Data processing agreement

Version 2.1, October 2026.

This Agreement applies to every customer through the Terms of Service and needs no signature. If your organization needs a countersigned copy, sign it online with DocuSeal and Cloudfleet countersigns it.

This data processing agreement is entered into by and between Cloudfleet GmbH, Kolonnenstraße 8, 10827 Berlin, Germany, hereinafter referred to as “Cloudfleet”, and the customer that has accepted Cloudfleet’s Terms of Service or signed a copy of this Agreement, hereinafter referred to as “Customer”. Cloudfleet and Customer, each a “Party” and, collectively, “Parties”.

Preamble

The Customer engages Cloudfleet to provide the Services described in § 2.1, which involves processing personal data on the Customer’s behalf. Article 28 GDPR sets out requirements for such processing. To meet them, the Parties enter into this data processing agreement (“Agreement”). Unless expressly stated otherwise, Cloudfleet receives no separate remuneration for performing this Agreement.

1. Definitions

Terms defined in Articles 4, 9 and 10 GDPR have the same meaning in this Agreement.

Term	Definition
GDPR	Regulation (EU) 2016/679 (General Data Protection Regulation);
Data Subject(s)	The natural person to whom the Personal Data relates;
Sub-processor(s)	Any processor engaged by Cloudfleet to process Personal Data on behalf of the Customer;
Personal Data	Any information relating to an identified or identifiable natural person within the meaning of Article 4 (1) GDPR that Cloudfleet processes on behalf of the Customer under this Agreement. The categories are described in Annex 1.

2. Subject matter

2.1. Under the agreement on the use of the Cloudfleet services concluded between the Parties, including Cloudfleet’s Terms of Service and any order form (“Principal Agreement”), Cloudfleet provides the following services to the Customer (“Services”):

Cloudfleet Kubernetes Engine (“CFKE”): a container runtime platform that runs across various cloud and infrastructure providers;
Cloudfleet Container Registry (“CFCR”): storage and distribution of container images and artefacts in the region selected by the Customer.

In doing so, Cloudfleet gains access to personal data. Subject to § 2.7, Cloudfleet processes this data exclusively on behalf of and according to the instructions of the Customer, unless otherwise required by EU or Member State law applicable to Cloudfleet.

The scope and purpose of the processing follow from the Principal Agreement, any applicable service description and Annex 1. The Customer is responsible for ensuring that the processing has a legal basis under Article 6 (1) GDPR.

The Parties acknowledge that Cloudfleet does not access the content of the Customer’s workloads, Kubernetes objects or container images, except for management operations and as described in Annex 2 item 2. Processing under this Agreement covers the categories described in Annex 1, including any personal data the Customer stores in Kubernetes objects or in container images in CFCR. Cloudfleet’s own processing under § 2.7 is not processing on behalf of the Customer.

2.2. This Agreement sets out the Parties’ rights and obligations under data protection law. In case of conflict, this Agreement takes precedence over the Principal Agreement.

2.3. Except for processing under § 2.7, this Agreement applies to all activities in connection with the Principal Agreement in which Cloudfleet, its employees or agents process personal data on behalf of the Customer.

2.4. This Agreement runs for the term of the Principal Agreement, unless the following provisions provide otherwise.

2.5. The Customer acts either (a) as controller of the personal data processed under this Agreement, in which case Cloudfleet acts as its processor; or (b) as processor on behalf of one or more third parties who are controllers of the personal data (each a “Third-Party Controller”), in which case Cloudfleet acts as the Customer’s sub-processor within the meaning of Article 28 (4) GDPR. The Customer may act in both roles at the same time for different personal data. Unless stated otherwise, this Agreement applies in both cases.

2.6. Where the Customer acts as processor under § 2.5 (b):

(a) The Customer’s instructions under § 4 are binding on Cloudfleet. The Customer warrants that its instructions, including the engagement of Cloudfleet, are consistent with the instructions of the Third-Party Controller.
(b) The Customer has obtained the authorisation of the Third-Party Controller required under Article 28 (2) and (4) GDPR for the engagement of Cloudfleet and of the sub-processors listed in Annex 3. The Customer shall pass on notices under §§ 8.3 and 8.4 to the Third-Party Controller and raise any objection of the Third-Party Controller with Cloudfleet. The Customer shall ensure that its agreement with the Third-Party Controller is consistent with this Agreement, and acknowledges that this Agreement meets the requirements of Article 28 (4) GDPR.
(c) Cloudfleet communicates exclusively with the Customer. Notifications under § 6, information and audit requests under § 7 and data subject requests under § 9 are exchanged between Cloudfleet and the Customer. The Customer shall forward them to, or receive them from, the Third-Party Controller without undue delay.
(d) If the Customer has ceased to exist in fact or in law, or if insolvency proceedings have been opened over its assets or rejected for lack of assets, the Third-Party Controller may instruct Cloudfleet directly to delete the personal data processed on its behalf and to stop that processing. Before deletion and at the Third-Party Controller’s expense, Cloudfleet shall provide an export of such data on request, insofar as technically possible. To this extent, the Third-Party Controller is a third-party beneficiary of this Agreement (§ 328 of the German Civil Code (Bürgerliches Gesetzbuch, BGB)). Its rights are subject to the mandatory rights of an insolvency administrator, and Cloudfleet’s liability towards it is limited to the same extent as towards the Customer under this Agreement and the Principal Agreement. Cloudfleet may require reasonable proof of the Third-Party Controller’s identity and of its status as controller before acting, and is not liable for acting in good faith on an instruction supported by such proof. The Third-Party Controller has no further rights or claims under this Agreement.
(e) The Customer shall indemnify Cloudfleet against claims of the Third-Party Controller and of data subjects, including reasonable costs of legal defence, to the extent they arise from a breach of the Customer’s obligations or warranties under (a) or (b). § 10.2 sentences 2 and 3 apply accordingly, with the roles of the Parties reversed.

2.7. Cloudfleet processes the following personal data as an independent controller and not on behalf of the Customer:

(a) data about the Customer’s account and its authorised users, for account administration, authentication, contract management, billing (including measurement of service usage) and service communications;
(b) data about the use of the Cloudfleet console, API and website, including log, device and network data, for security, fraud and abuse prevention, and the operation and improvement of the Services;
(c) feedback and support communications;
(d) personal data Cloudfleet must process to comply with legal obligations, such as tax and commercial record-keeping.

Where Cloudfleet accesses the contents of a Customer cluster during a support session authorised by the Customer, that access is processing on behalf of the Customer under this Agreement. Processing under this § 2.7 is governed by Cloudfleet’s privacy policy, which also names the service providers used for it.

3. Personal data and data subjects

3.1. Annex 1 sets out the categories of personal data and data subjects, and the nature, purpose and duration of the processing.

3.2. The Services are not designed for storing personal data in cluster metadata, resource identifiers, labels, configuration data, manifests or other Kubernetes objects, and Cloudfleet recommends that the Customer not place personal data there. Where the Customer does, that data is processed under this Agreement.

4. Instructions

4.1. Subject to § 2.7, Cloudfleet may process personal data only within the scope of the Principal Agreement and according to the Customer’s instructions; this applies in particular to transfers of personal data to a third country or an international organisation. If Cloudfleet must carry out further processing due to EU law or the law in an EU Member State applicable to Cloudfleet, Cloudfleet shall notify the Customer of these legal requirements before any such processing takes place, unless that law prohibits such notification on important grounds of public interest.

4.2. The Customer’s instructions are initially set out in this Agreement. The Customer may change, supplement or replace them at any time by individual instructions in text form within the meaning of § 126b BGB (“Individual Instruction”), including instructions on the rectification, erasure and restriction of processing of personal data. The persons authorised to give and receive instructions are named in Annex 4. If a designated person changes or is unavailable for a longer period, the Party concerned shall notify the other Party of the successor or substitute without undue delay.

4.3. The Customer and Cloudfleet shall document all instructions given and keep this documentation for as long as the instructions are valid. Instructions that go beyond the Services agreed in the Principal Agreement are treated as a request to change the Services.

4.4. If Cloudfleet considers that an instruction infringes data protection law, it shall inform the Customer without undue delay. Cloudfleet may suspend the instruction until the Customer confirms or changes it, and may refuse to carry out an obviously unlawful instruction.

5. Security and confidentiality

5.1. Cloudfleet shall comply with legal data protection requirements and shall not transfer or make accessible to third parties personal data processed under this Agreement, except to sub-processors engaged under § 8 or where required by EU or Member State law applicable to Cloudfleet. Cloudfleet shall protect documents and data against access by unauthorised persons in line with the state of the art.

5.2. Within its area of responsibility, Cloudfleet shall organise its operations to meet the requirements of data protection law and shall implement the technical and organisational measures required by Article 32 GDPR, in particular those set out in Annex 2. Insofar as the processing includes special categories of personal data, Cloudfleet shall additionally implement the adequate and specific measures laid down in § 22 (2) of the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG). Upon request, Cloudfleet shall explain to the Customer how these measures are determined and implemented.

Cloudfleet may change these measures, provided that the agreed level of protection is maintained.

5.3. Cloudfleet has not appointed a Data Protection Officer under Article 37 GDPR / § 38 BDSG. Contact for privacy matters: privacy@cloudfleet.ai.

5.4. Persons employed by Cloudfleet may not process personal data without authorisation. Cloudfleet shall ensure that all persons it engages in the processing (“personnel”) have committed themselves to confidentiality under Article 28 (3) (b) GDPR. Cloudfleet shall instruct personnel on the data protection obligations under this Agreement, including purpose limitation and the duty to follow instructions, and shall take due care to ensure that they comply. These obligations continue after the end of this Agreement and of the employment relationship.

6. Information obligations of Cloudfleet

6.1. Cloudfleet shall inform the Customer without undue delay in text form of material breaches of this Agreement by Cloudfleet and of security incidents that Cloudfleet reasonably believes may affect personal data processed under this Agreement. In the case of a personal data breach affecting the Customer’s data, Cloudfleet shall notify the Customer without undue delay and in any event within 24 hours of becoming aware of it. Cloudfleet becomes aware of a personal data breach when it has a reasonable degree of certainty that a security incident has occurred that has led to personal data being compromised. For a personal data breach at a sub-processor, Cloudfleet becomes aware of it when the sub-processor notifies Cloudfleet or Cloudfleet otherwise obtains such certainty. A notification under this § 6.1 is not an acknowledgement of fault or liability. To the extent possible, notification about a personal data breach shall contain the following information:

a description of the nature of the personal data breach including, where possible, the categories and number of data subjects potentially affected, and the categories and number of personal data records concerned;
a description of the likely consequences of the personal data breach, and
a description of the measures taken or proposed by Cloudfleet to address the personal data breach, including, where appropriate, measures to mitigate any possible adverse effects.

Where it is not possible to provide all of this information at the same time, Cloudfleet shall provide it in phases as it becomes available, without undue further delay. Notifications shall be sent to the notification contact designated by the Customer in Annex 4. Cloudfleet shall also inform the Customer without undue delay of inspections or measures by a supervisory authority insofar as they concern processing under this Agreement.

6.2. Cloudfleet shall take all necessary measures to secure the data and mitigate possible adverse effects on the data subjects without undue delay. Cloudfleet shall also inform the Customer of these measures and request further instructions.

6.3. Where a breach under § 6.1 concerns the Customer’s data, Cloudfleet shall provide further details on request.

6.4. If the Customer’s data at Cloudfleet is put at risk by seizure or confiscation, by insolvency or composition proceedings, or by other events or measures of third parties, Cloudfleet shall inform the Customer without undue delay, unless prohibited by court or administrative order. In this context, Cloudfleet shall, without undue delay, inform all competent entities that the decision-making authority over the data rests exclusively with the Customer or, where § 2.5 (b) applies, with the Third-Party Controller.

6.5. Cloudfleet shall notify the Customer without undue delay of material changes to the measures under § 5.2.

6.6. If Cloudfleet appoints or replaces a Data Protection Officer, it shall notify the Customer without undue delay.

6.7. Cloudfleet and, where applicable, its representative shall maintain a record of processing activities under Article 30 (2) GDPR. Upon request, Cloudfleet shall provide the Customer with the entries relating to processing on its behalf.

6.8. If Cloudfleet receives a legally binding request from a public authority, including a court, for disclosure of personal data processed under this Agreement, or becomes aware of direct access by a public authority to such data, Cloudfleet shall:

(a) notify the Customer without undue delay, unless prohibited by law, and where prohibited, use reasonable efforts to obtain a waiver of the prohibition;
(b) redirect the authority to the Customer where possible;
(c) review the legality of the request and challenge it where, after careful assessment, there are reasonable grounds to consider it unlawful; and
(d) disclose only the minimum personal data required to comply with the request.

For requests to sub-processors, Cloudfleet relies on the corresponding commitments in their data processing agreements and standard contractual clauses.

7. Information and audit rights of the Customer

7.1. Before the processing begins and regularly thereafter, the Customer shall satisfy itself of the technical and organisational measures taken by Cloudfleet.

7.2. Upon the Customer’s request in text form, Cloudfleet shall, in a timely manner, provide the information necessary to demonstrate compliance with Article 28 GDPR and this Agreement.

7.3. The Customer shall document the results of its review and inform Cloudfleet without undue delay of any deficiencies found. Where a review shows that changes to the processing are required, the Customer shall notify Cloudfleet of the necessary changes without undue delay.

7.4. Upon request, Cloudfleet shall provide the Customer with appropriate proof of the confidentiality obligations under § 5.4.

7.5. Information under § 7.2 is provided free of charge. The Customer shall reimburse Cloudfleet for reasonable, documented expenses of audits and inspections under § 7.6, unless the audit reveals a material breach of this Agreement by Cloudfleet.

7.6. Cloudfleet shall allow for and contribute to audits, including inspections, by the Customer or an auditor mandated by it who is bound to confidentiality. Inspections shall be announced at least 30 days in advance, take place during business hours without disrupting operations, and not more than once per year unless required by a supervisory authority or following a personal data breach. Cloudfleet may instead provide current audit reports or certifications where these sufficiently demonstrate compliance. The auditor shall not be a competitor of Cloudfleet. Audits are limited to the systems and records used for processing under this Agreement and do not extend to other customers’ data, to Cloudfleet’s trade secrets beyond what the audit requires, or to the premises of sub-processors; for sub-processors, Cloudfleet provides their audit reports and certifications (§ 8.1).

8. Engagement of sub-processors

8.1. Cloudfleet uses the sub-processors listed in Annex 3 to provide the Services. Cloudfleet may engage further sub-processors in accordance with § 8.3. Cloudfleet shall carefully select sub-processors according to their suitability and reliability. When engaging sub-processors, Cloudfleet shall ensure their commitment to confidentiality in line with the provisions of this Agreement and impose on them data protection obligations equivalent to those in this Agreement (Article 28 (4) GDPR). Cloudfleet shall exercise its audit rights towards sub-processors on the Customer’s behalf where necessary, including by relying on their audit reports and certifications. If sub-processors from a third country are involved, Cloudfleet shall ensure that the transfer is based on an adequacy decision under Article 45 GDPR, including the EU-US Data Privacy Framework, or on standard contractual clauses under Article 46 (2) (c) GDPR, as stated for each sub-processor in Annex 3. Upon request, Cloudfleet shall provide evidence of these agreements with its sub-processors.

8.2. Third parties that Cloudfleet engages for purely ancillary services are not sub-processors. Such ancillary services include, but are not limited to, postal, transport and shipping services, cleaning services, security services, and telecommunications services without specific reference to the Services. Maintenance and testing services are sub-processing insofar as they concern IT systems used to provide the Services. Providers of infrastructure that the Customer contracts directly, such as cloud provider accounts and hardware on which the Customer’s nodes run, are not sub-processors of Cloudfleet.

8.3. Cloudfleet shall notify the Customer of new sub-processors at least 30 days in advance via the notification contact designated in Annex 4. The Customer may object in text form within this period on reasonable data protection grounds. In that case, the Parties shall seek a solution in good faith. If no solution is found before the new sub-processor is engaged, the Customer may terminate the affected Services with effect from that date. If the Customer does not object within the period, the new sub-processor is deemed approved. Annex 3 is updated accordingly when the new sub-processor is engaged; § 13.2 does not apply to such updates.

8.4. Where a sub-processor must be replaced at short notice because it ceases to provide its services, materially breaches its obligations, or for urgent security or legal reasons, Cloudfleet may engage a replacement before the period under § 8.3 has expired. Cloudfleet shall notify the Customer without undue delay, at the latest when the replacement is engaged. The Customer’s right to object under § 8.3 applies from that notice.

9. Data subject inquiries and rights

9.1. Cloudfleet shall assist the Customer by appropriate technical and organisational measures, insofar as possible, in fulfilling the Customer’s obligations as established under Articles 12 to 23 and 32 to 36 GDPR.

9.2. If a data subject contacts Cloudfleet directly to exercise their rights, Cloudfleet shall not respond to the request itself but shall forward it to the Customer without undue delay and await the Customer’s instructions.

9.3. Assistance under § 9.1 is provided free of charge insofar as the Customer can perform it using the functions of the Services or it requires only minor effort. For assistance beyond this, the Customer shall reimburse Cloudfleet’s reasonable, documented expenses; Cloudfleet shall estimate them in advance.

10. Liability

10.1. The Customer and Cloudfleet shall be liable to the data subjects in accordance with the provisions of Article 82 GDPR. The Parties shall coordinate before satisfying any such claim.

10.2. Cloudfleet shall indemnify the Customer against claims that data subjects assert against the Customer under Article 82 GDPR, to the extent the damage was caused by Cloudfleet not complying with obligations of the GDPR specifically directed to processors or with this Agreement, or by Cloudfleet acting outside or contrary to the Customer’s lawful instructions. The indemnity requires that the Customer (a) notifies Cloudfleet of the claim without undue delay, (b) does not acknowledge or settle the claim without Cloudfleet’s prior consent, which shall not be unreasonably withheld, and (c) allows Cloudfleet to conduct or take part in the defence and provides reasonable assistance. Where both Parties are responsible for the damage, it is borne in proportion to their share of responsibility.

10.3. A Party is exempt from liability if and to the extent that it proves that it is not in any way responsible for the event giving rise to the damage (Article 82 (3) GDPR). Otherwise, Article 82 (5) GDPR applies.

10.4. The limitations of liability in the Principal Agreement apply to Cloudfleet’s liability under this Agreement, including § 10.2. They do not apply to liability for intent or gross negligence, for injury to life, body or health, or under the German Product Liability Act. For a slightly negligent breach of essential contractual obligations, Cloudfleet’s liability is limited to the typical, foreseeable damage.

11. Right to extraordinary termination

11.1. The Customer may terminate the Principal Agreement, in whole or in part, for good cause without notice if:

(a) Cloudfleet materially breaches its obligations under this Agreement and does not remedy the breach within 30 days of being notified of it in text form;
(b) Cloudfleet intentionally or through gross negligence violates the GDPR or other applicable data protection law in the processing under this Agreement;
(c) Cloudfleet refuses to execute a lawful instruction of the Customer within the scope of the Principal Agreement, other than in accordance with § 4.4; or
(d) Cloudfleet denies the Customer’s audit rights under § 7 contrary to this Agreement.

No remedy period under (a) is required where the breach cannot be remedied or the Customer cannot reasonably be expected to wait for it. Fees for services provided until termination remain payable; fees paid in advance for the period after termination are refunded.

12. Deletion of data

12.1. Before the Principal Agreement ends, the Customer may export its data through the interfaces of the Services. Cloudfleet shall delete all personal data processed on behalf of the Customer within 30 days after the end of the Principal Agreement, unless EU law or the laws of the Federal Republic of Germany require its storage. Upon the Customer’s request, Cloudfleet shall delete such data earlier, including during the term of the Principal Agreement. Backups and logs containing such data are deleted automatically within 30 days of the deletion; until then they remain subject to this Agreement and are not used or restored. Cloudfleet shall confirm the deletion in text form upon request.

12.2. The Customer may verify the deletion in an appropriate manner.

12.3. Cloudfleet shall keep confidential any data that has become known to it in connection with the Principal Agreement, including after the Principal Agreement ends. This Agreement remains in force after the end of the Principal Agreement for as long as Cloudfleet holds personal data processed on behalf of the Customer.

13. Final provisions

13.1. The Parties agree that Cloudfleet’s right of retention under § 273 BGB is excluded with regard to the data to be processed and the corresponding data carriers.

13.2. Changes and amendments to this Agreement require text form; this also applies to any change to this requirement. Individually negotiated agreements take precedence (§ 305b BGB).

13.3. Should any provision of this Agreement be invalid or become partially or entirely invalid or unenforceable, the remainder of this Agreement shall remain valid and in force.

13.4. This Agreement shall be governed by and construed in accordance with German law. The exclusive place of jurisdiction for all disputes arising out of or in connection with this Agreement is Berlin, Germany, unless mandatory statutory provisions designate a different place of jurisdiction.

13.5. Notwithstanding § 13.2, Cloudfleet may amend this Agreement where required by changes in applicable law, decisions of courts or supervisory authorities, or new standard contractual clauses or adequacy decisions, provided the amendment does not reduce the level of protection of the personal data. Cloudfleet shall notify the Customer of the amendment in text form at least 30 days before it takes effect. If the Customer objects in text form within this period, either Party may terminate the affected Services with effect from the date the amendment would have taken effect.

Annex 1: Data subjects and categories of personal data

This Annex sets out the personal data that Cloudfleet processes on behalf of the Customer under this Agreement.

The Data Subjects are the Customer’s authorised users and other persons accessing the Customer’s clusters, and any individuals whose personal data the Customer stores in its clusters or includes in container images stored in CFCR. The processing takes place for the term of the Principal Agreement and until deletion under § 12.1.

Data category	Data	Nature and purpose of processing
Cluster data	Kubernetes objects stored in the cluster data store and its backups, including configuration data, deployment manifests, labels and Secrets; performance metrics and resource utilisation data of the cluster.	Storage, backup and restoration in the cluster data store, and processing by the control plane components, to operate the Customer’s CFKE clusters.
Cluster access data	Identities of users and service accounts accessing the cluster’s Kubernetes API (user names, e-mail addresses, group memberships from the Customer’s identity provider, source IP addresses), as recorded in Kubernetes API audit logs.	Recording in Kubernetes API audit logs for the security of the Customer’s clusters and the traceability of access to them. Retained for 30 days (Annex 2 item 5).
Registry data	Container images and artefacts uploaded by the Customer to CFCR. They are stored and delivered as opaque content and not inspected by Cloudfleet. They contain personal data only if the Customer includes it.	Storage and delivery to clients authorised by the Customer, to provide CFCR.

Apart from Kubernetes objects stored in the cluster data store and container images stored in CFCR, Cloudfleet does not store customer application data, container contents, application or container logs, or business data. Data the Customer retrieves from its workloads through the Kubernetes API, such as container logs or exec sessions, passes through the cluster’s control plane in transit and is not stored by Cloudfleet.

Annex 2: Technical and organisational measures

Cloudfleet implements the following technical and organisational measures pursuant to Article 32 GDPR. They apply to the processing of personal data under this Agreement. Cloudfleet may adapt them to technical progress in accordance with § 5.2, provided the level of protection does not fall below the level described here.

Measure	Implementation
1. Physical access control	Cloudfleet does not operate its own data centres or server rooms. All systems used to provide the Services run at the infrastructure providers listed in Annex 3. Physical and environmental security of the hosting layer (access control to buildings, fire protection, climate control, power supply) is provided by the infrastructure provider and covered by its ISO/IEC 27001 certification and SOC 2 reports.
2. System and data access control	Access to production systems is restricted to Cloudfleet personnel who need it for their role, following the principle of least privilege. All accounts are personalised. There are no shared operator credentials. Access to production systems requires multi-factor authentication. Access by Cloudfleet personnel to control plane components is limited to management operations (upgrades, scaling, health monitoring). Cloudfleet does not access customer workloads, application data or Kubernetes Secrets unless the Customer explicitly authorises it for a limited time, for example during a support session. Administrative access is logged. Cloudfleet personnel with access to production systems are based in the EU/EEA. Access by Cloudfleet personnel from outside the EU/EEA is limited to temporary stays, such as business travel, and uses the same secured access path. Remote access by sub-processors is set out in Annex 3. Access rights are revoked without undue delay when personnel leave Cloudfleet, as part of a documented offboarding process.
3. Separation	Each cluster has its own control plane instance and cluster data store. Control plane components and data stores are not shared between clusters, including clusters of the same organisation. Control plane components are isolated from each other at network and runtime level. Production, staging and development environments are separated. CFCR stores container images in the region selected by the Customer. Storage for the EU region is restricted to data centres in the EU.
4. Encryption	Data in transit is encrypted with TLS 1.2 or higher, including all access to the CFKE Kubernetes API and to CFCR. Traffic between the nodes of a cluster runs over an encrypted WireGuard® overlay, independently of the encryption provided by the underlying network. Cluster data stores are encrypted at rest with AES-256. Backups are encrypted in transit and at rest. On Enterprise clusters with Confidential Control Plane, Kubernetes objects are additionally encrypted in the API server before storage, with keys held in the Customer’s own HSM or cloud KMS. Container images in CFCR are encrypted at rest with AES-256.
5. Input control and logging	Infrastructure components, Kubernetes API activity, administrative actions and access events are logged. Logs are written to append-only storage and are protected against alteration and deletion before the end of the retention period. Automated alerting notifies on-call engineers of anomalies and unauthorised access attempts. Infrastructure logs are retained for 30 days.
6. Availability and resilience	Cluster data stores are backed up several times per day. Backups are retained for 30 days. Restoration from backups is tested regularly. Pro and Enterprise control planes run with multiple replicas across physically separate availability zones. Infrastructure is defined as code, version-controlled and deployed through peer-reviewed pipelines.
7. Incident management	Cloudfleet maintains a documented incident management process covering detection, classification, containment, recovery, notification and post-incident review. An on-call rotation ensures incidents are handled outside business hours. Personal data breaches are notified to the Customer in accordance with § 6.1.
8. Regular testing and evaluation	Security checks run as mandatory gates in the delivery pipeline: static application security testing, dependency scanning, container image scanning and infrastructure-as-code linting. Infrastructure and services are scanned for vulnerabilities on an ongoing basis. The effectiveness of these measures is reviewed at planned intervals and after significant changes to infrastructure, services or the threat landscape. Findings are documented, assigned an owner and tracked to completion.
9. Organisational measures	All personnel are bound by written confidentiality obligations that survive the end of employment (§ 5.4). Personnel receive information security and data protection training during onboarding and when significant changes occur. Security policies are documented, version-controlled and approved by management. Sub-processors are selected after due diligence, including review of their security certifications and data processing terms, and are bound by data processing agreements (§ 8).
10. Deletion	Deletion of CFKE clusters and of the Customer’s data follows § 12.1. Cluster state is deleted when the cluster is deleted; backups and logs are deleted automatically within 30 days. Container images deleted from CFCR, including their underlying storage objects, are removed by garbage collection within 24 hours.

Annex 3: Approved sub-processors

The following companies are approved sub-processors under § 8 of this Agreement. Service providers that Cloudfleet uses only for processing under § 2.7 are not sub-processors and are listed in Cloudfleet’s privacy policy.

Legal entity and address	Service and purpose	Place of processing	DPA
Google Cloud EMEA Limited 70 Sir John Rogerson’s Quay, Dublin 2, Dublin D02 R296, Ireland	Infrastructure hosting (compute, storage, networking) for the management layer and cluster control planes, including data stores and backups. Details: security and data protection	Frankfurt, Germany; Iowa, USA for clusters in `northamerica-central-1a` (DPF, SCCs)	Cloud Data Processing Addendum
MongoDB Limited Building Two, Number One Ballsbridge, Shelbourne Road, Dublin 4, Ireland	Database for management layer metadata: mapping of organisations and clusters to regions	EU (Frankfurt, Germany); remote support access by MongoDB, Inc. (USA) (DPF, SCCs)	MongoDB DPA
Cloudflare, Inc. 101 Townsend Street, San Francisco, CA 94107, USA	Object storage for CFCR (container images and artefacts); DNS for CFKE cluster service endpoints	CFCR: region selected by the Customer (EU, USA or Asia-Pacific); storage for the EU region is restricted to data centres in the EU. DNS: global network. Remote access by Cloudflare, Inc. (USA) (DPF, SCCs)	Cloudflare Customer DPA

Annex 4: Contacts for instructions and notifications

For Cloudfleet: Recipient of instructions: Yegor Tokmakov, Managing Director, yegor@cloudfleet.ai. Data protection contact and notifications: privacy@cloudfleet.ai.

For the Customer: The Customer may designate, by e-mail to privacy@cloudfleet.ai or in a signed copy of this Agreement:

a contact for notifications under §§ 6, 8.3, 8.4 and 13.5, including personal data breaches and sub-processor changes (e-mail address, preferably a shared mailbox);
persons authorised to issue instructions (name, e-mail);
its data protection officer, if appointed (name, e-mail).

Communication channel: e-mail. If the Customer has not designated a contact for notifications or persons authorised to issue instructions, the owner of the Customer’s Cloudfleet organisation acts as such. The Customer shall keep its designated contacts up to date (§ 4.2). Notifications sent to the last designated contact or, if none is designated, to the e-mail address of the organisation owner are deemed received.

Conclusion of this Agreement

This Agreement is concluded when the Customer accepts the Terms of Service (Section 6.3) and applies for as long as Cloudfleet processes personal data on behalf of the Customer. The Customer may obtain a copy of this Agreement countersigned by Cloudfleet by signing it online.