subjects, controllers, and regulators.
We assist you; we do not replace your regulatory obligations.

----------------------------------------------------------------------
7. CONFIDENTIALITY AND GOVERNMENT ACCESS
----------------------------------------------------------------------

Access to Customer Data is strictly limited to personnel who require it to
deliver or support the services. All personnel with access are bound by
written confidentiality obligations that survive termination of their
engagement and receive training on their obligations under this DPA. We do not
disclose Customer Data to third parties except to the sub-processors in
Annex III, or where compelled by law.

If we receive a subpoena, court order, search warrant, or other binding legal
demand for Customer Data, then unless legally prohibited we will:
- Promptly notify you so you may seek protective relief;
- Disclose only the specific data strictly required by the demand; and
- Lawfully challenge demands that appear overbroad, improper, or invalid.

We do not provide any government body with direct, unmonitored, or bulk
access to Customer Data, nor do we construct or maintain backdoors.

----------------------------------------------------------------------
8. SECURITY OF PROCESSING
----------------------------------------------------------------------

42U Networks implements and maintains appropriate technical and organizational
measures to protect Customer Data against accidental or unlawful destruction,
loss, alteration, unauthorized disclosure, or access. Those measures are
detailed in Annex II and take account of the state of the art, implementation
costs, and the nature, scope, context, and risks of processing.

We may update the measures in Annex II as technologies and threat landscapes
evolve, provided the overall level of security is not diminished. Material
changes will be announced pursuant to Section 18.

Security operates under a shared responsibility model: Annex II covers physical
facilities, underlying network fabric, hypervisors, and company-operated
platforms. Guest operating systems, application code, in-app encryption,
credential hygiene, and user permissions remain your sole responsibility.

----------------------------------------------------------------------
9. SUB-PROCESSORS & REGULATORY REGISTRY DISCLOSURES
----------------------------------------------------------------------

9.1 GENERAL AUTHORIZATION:
You grant us general written authorization to appoint sub-processors. The
complete current list is maintained in Annex III. We own and operate our
hardware, network infrastructure, and cloud environments, keeping third-party
sub-processors to a strict minimum.

9.2 ADVANCE NOTICE AND OBJECTION PROCEDURE:
Before adding or replacing a sub-processor that processes Customer Data, we
will update Annex III and notify account contacts at least thirty (30) days
in advance. If you have a reasonable, documented data protection objection,
submit it via ticket within those 30 days. We will work with you in good
faith to identify an alternative setup or workaround. If no mutually acceptable
resolution can be reached, you may terminate the affected service without
penalty and receive a pro-rata refund of prepaid fees for the unused service
term. This constitutes your exclusive remedy.

All sub-processors are bound by written agreements imposing data protection
obligations no less protective than those set forth in this DPA. We remain
liable to you for each sub-processor's performance of its data protection
duties.

9.3 MANDATORY NOTIFICATION FOR UNLISTED RECIPIENTS & RIRs (EU/UK USERS):
In accordance with EU GDPR (Articles 13, 14, and 28), UK GDPR, and international
data protection standards, EU and UK based customers will be explicitly
notified in advance whenever any personal data or related account records must
be disclosed or transmitted to an unlisted third party, external organization,
or Regional Internet Registry ("RIR")—including but not limited to the American
Registry for Internet Numbers (ARIN) or RIPE Network Coordination Centre (RIPE
NCC)—for the purpose of IP address justification, routing registration, abuse
contact publication (WHOIS/RDAP), or upstream carrier transit provisioning.

Where such disclosure is required to fulfill a regulatory mandate, internet
governance standard, or network assignment requirement:
(a) 42U Networks will provide prior notification to the Customer via the
client dashboard, registered billing email, or trouble ticket system,
specifying the recipient entity, the exact categories of data to be
submitted, and the legal or regulatory basis for the disclosure;
(b) 42U Networks will limit any transmission strictly to the minimum data
necessary (data minimization) to satisfy the operational or registry
requirement; and
(c) If the transfer involves a transfer of personal data outside the UK or
EEA to an unlisted third party, 42U Networks will ensure an appropriate
transfer mechanism (such as standard contractual clauses or statutory
exceptions under Article 49 GDPR for the performance of a contract)
is properly applied.

----------------------------------------------------------------------
10. INTERNATIONAL DATA TRANSFERS
----------------------------------------------------------------------

Core hosting, platform infrastructure, and account processing environments
are located within Microsoft Azure Indonesia Central (Zone 1) in Jakarta,
Indonesia, as well as designated facility partner locations. Limited
administrative access may be performed by authorized personnel located in the
United States and the United Kingdom via authenticated, logged interfaces.
The United Kingdom benefits from an official European Commission adequacy finding.

10.1 TRANSFERS FROM THE EEA:
Where personal data subject to the EU GDPR is transferred to us, the Standard
Contractual Clauses (SCCs) approved by the European Commission under Implementing
Decision (EU) 2021/914 are incorporated herein by reference and completed as
set forth in Annex IV:
- Module Two applies where you act as a controller.
- Module Three applies where you act as a processor for another controller.
Annexes I, II, and III of this DPA serve as Annexes I, II, and III to the SCCs.

10.2 TRANSFERS FROM THE UNITED KINGDOM:
Transfers subject to the UK GDPR are governed by the SCCs as amended by the
UK Information Commissioner's International Data Transfer Addendum, completed
in Annex IV.

10.3 TRANSFERS FROM SWITZERLAND:
Transfers subject to the Swiss FADP are governed by the SCCs with the adaptations
stipulated by the Swiss Federal Data Protection and Information Commissioner
(FDPIC).

10.4 TRANSFER IMPACT ASSESSMENT:
We have evaluated the legal frameworks applicable to our cloud regions and
service delivery models and maintain that we can fulfill our obligations under
the SCCs. We will assist you in completing transfer impact assessments (TIAs)
upon request.

----------------------------------------------------------------------
11. ASSISTANCE WITH DATA SUBJECT REQUESTS
----------------------------------------------------------------------

Because you maintain administrative control over your hosted environment,
you are best positioned to directly manage data subject requests using your
system access.

If a data subject contacts 42U Networks directly regarding data we process on
your behalf, we will not respond substantively. We will direct them to you
and forward their inquiry to your account contacts without undue delay.

If you require assistance that only 42U Networks can provide to respond to a
verified request for access, rectification, erasure, portability, or restriction,
open a support ticket. We will provide commercially reasonable assistance. Work
requiring extensive engineering support beyond standard administrative tools
may be billed at standard professional rates upon prior quote and authorization.

----------------------------------------------------------------------
12. PERSONAL DATA BREACHES
----------------------------------------------------------------------

If 42U Networks confirms a personal data breach affecting Customer Data on
systems under our control, we will notify you without undue delay and in any
event within seventy-two (72) hours of confirmation. Notification will be
sent to your registered account contacts.

Our breach notification will include, to the extent known:
- A description of the incident, including categories and estimated volume
of records/subjects;
- Likely consequences and potential risks;
- Mitigation steps taken, underway, or proposed;
- Designated contact point for ongoing coordination.

Information may be provided in phased intervals as forensic investigations
proceed. We will preserve relevant audit logs and cooperate reasonably with
your investigation. Notification by 42U Networks does not constitute an
admission of fault or liability.

Notifying regulatory bodies and impacted data subjects remains your
responsibility as controller.

----------------------------------------------------------------------
13. IMPACT ASSESSMENTS AND PRIOR CONSULTATION
----------------------------------------------------------------------

Upon written request, 42U Networks will provide reasonable assistance with
Data Protection Impact Assessments (DPIAs) and prior consultations with
supervisory authorities under Articles 35 and 36 GDPR, limited to the specific
processing performed by us and the direct information in our possession.
Standard security documentation and questionnaires are made available once
annually at no charge.

----------------------------------------------------------------------
14. RETENTION, RETURN AND DELETION
----------------------------------------------------------------------

42U Networks retains Customer Data only as long as necessary to provide the
Services.

14.1 DURING THE SERVICE TERM:
You control data retention inside your environment and may modify, download,
or delete data at any time using your management tools. If you require manual
purging of an entire environment upon written ticket, we will execute it
within 5 business days and provide written confirmation.

14.2 ON TERMINATION OR CANCELLATION:
EXPORT YOUR DATA PRIOR TO SERVICE TERMINATION. Upon termination or service
cancellation, associated Customer Data is permanently and irretrievably deleted
in accordance with our automated deprovisioning routines:
- Virtual disks and local block storage are decommissioned and reclaimed;
- Shared hosting directories, mailboxes, and database instances are purged;
- Server backups and snapshots tied to the terminated slot are destroyed;
- Physical media decommissioned from service is sanitized or physically
destroyed following NIST SP 800-88 guidelines prior to disposal;
- Colocation customers retain and retrieve their own hardware; we do not
image, hold, or access colocated media unless expressly instructed in writing.

Reclaimed storage blocks remain unallocated until overwritten by normal storage
pool writes and cannot be accessed via customer-facing or administrative
interfaces once deprovisioned. Deletion confirmation will be furnished upon
request.

14.3 ACCOUNT BILLING DATA:
Account data (Section 3.1) collected in our role as controller is retained
during account activity and for thirty-six (36) months following the date of
last account activity (login, active invoice, or ticket). Statutory accounting,
tax, and fraud investigation records are preserved for longer statutory periods
as required by law. Identity verification records submitted via Didit Identity,
Inc. are deleted immediately post-verification.

----------------------------------------------------------------------
15. AUDIT RIGHTS
----------------------------------------------------------------------

We make available all documentation reasonably necessary to demonstrate
compliance with Article 28 GDPR:
1. Documentation First: Compliance reviews are conducted primarily through
this DPA, our technical security documentation, independent audit reports,
and our annual security questionnaire responses.
2. Formal Audits: Where documentation does not resolve a reasonable compliance
question, you may conduct an audit once per twelve (12) month period upon
at least thirty (30) days advance written notice, during normal business
hours, under a mutually agreed written scope, and without disrupting normal
datacenter operations.
3. Special Circumstances: Additional audits are permitted if mandated by a
competent regulatory authority or immediately following a confirmed data
breach impacting your specific Customer Data.
4. Audit Boundaries: Audits may not access any other customer's environment,
shared facilities where isolation cannot be preserved, or our proprietary
trade secrets. Independent auditors must execute non-disclosure agreements,
cannot be commercial competitors of 42U Networks, and must be escorted in
facility spaces at all times.
5. Facilities: Datacenter facility access is governed by the access policies
of the underlying cloud and datacenter infrastructure operators.
6. Costs: Each party bears its own costs for the initial scheduled audit in a
given 12-month period. Unreasonable or expedited audit requests may be
subject to reimbursement for staff time at standard technical rates.

----------------------------------------------------------------------
16. LIABILITY AND INDEMNITY
----------------------------------------------------------------------

Each party's aggregate liability under or relating to this DPA (whether in
contract, tort, negligence, or other legal theory) shall be subject to the
limitation of liability and aggregate cap provisions set forth in the 42U
Networks Terms of Service. Claims brought under this DPA and the Terms of
Service count collectively toward that single liability limit.

Neither party shall be liable for indirect, incidental, punitive, special,
or consequential damages, or loss of profits, revenue, or business data.

You agree to defend and indemnify 42U Networks against regulatory fines,
claims, damages, and legal costs arising from:
- Customer Data uploaded without lawful processing basis or valid consent;
- Customer instructions that violate Data Protection Laws;
- Unlawful, unauthorized, or HIPAA/special category data uploaded in
violation of Section 4;
- Customer failure to maintain security across self-managed operating systems,
applications, and credentials.

42U Networks agrees to indemnify you against third-party claims, regulatory
fines, and reasonable legal costs resulting directly from our intentional breach
of our processor obligations under this DPA, subject to the liability caps
referenced above.

Nothing herein diminishes either party's statutory liability to individual
data subjects pursuant to Article 82 GDPR where applicable.

----------------------------------------------------------------------
17. US STATE PRIVACY LAWS
----------------------------------------------------------------------

This Section applies where your data is subject to the California Consumer
Privacy Act as amended (CCPA/CPRA), or comparable comprehensive privacy laws
in Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other
applicable US states.

You disclose personal information to 42U Networks solely for the delimited
business purpose of performing hosting and infrastructure services. 42U
Networks acts strictly as a "Service Provider" or "Processor", and certifies
that it:
- Does not "sell" or "share" personal information, and accepts no monetary or
valuable consideration for customer personal information;
- Does not retain, use, or disclose personal information for any purpose
other than performing the specific services identified in the Agreement;
- Does not retain, use, or disclose personal information outside the direct
business relationship between the parties;
- Does not cross-combine personal information received with data received
from separate entities, except as permitted by statute;
- Complies with all applicable statutory service provider obligations and
maintains equivalent privacy protections;
- Will notify you if it determines it cannot meet statutory obligations;
- Permits reasonable verification and audit pursuant to Section 15;
- Binds subcontractors to written terms enforcing identical restrictions.

----------------------------------------------------------------------
18. TERM, CHANGES, AND GOVERNING LAW
----------------------------------------------------------------------

This DPA takes effect upon your initial use of the Services and remains in
effect until all services are deprovisioned and all Customer Data is destroyed
or returned. Sections 7, 12, 14, 15, and 16 survive contract termination.

We may update this DPA to reflect operational, infrastructural, or regulatory
developments. For material changes that diminish your contractual privacy
rights, we will provide at least thirty (30) days advance notice via email or
portal announcement. If you object to the modification, you may cancel the
affected service prior to the effective date without early cancellation fees.

GOVERNING LAW AND JURISDICTION:
This DPA and any non-contractual disputes arising from it shall be governed
by and construed under the laws of the State of New York, without regard to
conflict of law rules. The parties submit to the dispute resolution procedures
and binding arbitration terms specified in the 42U Networks Terms of Service.
This choice of law does not impair the mandatory application of the Standard
Contractual Clauses in Annex IV, nor does it deprive data subjects of
mandatory rights under their local consumer and privacy jurisdictions.

----------------------------------------------------------------------
19. HOW TO EXECUTE THIS DPA
----------------------------------------------------------------------

This DPA applies automatically to your service relationship with 42U Networks
without requiring physical execution.

If your regulatory, legal, or compliance team requires a formal countersigned
copy, open a support ticket from your client billing account providing:
- Account ID / Client Number;
- Registered legal entity name and corporate address;
- Name, corporate title, and email address of authorized signatory;
- Contact information for your Data Protection Officer (DPO) or privacy lead;
- Applicable EU/UK Article 27 representative details (if applicable);
- Specification of whether you are acting as Controller or Processor.

We will provide a countersigned PDF via electronic signature, typically
within five (5) business days.

======================================================================
ANNEX I - DETAILS OF PROCESSING
======================================================================
(This Annex also serves as Annex I to the Standard Contractual Clauses)

A. LIST OF PARTIES:

DATA EXPORTER:
- Name: The Customer identified on the 42U Networks billing account.
- Role: Controller (or Processor under Section 3.4).
- Contact: Account and technical contacts designated in the customer portal.
- Activities: Utilization of hosting, VPS, dedicated server, storage,
colocation, and network transit services.

DATA IMPORTER:
- Name: 42U Networks L.L.C.
- Address: 1 WTC, Suite 8500, New York, NY 10007, United States.
- Role: Processor (or Sub-processor under Section 3.4).
- Contact: 42U Networks Privacy and Compliance Department via support portal.
- Activities: Provision of hosting, virtualization, dedicated compute,
cloud infrastructure, bandwidth, and related infrastructure support.

B. DESCRIPTION OF TRANSFER:

- Categories of Data Subjects:
Determined solely by Customer. Typically includes Customer's end-users,
website visitors, employees, contractors, service clients, and game players.

- Categories of Personal Data:
Determined solely by Customer. Infrastructure can accommodate any lawful data
uploaded by Customer, such as names, contact details, user credentials,
network identifiers, IP logs, files, application databases, and transaction
records. 42U Networks does not mandate specific data types.

- Special Category Data:
Strictly prohibited without prior written agreement under Section 4.

- Frequency and Duration of Transfer:
Continuous throughout the duration of active service provision.

- Nature and Purpose of Processing:
Hosting, storage, transmission, server maintenance, network routing, and
incident resolution to maintain compute and network availability.

- Processing Locations:
Microsoft Azure Indonesia Central (Zone 1) in Jakarta, Indonesia, as well
as authorized regional partner datacenter facilities. Storage is maintained
in Jakarta, Indonesia and provisioned regions. Administrative and support
operations take place in the United States, with select authenticated
administrative access conducted from the United Kingdom.

C. COMPETENT SUPERVISORY AUTHORITY:
The supervisory authority of the EEA Member State where the exporter is
established or has appointed an Article 27 representative. For UK transfers,
the Information Commissioner's Office (ICO). For Swiss transfers, the Federal
Data Protection and Information Commissioner (FDPIC).

======================================================================
ANNEX II - TECHNICAL AND ORGANIZATIONAL MEASURES
======================================================================
(Applies to 42U Networks infrastructure; customer guest systems remain the
responsibility of the Customer)

1. PHYSICAL SECURITY:
Equipment and cloud regions are hosted in tier-rated, ISO/IEC 27001 and
SOC 2 certified facilities in Microsoft Azure Indonesia Central (Zone 1)
and authorized partner centers. Perimeter security, biometric/badge access
checkpoints, 24/7/365 monitored CCTV surveillance, visitor logging,
redundant utility power grids, UPS banks, diesel backup generation, and
automated fire suppression systems protect physical assets.

2. ACCESS CONTROL:
Administrative credentials are individually assigned and audited; shared
administrative accounts are prohibited. SSH key authentication is enforced
on production hosts and password access is disabled. Multi-Factor
Authentication (MFA) is strictly enforced on billing, control panel, and
infrastructure endpoints. Application panel access is restricted to staff,
while host and operating system level access is strictly restricted to
LLC owners. Management interfaces are isolated from public networks.

3. NETWORK SECURITY:
42U Networks operates a redundant, multi-homed carrier network architecture
with diverse Tier-1 upstream transit connections and internet exchange points.
RPKI route validation and IRR prefix filtering safeguard BGP routing.
Logical customer segregation is maintained via hardware virtualization,
container boundaries, and isolated customer virtual networks/VLANs. Edge
firewalls filter unauthorized traffic.

4. ENCRYPTION:
Management portals, client areas, and API endpoints enforce TLS with modern
ciphers and HSTS. Remote administration is conducted exclusively over SSH
or encrypted VPN tunnels. Customers maintain full capability to employ
full-disk, file-system, or application-level encryption inside their instances.

5. AVAILABILITY AND BUSINESS CONTINUITY:
Virtualization clusters feature node redundancy and failover paths for
supported tiers. Dual power feeds and diverse network entrances ensure high
availability. Platform disaster recovery mechanisms and encrypted backups
in Jakarta, Indonesia are maintained and validated.

6. LOGGING AND AUDIT TRAILS:
Centralized logging platforms record system events, access logs, and
administrative transactions. Real-time metric alerting notifies engineering
staff of unusual activity, resource anomalies, or service degradation.

7. VULNERABILITY MANAGEMENT:
Hypervisor platforms, underlying hosts, and management software receive
regular automated and manual security patches, with critical CVE patches
prioritized on an expedited timetable.

8. PERSONNEL CONTROLS:
Employees and contractors execute binding confidentiality agreements,
undergo security awareness training, and adhere to least-privilege access
policies. Access privileges are revoked immediately upon departure.

9. INCIDENT MANAGEMENT:
Established incident response plans detail containment, eradication, log
preservation, and escalation steps, ensuring timely notification pursuant
to Section 12.

10. DATA MINIMIZATION:
Customer environment data is never indexed, mined, profiled, or utilized
for machine learning training. Customer environments are accessed solely
upon explicit customer support authorization or documented security emergencies.

======================================================================
ANNEX III - AUTHORIZED SUB-PROCESSORS
======================================================================
(Last Updated: October 30, 2026)

Software licensed and deployed on 42U Networks-owned hardware or dedicated cloud
instances does not grant software vendors access to Customer Data and does not
qualify as sub-processing. Upstream bandwidth carriers operate strictly as
common-carrier transit conduits.

======================================================================
ANNEX IV - TRANSFER MECHANISM DETAILS
======================================================================

1. STANDARD CONTRACTUAL CLAUSES (EU SCCs):
- Implementing Decision: Commission Implementing Decision (EU) 2021/914
- Modules Selected:
* Module Two (Controller-to-Processor) where Customer is Controller.
* Module Three (Processor-to-Processor) where Customer is Processor.
- Clause 7 (Docking Clause): Included.
- Clause 9 (Sub-processors): Option 2 (General written authorization with
30-day notice).
- Clause 11 (Redress): Optional dispute resolution language is omitted.
- Clause 17 (Governing Law): Law of the EEA Member State where Exporter is
established; if outside the EEA, the laws of the Republic of Ireland.
- Clause 18 (Forum): Courts of the Member State designated in Clause 17.
- Annexes: Annexes I, II, and III of this DPA satisfy Annexes I, II, and III
of the SCCs.

2. UK INTERNATIONAL DATA TRANSFER ADDENDUM:
- Table 1 (Parties): Exporter: The Customer. Importer: 42U Networks L.L.C.,
1 WTC, Suite 8500, New York, NY 10007.
- Table 2 (Selected SCCs): EU SCCs as designated above.
- Table 3 (Appendix Information): Annexes I, II, and III of this DPA.
- Table 4 (Termination): Either party may end the Addendum in accordance with
Section 19 of the UK Addendum.

----------------------------------------------------------------------
For inquiries, ticket submission, or formal DPA execution, access your
42U Networks client dashboard or reach out via our contact channels.
======================================================================

Categories

Categories

Support

Data Processing Agreement (DPA) Print

Was this answer helpful?

Related Articles

Support

Categories

Categories

Support

Data Processing Agreement (DPA) Print

Was this answer helpful?

Related Articles

Support

Generate Password