When your hosted website or cloud desktop handles other people's personal data, you're the controller and we process it for you. This addendum covers that, including the Standard Contractual Clauses for transfers out of Europe.
Effective date: October 18, 2026. This Data Processing Addendum ("DPA") forms part of the Terms of Service between you ("Customer") and Rigaway, Inc., a Delaware corporation ("Rigaway"). It applies automatically, without signature, whenever Rigaway processes Customer Personal Data in providing hosting or cloud desktops. If you need a countersigned copy for your records, email privacy@rigaway.com.
"Data Protection Laws" means all laws on personal data that apply to the processing under this DPA, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection ("FADP"), and the California Consumer Privacy Act as amended ("CCPA"). "Customer Personal Data" means personal data that Rigaway processes on Customer's behalf as described in Annex I. "SCCs" means the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914. "Sub-processor" means a third party Rigaway engages to process Customer Personal Data. "Controller", "processor", "data subject", "personal data breach", and "processing" have the meanings in the GDPR.
Customer is the controller (or a processor acting for its own controller) and Rigaway is the processor (or sub-processor) of Customer Personal Data. This DPA does not cover data Rigaway processes as a controller to run its own business — for example Customer's account, billing, and security data — which our Privacy Policy covers. Customer is responsible for having a lawful basis for the processing, for giving notices to its data subjects, and for the lawfulness of its instructions. Customer will not use hosting or cloud desktops to process special categories of personal data or data subject to sector-specific rules (such as health or payment card data) unless the service's security measures are adequate for it under the law that applies to Customer.
Rigaway processes Customer Personal Data only on Customer's documented instructions. The Terms, this DPA, and Customer's configuration and use of the service (deploying websites, enabling databases, storage, or logs, and so on) are Customer's complete instructions. Rigaway may also process Customer Personal Data where required by law, in which case it will tell Customer first unless the law forbids it. Rigaway will tell Customer if, in its opinion, an instruction infringes Data Protection Laws.
Rigaway ensures that anyone it authorizes to process Customer Personal Data is bound by confidentiality obligations and accesses it only as needed to provide, secure, or support the service, or to comply with law.
Rigaway implements and maintains the technical and organizational measures in Annex II. Rigaway may update them as long as the update does not materially reduce the overall level of protection.
Customer gives Rigaway general authorization to engage Sub-processors. The current list is in Annex III and on our Subprocessors page. Rigaway will update that page at least 14 days before a new Sub-processor starts processing Customer Personal Data; Customer can subscribe to updates by emailing privacy@rigaway.com. Customer may object on reasonable data-protection grounds within that period; if we can't resolve the objection, Customer may stop using the affected feature or terminate the service, and that is its sole remedy. Rigaway imposes data-protection obligations on each Sub-processor that are no less protective than this DPA, and remains responsible for its Sub-processors' performance.
Taking into account the nature of the processing, Rigaway will reasonably help Customer (a) respond to data subjects exercising their rights, mainly through the service's own tools (Customer can read, change, and delete its website files, database, storage, and logs at any time); (b) meet its obligations on security, breach notification, data protection impact assessments, and prior consultation. If Rigaway receives a request directly from Customer's data subject, it will refer the data subject to Customer and won't respond itself except as the law requires.
Rigaway will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed; Rigaway will provide further information as it becomes available. Notice is sent to Customer's account email. Notifying Customer is not an acknowledgment of fault.
Customer can export or delete its Customer Personal Data at any time using the service. When Customer deletes a website, a cloud desktop, or its account, or when a subscription ends, Rigaway deletes the related Customer Personal Data on the schedule in our Privacy Policy (for example, deleted websites are removed right away; cloud-desktop data is deleted 30 days after the subscription ends), except where the law requires Rigaway to keep it, in which case it stays protected under this DPA for as long as it's kept.
Rigaway will make available the information reasonably needed to demonstrate compliance with this DPA, including written answers to reasonable security questionnaires, once a year or after a personal data breach. If that information is not enough to meet Customer's obligations or a supervisory authority's request, Customer may carry out an audit, or have an independent auditor bound by confidentiality do so, with at least 30 days' notice, during business hours, at Customer's cost, and without access to other customers' data. These audit rights also satisfy the audit provisions of the SCCs.
Rigaway processes Customer Personal Data in the United States and in the other locations listed in Annex III. To the extent processing involves a transfer of personal data from the EEA, the UK, or Switzerland to a country without an adequacy decision, the parties agree as follows, and the relevant clauses are incorporated into this DPA by reference:
If the SCCs conflict with this DPA, the SCCs prevail. If Rigaway adopts another lawful transfer mechanism (such as certification under the EU–U.S. Data Privacy Framework), it may rely on that instead. Rigaway will review government requests for Customer Personal Data, challenge them where there are reasonable grounds, disclose only the minimum required, and notify Customer unless legally prohibited.
For Customer Personal Data subject to the CCPA, Rigaway is a service provider. Rigaway will not sell or share it; will not retain, use, or disclose it for any purpose other than the business purposes in the Terms and this DPA, or outside the direct business relationship with Customer; will not combine it with personal information from other sources except as the CCPA permits; will comply with the CCPA and provide the same level of privacy protection it requires; will notify Customer if it can no longer meet these obligations; and allows Customer to take reasonable steps to stop and remediate unauthorized use. Rigaway certifies that it understands these restrictions.
This DPA lasts as long as Rigaway processes Customer Personal Data. Each party's liability under this DPA is subject to the limitations in the Terms, except where Data Protection Laws or the SCCs don't allow it. If this DPA conflicts with the Terms, this DPA prevails for the processing of Customer Personal Data. Rigaway may update this DPA to reflect changes in law or the service, with notice as described in the Terms; an update will not materially reduce the protection of Customer Personal Data.
The Sub-processors that process Customer Personal Data are those on our Subprocessors page used for hosting or cloud desktops — currently Cloudflare (serving, storage, databases, logs, archives), our control-plane server hosts (website configuration, private-website allowlists), Resend (private-website access codes), and Fly.io (cloud desktops) — at the locations listed there.