# HeliosDB Data Processing Agreement | Item | Detail | | --- | --- | | Document | Data Processing Agreement (GDPR Article 28) | | Version | 1.0 | | Effective date | 2026-10-29 | | Processor | Dimen Sigon OÜ, trading as HeliosDB, registry code 16757774, Ahtri 12, 10151 Tallinn, Estonia | | Address of this document | https://partners.heliosdb.com/legal/dpa | ## Change log | Version | Date | Change | | --- | --- | --- | | 1.0 | 2026-10-29 | First published version. | ## 1. Parties and how this agreement is made **1.1** This Data Processing Agreement ("DPA") is between Dimen Sigon OÜ, trading as HeliosDB ("HeliosDB"), and the customer or partner that accepts it (the "Customer"). **1.2** The Customer accepts this DPA electronically, by ticking the acceptance box when it accepts the HeliosDB Cloud Terms of Service, the HeliosDB Customer Terms for Self-Hosted Commercial Licences, a partner agreement or a support order, or when HeliosDB asks it to accept this DPA in the Partner Portal or the Cloud console. Electronic form satisfies GDPR Article 28(9). HeliosDB keeps a record of the version accepted, its SHA-256 fingerprint and the time of acceptance. **1.3** This DPA applies whenever HeliosDB processes Customer Personal Data on the Customer's behalf in connection with a service agreement between the parties (the "Agreement"). It prevails over the Agreement for that processing. ## 2. Definitions **2.1** Terms defined in Regulation (EU) 2016/679 (the "GDPR"), such as "personal data", "processing", "controller", "processor", "data subject", "personal data breach" and "supervisory authority", have the same meaning here. In addition: - **"Customer Personal Data"** means personal data that HeliosDB processes on behalf of the Customer under the Agreement, as described in Annex I. - **"Data Protection Law"** means the GDPR, the Estonian Personal Data Protection Act and any other data-protection law that applies to the processing, including the Swiss Federal Act on Data Protection and the UK GDPR where they apply. - **"SCC"** means the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914 of 4 June 2021. - **"Sub-processor"** means another processor engaged by HeliosDB to process Customer Personal Data. ## 3. Roles **3.1** The Customer is the controller of Customer Personal Data, or a processor acting for its own customers. HeliosDB is the Customer's processor, or its sub-processor where the Customer is itself a processor. **3.2** Where the Customer is a processor, it confirms that its controller has authorised it to appoint HeliosDB on these terms, and it passes on to its controller the information and assistance it receives under this DPA. **3.3** HeliosDB's processing of its own customers' and partners' account, contract, billing and contact data is outside this DPA; HeliosDB is controller for it, as described in the HeliosDB Privacy Notice. ## 4. Instructions **4.1** HeliosDB processes Customer Personal Data only on the Customer's documented instructions, including with regard to transfers, unless Union or Member State law requires otherwise; in that case HeliosDB informs the Customer of the legal requirement before processing, unless that law prohibits it. **4.2** The Agreement, this DPA and the Customer's use and configuration of the services are the Customer's complete instructions at the time of acceptance. Further instructions must be in writing and consistent with the Agreement; instructions that change the scope or cost of the service may need a change to the Agreement. **4.3** HeliosDB informs the Customer immediately if, in its opinion, an instruction infringes Data Protection Law. ## 5. Confidentiality **5.1** HeliosDB ensures that every person authorised to process Customer Personal Data is bound by confidentiality, by contract or by law, and processes it only as needed for the Agreement. ## 6. Security **6.1** HeliosDB implements the technical and organisational measures described in Annex II, which are designed to give a level of security appropriate to the risk, as required by GDPR Article 32. HeliosDB may update the measures, provided the overall level of protection is not reduced. **6.2** The Customer is responsible for the security of its own systems, credentials and configuration, and for choosing the services and settings appropriate to its data. ## 7. Sub-processors **7.1** The Customer gives HeliosDB general written authorisation to engage Sub-processors. The Sub-processors in use on the date of this version are listed in Annex III. **7.2** HeliosDB informs the Customer of any intended addition or replacement of a Sub-processor at least 30 days in advance, by e-mail to the Customer's account owner and by updating Annex III. The Customer may object on reasonable data-protection grounds within that period. The parties then discuss the objection in good faith; if it cannot be resolved, the Customer may terminate the affected service without penalty and receive a refund of any prepaid fees for the period after termination. **7.3** HeliosDB imposes on each Sub-processor, by contract, data-protection obligations that give at least the protection of this DPA, and remains responsible to the Customer for each Sub-processor's performance. ## 8. Assistance **8.1** Taking into account the nature of the processing, HeliosDB assists the Customer by appropriate technical and organisational measures in responding to requests from data subjects exercising their rights. If HeliosDB receives such a request directly, it forwards it to the Customer without undue delay and does not answer it itself unless the Customer instructs it to. **8.2** HeliosDB assists the Customer, using the information available to it, in meeting its obligations on security, breach notification, data-protection impact assessments and prior consultation (GDPR Articles 32 to 36). ## 9. Personal data breaches **9.1** HeliosDB notifies the Customer of a personal data breach affecting Customer Personal Data without undue delay after becoming aware of it, and in any event within 48 hours. This is an outer limit, not permission to delay. Notices are sent to the Customer's account owner or security contact at any time, not only in business hours. **9.2** The notice describes, as far as then known, the nature of the breach, the categories and approximate numbers of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Information not available at first is provided in phases without undue delay. **9.3** HeliosDB takes reasonable steps to contain the breach and reduce its effects, and cooperates with the Customer's investigation and notifications. A notice is not an admission of fault. ## 10. Deletion and return **10.1** When the service ends, the Customer may export Customer Personal Data during the export period stated in the Agreement (30 days for the Cloud Service). HeliosDB then deletes Customer Personal Data from its live systems within 30 days, unless Union or Member State law requires it to keep it. **10.2** Copies in encrypted backups expire in the ordinary backup cycle (daily copies for up to 14 days on the production server and 7 days off it, weekly copies for 4 weeks, monthly copies for 3 months). Until then they remain protected by this DPA and are not used except to restore service. **10.3** On request, HeliosDB confirms the deletion in writing. ## 11. Audits and information **11.1** HeliosDB makes available to the Customer the information necessary to demonstrate compliance with GDPR Article 28, including this DPA, Annex II and answers to reasonable security questionnaires. **11.2** If that information is not sufficient, or a supervisory authority requires it, the Customer may audit HeliosDB's compliance, itself or through an independent auditor bound by confidentiality, once in any twelve months, on at least 30 days' notice, during business hours and without disrupting operations or compromising other customers' data. Each party bears its own costs, unless the audit reveals a material breach of this DPA by HeliosDB, in which case HeliosDB bears the reasonable cost of the audit. ## 12. International transfers **12.1** HeliosDB does not transfer Customer Personal Data to a country outside the European Economic Area without an adequacy decision unless the conditions of GDPR Chapter V are met. **12.2** Where HeliosDB engages a Sub-processor in such a country, it relies on the Sub-processor's certification under an adequacy framework (such as the EU-U.S. Data Privacy Framework) or concludes the SCC, Module 3 (processor to processor), with that Sub-processor, together with any supplementary measures the transfer requires. **12.3** Where the Customer is located in a country outside the European Economic Area without an adequacy decision and HeliosDB returns or makes Customer Personal Data available to it, the SCC apply between HeliosDB as data exporter and the Customer as data importer: Module 4 (processor to controller) where the Customer is a controller, and Module 3 (processor to processor) where the Customer is a processor. They are incorporated by reference with these choices: clause 7 (docking clause) applies; clause 11(a) option is not used; clause 17 and clause 18: the law and the courts of the Republic of Estonia (Harju County Court); the competent supervisory authority is the Estonian Data Protection Inspectorate; Annexes I to III of the SCC are completed by Annexes I to III of this DPA. **12.4** For transfers subject to the Swiss Federal Act on Data Protection or the UK GDPR, the SCC apply with the amendments those laws require (for the UK, the International Data Transfer Addendum issued by the UK Information Commissioner). **12.5** If the SCC conflict with this DPA, the SCC prevail. ## 13. Liability and term **13.1** Each party's liability under this DPA is subject to the limitation of liability in the Agreement, except where Data Protection Law or the SCC do not allow it to be limited. **13.2** This DPA lasts as long as HeliosDB processes Customer Personal Data on the Customer's behalf, and its obligations survive until the data is deleted or returned. ## 14. Changes and governing law **14.1** HeliosDB may publish a new version of this DPA, with at least 30 days' notice. A new version that reduces the Customer's protection applies only once the Customer accepts it. Changes to Annex III follow clause 7.2. Every version is published at the address at the top with its version, effective date, change log and SHA-256 fingerprint. **14.2** This DPA is governed by the law of the Republic of Estonia, and disputes are decided by Harju County Court (Harju Maakohus) in Tallinn, Estonia, unless the SCC require otherwise. ## Annex I: Description of the processing | Item | Description | | --- | --- | | Services | HeliosDB Cloud; support, diagnosis and escalation support where the Customer gives HeliosDB access to personal data; AI Support and AI-DBA features used under a Customer account where the Customer submits personal data | | Categories of data subjects | Determined by the Customer: typically the Customer's end users, customers, employees, contractors and business contacts | | Categories of personal data | Determined by the Customer: any personal data the Customer stores in its databases or includes in support material, such as names, contact details, identifiers, transaction and usage records | | Special categories | None intended. The Customer shall not submit special categories of data or data about criminal convictions unless the parties agree additional safeguards in writing | | Nature of processing | Storage, hosting, backup copies, retrieval, query execution, transmission, and inspection for diagnosis and support | | Purpose | Providing the services under the Agreement, keeping them secure and resolving problems the Customer reports | | Duration | The term of the Agreement and the deletion period in clause 10 | | Frequency of transfers to sub-processors | Continuous for hosting; none to the remote AI model on the effective date (Annex III) | ## Annex II: Technical and organisational measures | Area | Measures | | --- | --- | | Encryption in transit | TLS on all public endpoints, with a post-quantum hybrid key exchange (X25519MLKEM768) where the client supports it; internal traffic between HeliosDB sites over an encrypted private network | | Encryption at rest | Database stores of the Cloud control plane and the Partner Portal encrypted with AES-256-GCM; encrypted backup archives | | Access control | Administrative access limited to named HeliosDB administrators; two-factor authentication for staff accounts; least-privilege service accounts; containers run as non-root users where supported | | Network security | Default-deny host firewall covering both IPv4 and IPv6; services bound to private interfaces unless they must be public | | Tenant isolation | Logical separation per Customer organisation: on the Free and Starter plans, a shared database in which each organisation's tables are kept under a name prefix unique to it; on the Pro plan, a separate embedded database file per organisation; every request is authenticated and scoped to the organisation | | Availability and recovery | Daily encrypted backups: daily copies for up to 14 days on the production server and 7 days off it, weekly copies for 4 weeks, monthly copies for 3 months; automated restore drills that compare restored data with the live system | | Logging and monitoring | Security-relevant events logged; monitoring of backup freshness and service health with alerts | | Personnel | Confidentiality duties for everyone with access; access removed when no longer needed | | Incident handling | Security reports at security@heliosdb.com at any time; breach notification under clause 9 | | Data minimisation | Diagnostic material redacted of personal data where practicable; AI Support logs do not store question text | ## Annex III: Sub-processors Status on the effective date of this version: | Sub-processor | Service | Customer Personal Data concerned | Location | Transfer mechanism | | --- | --- | --- | --- | --- | | OVH (OVHcloud); contracting entity to be confirmed | Rented server and network connectivity hosting the Cloud Service and HeliosDB's other public services | All Customer Personal Data in the Cloud Service | To be confirmed: Switzerland or Germany | None needed (EEA or adequacy decision) | | OpenAI; contracting entity to be confirmed | Remote language model, used only when HeliosDB's own model equipment is unavailable | None on the effective date: not used for Customer Personal Data until HeliosDB has confirmed the contracting entity, its data processing terms and the transfer mechanism and has given notice under clause 7.2 | United States | Data Privacy Framework certification or SCC Module 3, to be confirmed before any use | HeliosDB also processes Customer Personal Data on equipment it operates itself in Switzerland, which has an EU adequacy decision: its AI model server and its backup storage. These are not Sub-processors. Payment processing (Stripe) concerns HeliosDB's own billing data, not Customer Personal Data, and is outside this Annex.