Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the InstaPods Terms of Service, or any other written agreement for InstaPods services (the "Principal Agreement"), between ExpressTech Systems, trading as InstaPods ("InstaPods", "Processor"), and the customer that has accepted the Principal Agreement ("Customer", "Controller").

How this DPA takes effect. This DPA applies automatically, with no signature required, from the moment the Customer accepts the Principal Agreement, wherever InstaPods Processes Personal Data on the Customer's behalf that is subject to Data Protection Law. A Customer that needs a signed copy for its records may complete the signature block at the end of this DPA and send it to support@instapods.com, and InstaPods will countersign and return it. The signed copy changes no terms. If this DPA conflicts with the Principal Agreement, this DPA prevails for the Processing of Personal Data.

1. Definitions

Capitalised terms not defined in this DPA have the meanings given in the GDPR. In addition:

• "Data Protection Law" means all data-protection laws that apply to the Processing of Personal Data under the Principal Agreement. This includes, where applicable, Regulation (EU) 2016/679 (the "GDPR"), the GDPR as retained in UK law together with the UK Data Protection Act 2018 (the "UK GDPR"), and the Swiss Federal Act on Data Protection (the "FADP").
• "Customer Personal Data" means Personal Data that the Customer, or its end users, uploads to, stores in, generates within or transmits through the Services, including inside the Customer's pods, databases and backups.
• "EU SCCs" means the Standard Contractual Clauses annexed to Commission Implementing Decision (EU) 2021/914 of 4 June 2021, as amended or replaced from time to time.
• "UK Addendum" means the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner's Office under section 119A(1) of the Data Protection Act 2018 (Version B1.0, in force from 21 March 2022), as amended or replaced from time to time.
• "Services" means the InstaPods app-hosting platform and related services provided under the Principal Agreement.
• "Sub-processor" means any third party engaged by InstaPods that Processes Customer Personal Data.

2. Roles and scope

2.1 For Customer Personal Data, the Customer is the Controller (or a processor acting for its own controller) and InstaPods is the Processor (or sub-processor).

2.2 InstaPods acts as an independent controller for the account, billing and usage data it needs to run its business, such as the Customer's account email address, invoices and payment records. That Processing is described in the InstaPods Privacy Policy and is outside the scope of this DPA.

2.3 The subject matter, nature, purpose and duration of the Processing, and the types of Personal Data and categories of data subjects, are set out in Annex I.

2.4 The Customer is responsible for the lawfulness of the Customer Personal Data and of its instructions, and for having a lawful basis and any required notices or consents for the Processing.

3. Processor obligations

3.1 Documented instructions

InstaPods will Process Customer Personal Data only on the Customer's documented instructions, including with regard to international transfers, unless required to do otherwise by law. In that case InstaPods will inform the Customer of the legal requirement before Processing, unless that law prohibits it on important grounds of public interest. The Customer's instructions are this DPA, the Principal Agreement, and the Customer's configuration and use of the Services. InstaPods will tell the Customer without undue delay if it believes an instruction infringes Data Protection Law. InstaPods does not sell Customer Personal Data, does not use it for its own purposes, and does not disclose it to anyone other than the Sub-processors listed in Annex III, and then only to provide the Services.

3.2 Confidentiality

InstaPods will ensure that everyone authorised to Process Customer Personal Data is bound by appropriate confidentiality obligations or is under an appropriate statutory duty of confidentiality.

3.3 Security

InstaPods will implement and maintain the technical and organisational measures described in Annex II. InstaPods may update those measures from time to time, provided the overall level of protection is not materially reduced.

3.4 Sub-processors

(a) The Customer gives InstaPods general written authorisation to engage Sub-processors. The current list is published at instapods.com/legal/subprocessors (Annex III).

(b) InstaPods will impose data-protection obligations on each Sub-processor that are no less protective than those in this DPA, to the extent applicable to the service that Sub-processor provides. InstaPods remains liable to the Customer for each Sub-processor's performance of those obligations.

(c) InstaPods will give at least 30 days' notice before adding or replacing a Sub-processor. Notice will be given by updating the Sub-processor page and emailing the account owner's email address. The Customer may object on reasonable data-protection grounds within that period by writing to support@instapods.com. If the parties cannot resolve the objection, the Customer may terminate the affected Services and will receive a pro-rata refund of any prepaid fees for the unused portion of those Services.

3.5 Data-subject requests

Taking into account the nature of the Processing, InstaPods will assist the Customer with appropriate technical and organisational measures, insofar as possible, to respond to requests from data subjects exercising their rights under Data Protection Law. If InstaPods receives such a request directly, it will forward it to the Customer without undue delay and will not respond itself, other than to confirm receipt and direct the data subject to the Customer.

3.6 Personal Data Breaches

InstaPods will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data. Notice goes to the account owner's email address. The notice will include, as far as is then known: the nature of the breach, including the categories and approximate number of data subjects and records concerned; its likely consequences; the measures taken or proposed; and a contact point. Breach-notification emails will identify the incident by date, time and scope and will not contain the affected Personal Data. InstaPods will cooperate with the Customer in investigating and remediating the breach.

3.7 Impact assessments

InstaPods will provide reasonable assistance with any data-protection impact assessment or prior consultation with a supervisory authority that the Customer is required to carry out, taking into account the nature of the Processing and the information available to InstaPods.

3.8 Deletion and return

(a) During the term, the Customer can export its data at any time, including by downloading pod backups, and can delete pods, backups and its account from the dashboard.

(b) On termination, or earlier on the Customer's written request, InstaPods will delete Customer Personal Data as follows:

(c) On request, InstaPods will confirm deletion in writing. Where law requires InstaPods to retain some data (for example billing records for tax purposes), InstaPods will protect it under this DPA and Process it only for that legal purpose.

4. International transfers

4.1 Where data is stored. The Customer chooses a region when it creates a pod:

• EU region: pods run in data centres in France.
• North America region: pods run in data centres in Canada and the United States.

Pod backups are stored in Germany. The InstaPods control plane, which holds account data and pod configuration, runs in Finland. Full details are in Annex III.

4.2 Access from India. InstaPods is based in India. Authorised InstaPods personnel access the Services, including Customer Personal Data where this is needed for support, maintenance, security and incident response, from India.

4.3 EU SCCs. Where the Processing involves a transfer of Personal Data subject to the GDPR to a country without an adequacy decision, the EU SCCs are incorporated into this DPA by reference. They apply as follows:

• Module Two (controller to processor) applies where the Customer is a controller, and Module Three (processor to processor) applies where the Customer is a processor.
• The Customer is the data exporter and InstaPods is the data importer.
• Clause 7 (docking clause) does not apply.
• Clause 9(a): Option 2 (general written authorisation) applies, with the notice period in Section 3.4.
• Clause 11(a): the optional language does not apply.
• Clause 13: the competent supervisory authority is determined as described in Annex I.C.
• Clause 17: Option 1 applies, governed by the law of Ireland.
• Clause 18(b): disputes are resolved before the courts of Ireland.
• The Annexes to the EU SCCs are completed by Annexes I to III of this DPA.

4.4 UK transfers. Where the UK GDPR applies, the UK Addendum is incorporated into this DPA. Tables 1 to 3 are completed by reference to Annexes I to III and the selections in Section 4.3. For Table 4, neither party may end the UK Addendum.

4.5 Swiss transfers. Where the FADP applies, the EU SCCs apply with these changes:

• references to the GDPR are read as references to the FADP;
• the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner;
• "Member State" is read to include Switzerland, so that data subjects in Switzerland can bring claims in their place of habitual residence.

4.6 Other jurisdictions. Where other Data Protection Law requires a transfer mechanism, the parties will rely on the safeguards in this DPA and the EU SCCs to the extent that law permits.

4.7 Transfer impact. InstaPods has informed the Customer that it operates from India, which has no adequacy decision under the GDPR or UK GDPR. Having considered that information, the Customer relies on this DPA, the measures in Annex II and the transfer mechanisms above.

5. Audits

5.1 InstaPods will make available the information reasonably necessary to demonstrate compliance with this DPA. This includes answers to industry-standard security questionnaires (such as CAIQ or SIG) and the then-current certifications of its infrastructure Sub-processors.

5.2 If that information is not sufficient to show compliance, or a supervisory authority requires it, the Customer may conduct an audit, including an inspection, or have an independent auditor conduct one. The following conditions apply:

• Frequency: no more than once in any 12-month period, except after a Personal Data Breach affecting the Customer.
• Notice: at least 30 days' written notice.
• Timing and confidentiality: during normal business hours, under reasonable confidentiality undertakings.
• Costs: at the Customer's cost.

6. Liability

Each party's liability under this DPA is subject to the limitations and exclusions in the Principal Agreement, except where Data Protection Law or the EU SCCs do not permit liability to be limited.

7. Term

This DPA lasts as long as InstaPods Processes Customer Personal Data under the Principal Agreement. Section 3.8 and any other obligations that by their nature survive termination continue after it ends.

8. General

8.1 Order of precedence. If documents conflict regarding the Processing of Personal Data, the following order applies:

1. the EU SCCs, together with the UK Addendum and the Swiss changes in Section 4.5, as applicable;
2. this DPA;
3. the Principal Agreement.

8.2 Changes. InstaPods may update this DPA to reflect changes in law, its Sub-processors or the Services, provided the update does not materially reduce the protection given to Customer Personal Data. InstaPods will post each version at instapods.com/legal/dpa with its date and will email account owners about material changes at least 30 days before they take effect.

8.3 Successors. Either party may assign or novate this DPA to a successor or affiliated entity together with the Principal Agreement, on at least 30 days' written notice, provided the level of protection is not reduced.

8.4 Notices. Notices to InstaPods under this DPA go to support@instapods.com. Notices to the Customer go to the account owner's email address.

8.5 Governing law. Except where the EU SCCs, the UK Addendum or Data Protection Law require otherwise, this DPA is governed by the laws of India, and the courts of India have exclusive jurisdiction, as for the Principal Agreement.

Annex I - Description of the Processing

I.A - Parties

• Data exporter / Controller: the Customer, as identified in its InstaPods account (or in the signature block of a signed copy). Role: controller, or processor on behalf of its own controller. Activities: using the Services to host and run its applications.
• Data importer / Processor: ExpressTech Systems, trading as InstaPods, 780, Sector 7, HSR Layout, Bangalore, India. Contact: support@instapods.com. Activities: providing the Services, including infrastructure operation, backups, support, maintenance and incident response.

I.B - Description of the transfer

• Categories of data subjects: determined by the Customer. Typically the Customer's end users, customers, contacts and staff, and other people whose data the Customer's applications process.
• Categories of Personal Data: any Personal Data that the Customer or its end users put into, generate within or send through the Services. Typically this includes identifiers, contact details, account credentials, and transaction and usage data. The specific categories depend on the applications the Customer deploys.
• Special-category data: none is expected. If the Customer chooses to process special-category data or criminal-offence data, the Customer is responsible for the additional safeguards and lawful basis that Data Protection Law requires. The measures in Annex II apply to all Customer Personal Data.
• Frequency: continuous, for the term of the Principal Agreement.
• Nature of the Processing: hosting, storage, computation as directed by the Customer's applications, transmission, backup, logging, support and deletion.
• Purpose: to provide the Services under the Principal Agreement.
• Retention: for the term of the Principal Agreement, then as set out in Section 3.8.
• Sub-processor transfers: as described in Annex III, for the same nature and purpose and for the duration of each Sub-processor's engagement.

I.C - Competent supervisory authority

• Where the Customer is established in the EEA, the competent supervisory authority is the authority of the Member State where the Customer is established.
• Where the Customer is not established in the EEA but the GDPR applies to it, the competent authority is the authority of the Member State where its EU representative is established. If it has no EU representative, it is the Irish Data Protection Commission.
• For the UK GDPR, the competent authority is the Information Commissioner's Office. For the FADP, it is the Federal Data Protection and Information Commissioner.

Annex II - Technical and organisational measures

Physical security. Infrastructure runs in professionally operated data centres run by the hosting Sub-processors listed in Annex III. Each provides physical access control, perimeter security, power and cooling redundancy, and on-site staff under its own published security certifications.

Network security. All public traffic to the Services and to Customer pods is encrypted with TLS 1.2 or TLS 1.3. Older protocol versions are refused. Management interfaces are restricted and reached over SSH with key-based authentication only. Host firewalls allow only the ports that are required.

Tenant isolation. Each pod runs in its own isolated Linux environment, with a separate filesystem, network namespace, process space and resource limits.

Access control.

• InstaPods personnel: production access is currently held by a single authorised operator, uses SSH keys, and follows least privilege.
• Customer accounts: sign-in to the dashboard is by email and password, or by Google or GitHub sign-in. Sessions use HttpOnly, Secure cookies.
• API and MCP access: uses OAuth 2.0 with PKCE and team-scoped tokens.
• MFA: multi-factor authentication for customer accounts is on the roadmap and is not available today. On request, InstaPods can restrict dashboard access to a Customer-specified IP address range.

Encryption.

• In transit: TLS 1.2+ for all public traffic and for traffic to backup storage.
• Backups at rest: object storage encrypts backups at rest with provider-managed keys.
• Pods at rest: pod filesystems and the control-plane database are not encrypted at the volume level. Customers that need encryption at rest for particular data should apply it at the application layer.

Backups.

• Customer pod data and database dumps are backed up to object storage in Germany, on a schedule set by the Customer's plan.
• Backups contain Customer-supplied data, not the base operating-system image.
• Customers can download, restore and delete their backups from the dashboard.

Logging and monitoring.

• Web-server access and error logs on hosting servers are kept for up to 30 days.
• Pod build and status events are kept while the Customer's account exists, so the Customer can see its pod history.
• Logs are not designed to capture the content of Customer data.
• Hosts and pods are health-checked continuously.

AI-assisted features. Some features send limited, task-specific data to an AI Sub-processor (Annex III), for example build and runtime logs to diagnose a failed deploy, or repository metadata to detect how to run an app. This data is used only to provide the feature. Under that Sub-processor's commercial API terms, it is not used to train models, and InstaPods does not use Customer Personal Data to train models of its own.

Vulnerability management. InstaPods keeps base images and platform dependencies up to date and applies critical security patches promptly.

Incident response. InstaPods follows a documented incident-response process and notifies customers as set out in Section 3.6.

Personnel. Everyone with access to production systems is bound by confidentiality obligations.

Certifications. InstaPods does not currently hold its own SOC 2 or ISO 27001 certification. Its infrastructure Sub-processors hold their own certifications. InstaPods will complete reasonable security questionnaires on request.

Annex III - Sub-processors

The current list, with entity names, locations and purposes, is published at instapods.com/legal/subprocessors. It is incorporated into this DPA by reference. The list as of 14 October 2026 is included in the published page.

See also: Sub-processors (Annex III), Privacy Policy and Terms of Service.

Signature (optional - only for Customers who need a signed copy)