Company logo

Data Processing Addendum

Version 1.0 · Last updated November 3, 2026

This Data Processing Addendum (“DPA”) forms part of the agreement between ParadeDB, Inc. (“ParadeDB,” “we,” “us”) and the customer (“Customer,” “you”) governing our hosted databases and related services (the “Services”). That agreement includes our Terms of Service and your applicable Order, or a separately signed agreement governing the same Services (the “Agreement”).

1. Scope and acceptance

This DPA applies when we process personal data on your behalf to provide the Services, including during trials and previews. You accept it when you accept the Agreement, including through the account creation, provisioning, or use specified in the Terms, or sign an agreement incorporating it. No separate DPA signature or ParadeDB countersignature is required. It takes effect with the Agreement and continues to protect personal data for as long as we or our subprocessors retain it on your behalf.

“Customer Personal Data” means personal data you or your users upload or provide as part of the Services that we process on your behalf. This includes personal data in customer databases, backups, and support or diagnostic materials. Customer Personal Data remains covered when it appears in logs or operational records. Moving it to another system does not change our processing role or permit unrelated uses.

You act as controller and we act as processor. If you process data for another controller, we act as your subprocessor. You must have that controller's authorization to engage us and give the instructions described in this DPA. “Personal data,” “processing,” “controller,” “processor,” and “data subject” have the meanings given by applicable data-protection laws. A “subprocessor” is a provider we engage to process Customer Personal Data on your behalf.

“Data Protection Laws” means privacy and data-protection laws that apply to the processing under this DPA, including the EU General Data Protection Regulation (“GDPR”), UK GDPR and Data Protection Act 2018, Swiss Federal Act on Data Protection, and applicable US state privacy laws, including the California Consumer Privacy Act as amended (“CCPA”). These references include applicable amendments and implementing regulations.

Our independent processing of account, business contact, billing, and Website information is described in our Privacy Policy. This DPA does not govern that processing. The distinction depends on the purpose for which we process the information, rather than where it is stored.

2. Processing details

We process Customer Personal Data to deliver the database services you order. The following details describe both the processing and any associated transfers:

  • Subject and purpose: providing, operating, securing, maintaining, and supporting the Services you use under the Agreement, including database hosting, search, indexing, backups, recovery, technical support, and other features and functionality.
  • Operations: receiving, storing, organizing, querying, retrieving, transmitting, replicating, backing up, restoring, and deleting data. Access and diagnostic work are limited to providing, securing, maintaining, and supporting the Services and carrying out your documented instructions.
  • People whose data is processed: your customers, application users, employees, contractors, suppliers, and other individuals whose data you lawfully submit.
  • Types of data: the database records you choose to submit, which may include names, contact details, identifiers, account information, transactions, and application activity. Support and diagnostic materials may also contain database or object names, connection information, and excerpts you provide.
  • Frequency: ongoing transfers as you and your applications use the Services, scheduled backups and operational processing, and support transfers when you request assistance.
  • Duration: the service term and the limited period needed to return or delete data under Section 8. Any legally required retention remains subject to this DPA.

The Agreement's restrictions on sensitive data apply. By default, you must not submit payment information subject to PCI DSS or special categories of personal data under Article 9 of the GDPR. HIPAA-regulated health information requires an executed business associate agreement and an expressly approved service configuration. Any separately agreed authorization for restricted data must identify the permitted categories and the additional safeguards and processing restrictions that apply. Accepting this DPA alone does not authorize that data.

Active databases and their service-managed backups stay in the region selected for the cluster, except as permitted by the Agreement. Personnel and subprocessors supporting the Services may process Customer Personal Data in other locations, subject to Section 9. The selected database region does not control every support or operational processing location. We provide information about relevant processing locations on request and in our subprocessor list.

3. Instructions and permitted use

Each party will meet its obligations under Data Protection Laws. You are responsible for the lawfulness of the data you submit and your instructions, including required notices, consents or other legal bases, and responses to individuals exercising their rights.

We process Customer Personal Data only under your documented instructions to provide the Services or as required by applicable law. Your instructions include the Agreement, this DPA, your service configuration, SQL operations, support requests, and additional written instructions we acknowledge. If law requires processing outside those instructions, we will tell you before processing unless the law prohibits that notice. We will promptly tell you if we cannot follow an instruction or believe it infringes Data Protection Laws.

We will not sell Customer Personal Data, share it for cross-context behavioral advertising, or use it for our own advertising or to develop, train, or enhance AI or machine learning models, including third-party models. The Agreement's Customer Content protections also apply to personal data in support materials and operational records.

Where we act as a service provider or contractor under US state privacy law, we will not retain, use, or disclose Customer Personal Data outside the limited business purposes in this DPA or our direct business relationship with you, except as permitted by that law. We will not combine it with personal data from other customers or our own interactions with individuals except as permitted by Data Protection Laws. We certify that we understand and will comply with these restrictions. We will notify you if we can no longer meet them, and you may take reasonable steps to verify compliance and stop and remedy unauthorized use.

A service update does not authorize a new processing purpose or sensitive-data category merely because we give notice. Broader processing requires your documented agreement and any safeguards required by Data Protection Laws.

If you provide data in deidentified form, we will take reasonable steps to keep it from being linked to an individual, maintain and use it only in deidentified form, and not attempt to reidentify it. Any recipient we engage to process that data must be contractually bound to the same restrictions and applicable Data Protection Laws. This commitment does not give us any additional right to use or disclose Customer Content.

4. Security measures

We will maintain technical and organizational measures appropriate to the data, processing, and associated risks to protect confidentiality, integrity, and availability. We may improve or change the measures without materially reducing the overall protection of the contracted Services. These measures also apply to Customer Content as provided in the Agreement.

Access and confidentiality

We use authentication and access controls to limit access to the Services and Customer Personal Data to authorized users. Staff access is restricted to personnel who need it to operate, secure, or support the Services. Personnel handling Customer Personal Data are bound by confidentiality duties and receive relevant security training. We review access periodically and remove access when it is no longer needed.

You can enable Support Mode in the console to authorize engineers to access a cluster and its data for troubleshooting. Access through Support Mode also requires separate activation by authorized ParadeDB personnel. You can disable it in the console to revoke your approval and initiate shutdown of that support access.

Encryption and credentials

We use encryption at rest to protect managed databases and service-managed backups. Database endpoints support TLS connections, and we use access controls to protect managed credentials. You must protect your credentials and configure clients to verify server identity. Encryption does not prevent authorized access needed to operate and support the Services.

Isolation and network access

We use logical isolation and network access controls to separate customer environments and restrict access to Customer Personal Data and backups. Management and networking components may be shared unless your Order expressly provides for dedicated infrastructure. Network access settings let you restrict connections to your databases. You remain responsible for your users, SQL permissions, application security, integrations, and selected service configuration.

Backups and recovery

We maintain scheduled backups in the cluster's selected region according to its supported configuration, maintain recovery procedures, and periodically test restoration. Your configured recovery window determines how far back you can restore data. The deletion deadlines in Section 8 set the maximum time to erase retained copies after a deletion request and do not guarantee that those copies remain available for recovery. No recovery-time or recovery-point guarantee applies unless expressly included in your Order.

Monitoring and incident response

We monitor the Services to detect failures and investigate incidents. Access to logs and diagnostic materials is restricted, and we minimize collection of Customer Content where practicable. We maintain incident-response procedures and investigate and report Security Incidents as described in Section 6.

Changes, vulnerabilities, and deletion

We maintain procedures for reviewing and deploying changes, assessing vulnerabilities, and prioritizing remediation according to risk. We restrict processing of retained data and maintain procedures to carry out the deletion deadlines in Section 8. We review subprocessors and require the contractual protections in Section 5.

5. Subprocessors

You give us general authorization to engage the subprocessors identified in our Trust Center to process Customer Personal Data. The list identifies their functions and processing locations. Their processing is limited to the work assigned to them for the Services and the applicable service and deletion periods.

We will notify you before adding or replacing a subprocessor and will also notify you of removals. Where the EU transfer clauses in Section 9 apply, we will give at least 10 business days' prior written notice of additions or replacements. You have five calendar days after notice to object in writing on reasonable data-protection grounds. We will provide information reasonably needed to assess the change and allow the objection process to operate before the new subprocessor begins processing your data.

If you object, we will work with you in good faith to resolve the concern. If we cannot resolve it, we may withdraw the proposed appointment or suspend or terminate the affected Services. Fees already incurred remain payable. This provision does not create an additional refund right or remove an express refund right in your Agreement or mandatory law.

We will bind each subprocessor to written data-protection obligations at least as protective as those that apply to its work under this DPA. We remain responsible for the obligations we delegate and for our subprocessors' compliance with them. We will notify you if a subprocessor fails to meet a material obligation concerning your Customer Personal Data. Where Data Protection Laws require it, we will provide a copy of the relevant subprocessor terms on request. We may redact confidential information that is not needed to assess compliance.

6. Security incidents

A “Security Incident” is a breach of security causing accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data. Unsuccessful attempts that do not compromise Customer Personal Data are not Security Incidents.

We will notify you without undue delay after becoming aware of a Security Incident. We will not wait for the investigation to finish before giving the initial notice. We will use the security contact in your account or Order, or your account contact if you have not designated one. You must keep those details current. Any shorter deadline required by applicable law remains in effect.

We will take reasonable steps to contain, investigate, and mitigate the incident. As information becomes available, we will provide details about its nature, affected data and individuals where known, likely consequences, steps taken or planned, and a contact for further questions. We will reasonably assist with your investigation and any required notices to individuals or authorities. Reporting or responding to an incident does not by itself admit fault or liability.

7. Requests, assessments, and audits

You decide how to respond to individuals' requests concerning Customer Personal Data. We will promptly forward requests we can identify as relating to your data. Unless legally required or authorized by you, we will not respond other than to acknowledge the request and direct the individual to you. Taking account of the processing and information available to us, we will reasonably assist you with access, correction, deletion, portability, restriction, and other rights requests that you cannot fulfill through the Services yourself.

If a public authority demands Customer Personal Data, we will notify you unless prohibited by law, seek to direct the request to you where appropriate, and disclose only what we are legally required to disclose. We will follow the additional notice, review, and challenge obligations in applicable transfer clauses. Where permitted, we will reasonably assist you in seeking confidential treatment or another available remedy.

We will reasonably assist with data-protection and transfer-impact assessments and consultations with supervisory authorities required by Data Protection Laws. Assistance requiring additional work outside the Services may be at your reasonable expense, except where law requires otherwise. Charges will not prevent us from meeting our mandatory obligations.

Compliance information and audits

We will promptly notify you if we determine that we can no longer meet our obligations under Data Protection Laws or this DPA. On reasonable notice, you may take appropriate steps to stop and remedy unauthorized processing.

We will make available information reasonably needed to demonstrate compliance with this DPA. On written request and under confidentiality, we will provide relevant security documentation and available independent audit reports. This DPA does not promise a particular certification or report that we have not obtained.

We normally handle due diligence through that documentation and reasonable written questionnaires, no more than once a year. If it is insufficient to meet your rights under Data Protection Laws, we will allow and contribute to an appropriately scoped audit, including an inspection where required. The parties will arrange reasonable notice, timing, confidentiality, and safeguards for other customers' data and service operation. An independent auditor acting for you must have suitable qualifications and confidentiality obligations.

Annual limits and reporting-first procedures do not restrict an audit or additional information required by law or the transfer clauses, a supervisory authority's request, or a review following a relevant Security Incident. We may protect unrelated confidential information but will not use those restrictions to prevent legally required verification. We will retain records of compliance with this DPA for three years after it ends.

8. Return and deletion

You can export Customer Personal Data using supported PostgreSQL tools while your cluster is available. Complete exports before deletion or loss of access. Any assisted export after termination must be specified in your Order or agreed with support before access ends, as provided in the Agreement.

After termination, you may ask us to return or delete Customer Personal Data in our possession or control. We will follow your choice for data other than backup copies within 30 days of your request and delete backup copies within 60 days of your request, unless law requires retention. If you instruct us to delete an active cluster, both periods start when you give that instruction. The 30-day deadline also applies to Customer Personal Data in support and operational records. We will ensure our subprocessors fulfill their return and deletion obligations.

Data may be erased before these deadlines. You should export anything you need before deleting a cluster or losing access. These deadlines do not require us to keep data available for recovery or a later return request, and requesting a return cannot restore a deleted cluster. Any stricter return or deletion requirements under Data Protection Laws or the transfer clauses still apply, including required deletion certifications.

We continue to protect retained Customer Personal Data under this DPA until it is deleted. During that period, processing is limited to permitted retention, security, legal compliance, and deletion. If law requires longer retention, we will protect the data and process it only as that law requires. If a retained backup is restored, we will reapply deletion instructions before putting the data back into ordinary use. Account and billing records we process for our own purposes follow the retention practices in our Privacy Policy.

9. International transfers

We may transfer Customer Personal Data to the processing locations described in Section 2 and our subprocessor list only as permitted by your instructions, the Agreement, and Data Protection Laws. Choosing a database region does not replace the transfer safeguards required for other processing locations.

EEA transfers

Where a transfer to ParadeDB is subject to the GDPR's international-transfer restrictions and is not covered by an applicable adequacy decision, the European Commission's transfer clauses under Decision (EU) 2021/914 (“SCCs”) are incorporated into this DPA. Module Two applies when you act as controller. Module Three applies when you act as processor. Acceptance of this DPA constitutes both parties' agreement to the applicable SCCs, with these selections:

  • The optional docking clause in Clause 7 does not apply.
  • Clause 9 uses general written authorization, with at least 10 business days' prior notice for new or replacement subprocessors under Section 5.
  • The optional independent dispute-resolution provision in Clause 11 does not apply.
  • Clause 13 uses the alternative appropriate to your establishment or representative. The competent authority is the authority responsible for your compliance with the GDPR in relation to the transfer. If you have neither an EEA establishment nor a required representative, you identify an authority in a Member State where affected individuals are located, as Clause 13 requires, and provide that information to us.
  • Clause 17 uses Option 1 and Irish law. Clause 18 uses the courts of Ireland, without restricting individuals' rights under the SCCs to bring proceedings elsewhere.

For Annex I.A of the SCCs, you are the data exporter and ParadeDB is the data importer. Your identity, address, contact person, and controller or processor role are recorded in your Order or account records. Your relevant activity is providing data for the contracted Services. Our identity and contact details are in Section 11, our role is described in Section 1, and our activity is operating and supporting those Services. The signature and date requirements are fulfilled by acceptance of the Agreement and this DPA, with the acceptance date as the transfer-clause start date.

Sections 2 and 8 supply the transfer description and retention periods for Annex I.B. The competent authority described above supplies Annex I.C. Section 4 supplies the security measures for Annex II. Section 5 and the authorized subprocessor list supply the subprocessor details for Annex III. You will give us and keep current any additional party, contact, or processing details needed for the applicable transfer. We will provide reasonable assistance with completing those details.

UK transfers

For transfers subject to UK GDPR that require these safeguards, the UK International Data Transfer Addendum issued by the Information Commissioner's Office (“UK Addendum”) applies to the SCCs selected above. Its mandatory provisions are incorporated into this DPA, including revisions taking effect under its Section 18.

The parties, contacts, acceptance date, selected SCC version and modules, and processing and security information are those specified in this section and Sections 1, 2, 4, 5, 8, and 11. Neither party may exercise the optional right in Section 19 of the UK Addendum to end it solely because the approved addendum changes. The UK Addendum makes the required changes to governing law, courts, and supervisory authority for UK transfers, including application of the law and courts of England and Wales.

Swiss transfers and continuing safeguards

Where Swiss data-protection law governs a transfer, the SCCs apply with the adaptations needed to protect that transfer. References to the GDPR include the Swiss Federal Act on Data Protection, references to the competent authority include the Swiss Federal Data Protection and Information Commissioner, and references limiting individuals to the EU do not exclude individuals in Switzerland. Irish law and the selected courts apply except where Swiss law requires otherwise.

We will cooperate in assessing transfer risks, provide relevant information about our processing and safeguards, and implement supplementary measures where required. If we cannot meet applicable transfer safeguards, we will promptly tell you and suspend the affected transfer or processing until lawful safeguards are in place. Nothing in this DPA removes rights or obligations under the SCCs or UK Addendum.

10. Liability, priority, and changes

The Agreement's liability limits and exclusions apply to this DPA and are aggregated with liability under the Agreement, rather than providing an additional cap. They do not limit individuals' statutory data-protection rights, liability under the SCCs or UK Addendum, or anything the law prohibits limiting. Contractual claims on behalf of Customer and its affiliates must be brought by the Customer entity that entered into the Agreement, subject to those exceptions.

For conflicts concerning processing on your behalf, the SCCs and UK Addendum control first, this DPA next, and the remainder of the Agreement afterward. Other Agreement provisions remain in effect. Its governing-law and dispute provisions apply except where the transfer clauses or Data Protection Laws require otherwise.

Changes to this DPA require both parties' written or electronic agreement, except for subprocessor and security-measure changes permitted by Sections 4 and 5 and mandatory revisions to the UK Addendum described in Section 9. Updating a webpage or the Privacy Policy alone does not amend an accepted DPA.

11. Contact details

Send DPA questions, instructions, and privacy requests to legal@paradedb.com or by mail to:

ParadeDB, Inc.
2261 Market Street STE 80275
San Francisco, CA 94114
United States

For general support, contact support@paradedb.com. To report a security vulnerability, contact security@paradedb.com. We send DPA notices to the legal or security email address designated in your Order or account records. Keep those email addresses and any required controller authorization current so that we can deliver notices and respond to requests.