"Customer" refers to the entity that has entered into an agreement with GCNhub for API services.
"Processor" refers to GCNhub, which processes personal data on behalf of the Customer.
"Personal Data" has the meaning given in the GDPR and other applicable data protection laws.
"Sub-processor" means any third party engaged by GCNhub to assist in processing personal data on behalf of the Customer.
The Customer acts as the data controller and GCNhub acts as the data processor.
GCNhub processes personal data only on documented instructions from the Customer, including with regard to transfers of personal data to a third country, unless required by applicable law.
The Customer is responsible for ensuring that it has a valid legal basis for the processing and for complying with its obligations as a controller under applicable data protection laws, including providing necessary privacy notices and obtaining consents from data subjects.
GCNhub processes personal data for the following purposes on behalf of the Customer:
GCNhub engages sub-processors to support the delivery of the Service (e.g., cloud hosting, email delivery, payment processing).
GCNhub remains liable for the performance of its sub-processors to the same extent as if it were performing the services itself.
A current list of sub-processors is available upon request. GCNhub will notify the Customer of any intended changes to sub-processors, giving the Customer the opportunity to object.
GCNhub implements and maintains appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:
GCNhub will assist the Customer in responding to data subject requests (e.g., access, rectification, erasure, restriction, portability) by providing the necessary information and tools within a reasonable timeframe.
If GCNhub receives a data subject request directly, it will forward it to the Customer without responding, unless required by law.
GCNhub will notify the Customer without undue delay (and in any case within 72 hours) upon becoming aware of a personal data breach affecting the Customer's data.
The notification will include the nature of the breach, the likely consequences, and the measures taken or proposed to address it and mitigate its effects.
GCNhub will cooperate with the Customer in fulfilling any breach notification obligations to supervisory authorities and data subjects.
GCNhub will make available to the Customer all information necessary to demonstrate compliance with this DPA.
The Customer may, at its own cost, conduct an audit or instruct a qualified third-party auditor to do so, subject to reasonable confidentiality obligations and at least 30 days' prior notice.
GCNhub's SOC 2 Type II report is available annually and may satisfy audit requirements without the need for on-site audits.
Upon termination of the Service or at the Customer's request, GCNhub will return or delete all personal data processed on behalf of the Customer, except where storage is required by applicable law.
Any data retained for legal compliance will be held securely and processed only for the purpose of complying with the applicable legal obligation, then deleted upon expiration of the retention period.
If personal data is transferred outside the EEA, UK, or Switzerland, GCNhub will ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) or other valid transfer mechanisms approved by the relevant supervisory authority.
This DPA is governed by the same governing law as the underlying agreement between the Customer and GCNhub.
For questions about this DPA or to request the list of sub-processors, please contact our Data Protection Officer at dpo@gcnhub.com.
We use analytics cookies to understand how the site is used. Choosing “Essential only” means no analytics run at all. Read our Cookie Policy.