OneBucket Data Processing Addendum
This Data Processing Addendum ("DPA") is part of the OneBucket Terms of Service between Attimis Corporation, a Delaware corporation ("Attimis"), and you. It applies to personal information about other people, such as your app's users, in the data you store or process through OneBucket ("Customer Personal Data").
1. Roles and instructions
You are the controller (or "business") and Attimis is your processor (or "service provider") under US state privacy laws, including the California Consumer Privacy Act. Attimis processes Customer Personal Data only to provide, secure and support OneBucket, on your instructions: the Terms, this DPA, and the storage providers, regions and plugins you choose. It will tell you if it believes an instruction breaks the law.
2. Restrictions
Attimis will not sell or share Customer Personal Data, use it for targeted advertising or to train AI models, use it for any other purpose, or combine it with other data except as the law allows for service providers. It will tell you if it can no longer meet these obligations, and you may then take reasonable steps to stop any unauthorized use. Attimis certifies that it understands and will follow these restrictions.
3. Providers and plugins
Storage and compute providers you choose, such as Wasabi, Datum and AWS ("Providers"), aren't Attimis subprocessors. You hold your own accounts with them and contract with them directly, including under any free promotion, and their handling of your data is governed by your agreements with them, not this DPA. Attimis isn't responsible for Providers or the data they hold or process. Attimis uses your Provider credentials only to provide OneBucket and deletes them when you disconnect.
Plugins you turn on run on compute in your own Provider account, such as Datum, process data on your instructions and may not produce complete results; PII redaction doesn't guarantee all personal information is removed. Datum's separate role in running the OneBucket service and its network is covered in section 5.
4. Confidentiality and security
Staff who process Customer Personal Data are bound by confidentiality, and only those who need access have it. Attimis protects the data with appropriate measures, including encryption in transit, least-privilege access with MFA, logging and monitoring, and an incident response plan. You're responsible for your account, keys, bucket settings and backups.
5. Subprocessors
You authorize the subprocessors listed at onebucket.io/subprocessors, currently Datum, DigitalOcean, Oracle Cloud Infrastructure, OVHcloud and Servers.com, which run the OneBucket service and its network. Each is bound by a written contract at least as protective as this DPA, and Attimis remains responsible for them. Attimis gives at least 30 days' notice of new subprocessors; you may object on reasonable data-protection grounds and, if unresolved, close the affected service with a refund of unused prepaid fees. Providers you choose aren't subprocessors (section 3).
6. Security incidents
Attimis will notify you without undue delay, and within 72 hours of confirming an incident affecting Customer Personal Data, including one reported to it by a subprocessor, with the information you need for your own notices.
7. Assistance and audits
Attimis will reasonably help you respond to privacy requests (forwarding any it receives about your data), carry out assessments, and meet security and breach-notice duties. Once a year, or after an incident, it will provide information showing it complies with this DPA, or allow a reasonable assessment at your cost with 30 days' notice.
8. Deletion
After your account ends and the 30-day retrieval period in the Terms passes, Attimis deletes Customer Personal Data within 30 days, and from backups as they are overwritten, unless the law requires keeping it. It will confirm deletion on request.
9. Your responsibilities
You confirm you have given the notices and obtained the consents the law requires, and that you won't store HIPAA-protected health information or other data the Terms prohibit.
10. General
Customer Personal Data is kept in the United States. Requests to OneBucket endpoints in the United Kingdom, Germany and Singapore pass through servers there, which may hold temporary configuration for up to 24 hours. Data in your Provider accounts stays in the regions you choose. Liability under this DPA is subject to the limits in the Terms, as one total. If this DPA conflicts with the Terms about Customer Personal Data, this DPA governs.
Questions: support@attimis.co.