Perch Platform — Data Processing Agreement

Version 1.0 — effective 13/10/2026.

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Perch Platform Limited (CRO 801020), registered office Middlequarter, Newcastle, Clonmel, Co. Tipperary, E91 CD71, Ireland ("Perch", "we", the Processor) and the customer ("you", the Controller).

It applies where you use the Service to process personal data for which you are the controller, and it records the terms required by Article 28(3) of Regulation (EU) 2016/679 (GDPR). It takes effect automatically when you subscribe — you do not need to sign a separate copy, though we will sign one on request.

"Customer Personal Data" means personal data contained in Your Content and processed by us on your behalf. "Data Protection Law" means the GDPR and the Irish Data Protection Acts 1988 to 2018, and any law replacing them.

1. Roles

You are the controller of Customer Personal Data and we are your processor. You decide what personal data goes into the Service, why, and for how long.

Where we process personal data about you as our customer — your account and billing details — we do so as a controller in our own right, and our Privacy Policy applies to that, not this DPA.

2. Your obligations

You warrant that:

• you have a lawful basis for the processing you carry out through the Service, and have given the notices and obtained any consents required;
• your instructions to us comply with Data Protection Law; and
• you will not use the Service to process special category data under Article 9, or criminal offence data under Article 10, without first telling us in writing so we can assess whether our measures are appropriate.

3. Our obligations

We will:

(a) Process only on your instructions. We will process Customer Personal Data only on your documented instructions, which are: to provide, secure, maintain and support the Service in accordance with the Terms of Service; anything you configure or ask for through the Service or by email; and nothing else. If we are required by EU or Irish law to process it otherwise, we will tell you before doing so unless that law forbids it on important grounds of public interest. If we think an instruction breaches Data Protection Law, we will tell you.

(b) Keep it confidential. Everyone we authorise to process Customer Personal Data is bound by a duty of confidentiality that survives the end of their engagement. Access is limited to those who need it to do their job.

(c) Keep it secure. We will apply the technical and organisational measures set out in Annex 2, appropriate to the risk, as required by Article 32.

(d) Use sub-processors properly. See clause 4.

(e) Help you answer data subjects. Taking into account the nature of the processing, we will help you meet your obligations to respond to requests to access, correct, erase, restrict, port or object. If a data subject contacts us directly about data inside your instance, we will not respond substantively; we will forward it to you without undue delay.

(f) Help you with your wider obligations. We will help you, as far as is reasonable given the nature of the processing and the information available to us, with security, breach notification, data protection impact assessments and prior consultation under Articles 32 to 36.

(g) Delete it at the end. See clause 6.

(h) Let you verify. See clause 7.

4. Sub-processors

You give us general authorisation to appoint sub-processors. Each one is bound by written terms imposing data protection obligations no less protective than this DPA, and we remain fully liable to you for their performance.

Our current sub-processors are:

We will tell you by email at least 30 days before adding or replacing a sub-processor. If you reasonably object on data protection grounds within that period, we will discuss it with you; if we cannot resolve it, you may terminate the affected part of the Service without penalty and we will refund the unused part of any period you have paid for.

5. International transfers

Customer Personal Data is stored and processed within the European Union — in Germany and Finland — including backups.

We will not transfer Customer Personal Data outside the EEA without either a European Commission adequacy decision, Standard Contractual Clauses, or another transfer mechanism valid under Chapter V of the GDPR, and we will tell you first.

6. Personal data breaches

If we become aware of a personal data breach affecting Customer Personal Data, we will notify you without undue delay and in any event within 48 hours of becoming aware of it, at the email address on your account.

Our notification will describe, as far as we know at the time: the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, the measures taken or proposed, and a contact point for more information. We will provide further information as it becomes available and will cooperate with you in investigating and remedying it.

It is your responsibility as controller to decide whether to notify a supervisory authority or the affected individuals, and to make any such notification.

7. Return and deletion

On the ending of the Service, and at your choice, we will return Customer Personal Data to you or delete it.

In practice: we keep one final backup of it for 30 days after your subscription ends so you can export it or subscribe again, and then permanently delete it, including from backups in the normal backup rotation, as set out in clause 10 of the Terms of Service. If you ask us to delete it sooner, we will. We will confirm deletion in writing on request.

We may retain data where EU or Irish law requires us to, and only for as long as that law requires.

8. Audit

We will make available to you the information necessary to demonstrate our compliance with Article 28, and will allow and contribute to audits, including inspections, conducted by you or an auditor you appoint.

In practice, we will first answer a reasonable written questionnaire. If that is not enough for you to satisfy your obligations, an on-site or remote inspection may be carried out on 30 days' notice, no more than once in any 12-month period unless a breach or a supervisory authority requires otherwise, during normal business hours, subject to confidentiality, and in a way that does not disrupt the Service or affect other customers. You bear the cost of any inspection you initiate.

9. Liability

Each party's liability under this DPA is subject to the limitations and exclusions in clause 14 of the Terms of Service, except where Data Protection Law does not permit that.

10. Precedence and duration

This DPA applies for as long as we process Customer Personal Data on your behalf. If there is a conflict between this DPA and the rest of the Terms of Service on the processing of Customer Personal Data, this DPA prevails.

Annex 1 — Details of the processing

Subject matter: provision of managed, EU-hosted open-source applications, such as Nextcloud, WordPress, Forgejo with Woodpecker CI, PostgreSQL and Redis.

Duration: for the term of the subscription, plus the 30-day retention window in clause 7.

Nature and purpose: hosting, storage, transmission, backup, security monitoring, maintenance and support of the customer's instance, carried out on the customer's instructions.

Types of personal data: whatever the customer chooses to put into the Service. Typically: names, email addresses, contact details, usernames, documents and files and their contents, calendar and contact records, website content and comments, source code and repository content, and database contents. For WordPress sites, also visitor IP addresses and log data.

Categories of data subjects: the customer's own staff and users, and their clients, contacts, members, correspondents and website visitors.

Special category data: not expected. Not to be processed without prior written notice to us under clause 2.

Annex 2 — Technical and organisational measures

Access control

• Administrative access is limited to authorised personnel of Perch and is granted on a need-to-know basis.
• Administrative accounts use strong, unique credentials.
• Access to infrastructure providers' consoles is restricted to the same personnel.

Encryption

• All data in transit between users and customer instances is encrypted using TLS, with certificates managed and renewed automatically.
• Backups are encrypted.

Separation

• Each customer's instance runs on its own virtual server, separate from every other customer's, with its own application, database and credentials.

Resilience and backups

• Backups of customer instances are taken daily and retained for 7 days.

No tracking

• No analytics, advertising or third-party tracking technology is used in the Perch Platform application or website. The application sets one strictly necessary authentication cookie (perch_refresh_token, HttpOnly, Secure, SameSite=Lax, scoped to the auth path, 7 days) and stores one non-personal interface preference in local storage; the perchplatform.com website stores one non-personal theme preference in local storage.

Perch Platform Limited, registered in Ireland, company number 801020. Registered office: Middlequarter, Newcastle, Clonmel, Co. Tipperary, E91 CD71.