Data Processing Agreement

1. Parties

This Data Processing Agreement (“DPA”) is entered into between:

2. Subject Matter and Duration

This DPA governs the processing of personal data by GhostNexus on behalf of the Controller in connection with the provision of GPU compute services (“Service”). The DPA enters into force on the date of account creation and remains in effect until termination of the Service agreement, extended by any statutory retention obligations.

3. Nature, Purpose, and Scope of Processing

GhostNexus processes personal data solely to provide the private GPU execution service, including workload validation and execution, billing, authentication, and communication. Processing is limited to the following operations:

• Storing account registration data (email address, hashed credentials)
• Logging job execution metadata (job ID, GPU type, duration, cost, status)
• Automatically validating, dispatching, and executing Client-submitted workloads
• Processing billing information via Stripe (customer and transaction identifiers)
• Sending transactional and lifecycle emails via Resend
• Maintaining security logs for fraud prevention and incident response

4. Categories of Personal Data and Data Subjects

4.1 Data categories processed

• Identification data: account email address
• Authentication credentials: bcrypt-hashed passwords and confidential API keys
• Financial data: Stripe customer and subscription identifiers, transaction records, and plan status
• Usage data: API call logs, job identifiers, GPU resource consumption, timestamps
• Technical data: IP addresses and user-agent strings collected by contact and security controls
• Workload data: personal data contained in scripts, input data, model artifacts, or stdout/stderr only where the Controller chooses to submit or output it

4.2 Categories of data subjects

• Registered Client users of the GhostNexus platform
• Employees or contractors of the Controller using the Service under the Controller's account
• Individuals whose data the Controller includes in an approved workload, as documented by the Controller

Special category data (Art. 9 GDPR): GhostNexus GhostNexus does not require special category data to operate the Service. The Controller must not submit such data unless the processing scope, Article 9 condition, documented instructions, and appropriate safeguards have been agreed in writing. A DPIA must be completed where Article 35 GDPR requires one.

5. Obligations of the Processor

GhostNexus undertakes to:

• Process personal data only on documented instructions from the Controller
• Ensure that all persons authorised to process personal data are bound by confidentiality
• Implement and maintain the Technical and Organisational Measures set out in Article 7
• Not engage sub-processors without prior written authorisation from the Controller (general authorisation granted as per Article 6 below)
• Assist the Controller, insofar as possible, in responding to data subject requests under Chapter III GDPR
• Assist the Controller with Articles 32–36 GDPR obligations (security, breach notification, DPIA)
• Delete or return all personal data upon termination of services at the Controller's choice
• Make available all information necessary to demonstrate compliance and permit audits

6. Sub-processors

The Controller grants general authorisation to GhostNexus to engage the following sub-processors. GhostNexus will notify the Controller of any intended changes at least 30 days in advance via email and the platform changelog.

Stripe and Resend are peripheral to execution. GhostNexus does not intentionally transmit Client workload files, datasets, model weights, or execution results to either provider.

7. Technical and Organisational Measures (TOMs)

GhostNexus implements the following measures pursuant to Article 32 GDPR to ensure a level of security appropriate to the risk:

7.1 Compute isolation (primary control)

Container filesystems are destroyed immediately upon job completion. No workload files persist between jobs. Execution nodes cannot access the internet during job execution.

7.2 Access controls

• Passwords are hashed with bcrypt; access credentials are treated as confidential secrets
• API-key rotation is available via the authenticated dashboard and API
• TLS 1.2 or later protects public API and WebSocket communications (Caddy/ACME)
• Rate limiting: 10 requests/minute per API key for compute endpoints
• Authentication failures and operational events are recorded in size-rotated security logs

7.3 Data minimisation

• Script contents transmitted to the execution node over a protected WebSocket channel and not stored post-execution
• Job metadata is retained for billing and support; stdout/stderr logs are purged after 30 days
• Early deletion of stdout/stderr logs is available on written request

7.4 Physical and infrastructure security

• Compute infrastructure hosted in Hetzner data centres in Nuremberg, Germany
• Locations: Nuremberg (DE) — within EEA
• No data processing outside EEA for compute workloads

7.5 Availability and resilience

• Redis persistence supports operational recovery of scheduling state
• Automated PostgreSQL backups every 6 hours with 30-day retention
• Monitoring with 5-minute health checks and automated alerting

7.6 Pseudonymisation and encryption

• Passwords: bcrypt hash, never stored in recoverable form
• API keys: confidential authentication secrets with restricted application access and rotation support
• Stripe payment data: tokenised — card numbers never touch GhostNexus servers

8. International Data Transfers

Compute processing takes place exclusively within the EEA (Germany). No personal data is transferred to third countries for the purpose of executing compute jobs.

Where peripheral sub-processors operate outside the EEA (Stripe and Resend — United States), transfers are covered by the transfer mechanisms made available by those providers, including the EU-U.S. Data Privacy Framework and Standard Contractual Clauses where applicable.

9. Personal Data Breach Notification

In the event of a personal data breach, GhostNexus will:

• Notify the Controller without undue delay and, where feasible, within 72 hours of becoming aware of the breach (Art. 33 GDPR)
• Provide, at minimum: nature of the breach, categories and approximate number of data subjects affected, likely consequences, measures taken or proposed
• Notify via email to the account's registered address; escalation path: contact@ghostnexus.net
• Cooperate fully with the Controller in any regulatory notification obligations

10. Assistance with Data Subject Rights

GhostNexus will assist the Controller in fulfilling its obligations to respond to data subject requests under Articles 15–22 GDPR. Requests should be submitted to contact@ghostnexus.net. GhostNexus will respond to Controller requests within 10 business days.

Deletion requests: Personal data associated with an account is deleted when the verified request is processed, except data subject to statutory retention obligations (financial records: 10 years under French commercial law).

11. Audit Rights

The Controller may audit GhostNexus's compliance with this DPA no more than once per calendar year, upon 30 days' written notice. Audits may be conducted by the Controller or a mutually agreed independent third party bound by confidentiality. GhostNexus may satisfy proportionate audit requests by providing infrastructure assurance documentation made available by Hetzner or completing a standardised security questionnaire.

12. Termination and Data Return

Upon termination of the Service or upon the Controller's written request, GhostNexus will, at the Controller's election:

• Delete the personal data when the verified request is processed and provide written confirmation; or
• Return available account and job data in a commonly used machine-readable format

This obligation does not apply to data that GhostNexus is required to retain under applicable law.

13. Governing Law

This DPA is governed by the laws of France. Disputes shall be brought before the courts having jurisdiction under applicable French law, unless mandatory local law requires otherwise.