Customer Data Processing Terms
Revision of: 13 August 2026
1. Subject Matter and Roles of the Parties
1.1. These Terms define how Individual Entrepreneur Lev Aleksandrovich Aminov (hereinafter — the "Provider", "Processor") processes personal data contained in Customer Data, and form an integral part of the Terms of Service (clause 15.2).
1.2. With respect to personal data contained in Customer Data, the Customer acts as the operator (controller) and the Provider as the processor acting on the Customer's instructions.
1.3. With respect to account data, payment data, Operational Data (clause 2.13 of the Agreement) and website visitor data, the Provider acts as an independent operator. The procedure for such processing is described in the Privacy Policy and is not governed by these Terms.
1.4. These Terms are drawn up taking into account the requirements of the Law of the Republic of Armenia "On Protection of Personal Data" and, for Customers subject to the General Data Protection Regulation of the European Union (GDPR, Regulation (EU) 2016/679), the requirements of Article 28 of that Regulation.
1.5. Terms not defined in these Terms are used in the meanings established by the Terms of Service.
2. Details of the Processing
2.1. Subject matter of the processing — provision of the Tuna platform Services under the Agreement.
2.2. Duration of the processing — the term of the Agreement, subject to the deletion periods established in Section 8.
2.3. Nature and purpose of the processing — storage, transmission, display and other technical processing of Customer Data necessary for the operation of the Services and for ensuring their operability and security.
2.4. Categories of data subjects are determined by the Customer and may include its employees, members of its Organization, its clients and other individuals whose data the Customer transfers to the Services.
2.5. Categories of personal data are determined by the Customer. Depending on the Services used, they may include:
| Service | What is technically processed |
|---|---|
| Tunnels and gateways | Traffic transmitted in transit between the Customer and its users; technical connection data (IP addresses, time, volume, destination addresses) |
| Webhooks, request inspector | Contents of incoming HTTP requests stored for debugging |
| Applications (Zero Trust access) | Identifiers and attributes of authenticating users, access logs |
| Bastion | User identifiers, logs and parameters of SSH sessions |
| Secrets | Configuration data of the Customer's applications in encrypted form |
| Passwords | Vault data in encrypted form; decryption keys are not transmitted to the Provider |
| Reports | Screenshots, screen recordings, technical session details of the users of the Customer's website |
| Meetings, boards | Audio and video streams, chat messages, collaboration materials |
| Monitors, status pages | Addresses of monitored resources, check results, notification contacts |
2.6. The Customer independently determines what data it transfers to the Services and does not place in them data whose processing requires protection measures not provided for by the Agreement and the documentation (clause 13.5 of the Agreement).
3. Obligations of the Provider
3.1. The Provider processes Customer Data only on the Customer's documented instructions, which are constituted by these Terms, the Agreement and the Customer's actions when using the Services.
3.2. The Provider does not use Customer Data for its own purposes, including for training machine learning models or for advertising. This clause does not restrict the processing of Operational Data, in respect of which the Provider acts as an independent controller (clause 1.3 of these Terms, clause 13.8 of the Agreement). Operational Data does not include the contents of Customer Data, nor Application access logs and Bastion session logs, which a Service maintains for the Customer and in respect of which the Provider remains a processor.
3.3. The Provider ensures that persons with access to Customer Data are bound by a confidentiality obligation.
3.4. The Provider implements organizational and technical protection measures proportionate to the risks, including:
- encryption of traffic in transit (TLS);
- encryption of sensitive data at rest;
- a zero-knowledge model for the password manager;
- access segregation and minimization of the number of persons with access to the production environment;
- access and security event logging;
- infrastructure backups and regular component updates.
3.5. The Provider promptly notifies the Customer if, in its opinion, the Customer's instruction infringes applicable data protection law.
3.6. The Provider notifies the Customer of a security breach affecting Customer Data without undue delay after becoming aware of it and provides the information the Customer needs to fulfil its own notification obligations.
3.7. The Provider provides the Customer with reasonable assistance in responding to data subject requests and in carrying out data protection impact assessments, to the extent available to the Provider given the nature of the processing.
3.8. If the Provider receives a data subject request relating to Customer Data, it does not respond to it on the merits but forwards it to the Customer.
4. Obligations of the Customer
4.1. The Customer warrants that it has a legal basis for processing the personal data it transfers to the Services, including obtaining the necessary consents and notifying data subjects.
4.2. The Customer independently ensures the exercise of data subjects' rights, the fulfilment of controller obligations and compliance with the law applicable to its activities, including notifying the competent authorities where required.
4.3. The Customer independently configures the access rights of members of its Organization, promptly revokes access for departed members and determines which data is to be masked in those Services where such functionality is provided by the documentation.
4.4. The Customer independently determines and observes the retention periods for the data it places in the Services, within the technical capabilities provided by the documentation.
5. Engagement of Sub-processors
5.1. The Customer grants the Provider general authorization to engage sub-processors for the provision of the Services.
5.2. The Provider concludes an agreement with each sub-processor imposing data protection obligations no less strict than those set out in these Terms, and is responsible for the actions of sub-processors as for its own.
5.3. As of this revision, the following categories of sub-processors are engaged:
| Category | Purpose | Location |
|---|---|---|
| Hosting and network infrastructure providers | Hosting of platform servers, tunnel and monitoring nodes, and databases | Russian Federation, Germany, the Netherlands and other countries listed in the Regions section |
| Functional Software, Inc. (Sentry) | Application error monitoring | USA |
5.4. The current list of regions available for tunnel connections and monitoring checks is published in the Regions section and changes as the infrastructure evolves. The Customer selects the region itself when starting a tunnel or configuring a monitor and takes this into account when working with data containing personal data.
5.5. The introduction of a new region whose use the Customer selects itself does not constitute a change to the list of sub-processors and does not require notification under clause 5.6, since processing in such a region begins by the Customer's own decision.
5.6. The Provider notifies the Customer of changes to the list of sub-processors affecting the processing of Customer Data regardless of the Customer's choice (in particular, when platform servers and databases are relocated) through the Personal Account or by email at least 14 calendar days in advance. If the Customer reasonably objects to a new sub-processor, it may terminate the Agreement before the change takes effect; in this case the unused portion of the paid Subscription is refunded on a pro rata basis.
6. Cross-Border Transfers
6.1. Customer Data is processed on infrastructure located in the Russian Federation, Germany and the Netherlands, and, as regards error monitoring, in the United States. The list of countries changes as new regions are introduced; the current list is published in the Regions section.
6.2. For data subjects located in the European Economic Area, transfers to countries not recognized by the European Commission as providing an adequate level of protection are carried out on the basis of standard contractual clauses.
6.3. A Customer subject to data localization requirements independently determines whether the use of a particular region and Service is permissible.
7. Disclosure to Authorities
7.1. The Provider discloses Customer Data to authorities only on the basis of an official request made in accordance with the law, and only to the extent necessary to comply with legal requirements.
7.2. Unless prohibited by law, the Provider notifies the Customer of a received request before complying with it.
8. Return and Deletion of Data
8.1. During the term of the Agreement, the Customer independently manages its data and may delete and export it using the tools provided by the documentation.
8.2. After termination of the Agreement or deletion of the account, Customer Data is deleted within no more than 30 calendar days, except for data that must be retained under legal requirements.
8.3. Database backups are retained for no more than 30 days from creation and are deleted at the end of the rotation period.
8.4. Technical logs containing connection metadata are retained for no more than 90 days and are used for security, diagnostics and handling abuse reports.
9. Demonstrating Compliance
9.1. Upon the Customer's written request, the Provider provides the information necessary to demonstrate compliance with these Terms.
9.2. Such a review is carried out no more than once every 12 months, except where it is required by a competent authority or prompted by a confirmed security breach. The parties agree the format and timing of the review in advance; the review must not compromise the confidentiality of other clients' data or the operation of the platform.
10. Liability and Changes to the Terms
10.1. The parties' liability under these Terms is limited as set out in Section 19 of the Terms of Service.
10.2. The Provider may amend these Terms in accordance with Section 22 of the Terms of Service. The current revision is published at /dpa/ with the date indicated.
10.3. For Customers that require a signed data processing agreement on paper or as an electronic document, such an agreement is concluded upon request to info@tuna.am.