Skip to content

Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms of Service between GeckoNode LLC ("GeckoNode", "processor") and the business customer ("Customer", "controller"). It applies whenever GeckoNode processes personal data on the Customer's behalf while providing its services, for example when we manage the Customer's servers or websites, deploy its applications or work in its systems. It applies automatically; no signature is required. A countersigned copy is available on request from [email protected].

1. Subject Matter and Duration

GeckoNode processes Customer personal data only to provide the services the Customer has purchased, for as long as those services are provided and until the data is returned or deleted under Section 9.

2. Nature, Purpose and Data

  • Nature and purpose: technical services performed remotely on the Customer's own infrastructure: setup, deployment, maintenance, monitoring, backups, troubleshooting and development.
  • Types of personal data: whatever personal data the Customer stores in the systems we work on, typically contact and account data of the Customer's users, customers and staff, and technical data such as logs and IP addresses. We do not require special categories of data; the Customer must tell us in advance if its systems hold them.
  • Data subjects: the Customer's end users, customers, employees and other individuals whose data is held in those systems.

3. Processing on Instructions

GeckoNode processes Customer personal data only on the Customer's documented instructions, which consist of the Terms, the purchased product and the Customer's written requests. If we believe an instruction infringes applicable data protection law, we will tell the Customer. GeckoNode does not sell Customer personal data or use it for its own purposes.

4. Confidentiality

Everyone who works on Customer systems for GeckoNode is bound by confidentiality obligations and accesses Customer personal data only as far as needed for the service.

5. Security

GeckoNode implements appropriate technical and organizational measures, including: access limited to named personnel; multi-factor or passkey authentication on our administrative systems; encrypted connections to Customer systems; least-privilege access where the Customer's systems allow it; encrypted backups where we configure them; logging of administrative actions on our own systems; and prompt application of security updates.

6. Subprocessors

The Customer gives general authorization for the subprocessors listed on our Subprocessors page. We will announce new subprocessors on that page at least 30 days before they start processing Customer personal data. The Customer may object on reasonable data protection grounds within that period; if we cannot address the objection, the Customer may end the affected service and receive a pro-rata refund of prepaid fees. GeckoNode imposes data protection obligations on each subprocessor that are no less protective than this DPA and remains responsible for their performance.

7. Assistance

Taking into account the nature of the processing, GeckoNode assists the Customer in responding to data subject requests and in meeting its obligations on security, breach notification, data protection impact assessments and prior consultation. Assistance beyond what the purchased service includes may be charged at our usual rates.

8. Personal Data Breaches

GeckoNode notifies the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer personal data, with the information reasonably available to help the Customer meet its own notification duties.

9. Return and Deletion

Customer personal data stays in the Customer's own accounts and systems. When a service ends, GeckoNode stops accessing those systems and deletes any copies it holds (for example working copies or exports) within 30 days, unless the law requires us to keep them. On request we will confirm deletion in writing.

10. Information and Audits

GeckoNode makes available the information reasonably needed to demonstrate compliance with this DPA, including written answers to security questionnaires, and allows audits by the Customer or an independent auditor it appoints, on 30 days' notice, during business hours, at the Customer's cost and no more than once a year unless a breach has occurred.

11. International Transfers

GeckoNode is located in the United States and its main subprocessor, Kodviva Yazılım Sanayi ve Ticaret Ltd. Şti., is located in Türkiye. Where Customer personal data subject to the EU GDPR is transferred to GeckoNode or onward to a subprocessor in a country without an adequacy decision, the Standard Contractual Clauses adopted by European Commission Decision (EU) 2021/914 apply and are incorporated into this DPA: Module Two (controller to processor) between the Customer and GeckoNode, and Module Three (processor to processor) between GeckoNode and its subprocessors, with Clause 7 (docking) included, the optional wording in Clause 11 omitted, Clause 17 governed by the law of Ireland and Clause 18 disputes before the courts of Ireland. The annexes of the Clauses are completed by Sections 1, 2, 5 and 6 of this DPA. For data subject to the UK GDPR, the UK International Data Transfer Addendum to those Clauses applies.

12. Order of Precedence

If this DPA conflicts with the Terms, this DPA prevails for the processing of Customer personal data. If the Standard Contractual Clauses conflict with this DPA, the Clauses prevail.

Last Updated: September 28, 2026