Resolvo Cloud

Data Processing Agreement

Last updated: 29 September 2026

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between Resolvo Cloud, registered in the Kingdom of Norway with organisation number 931 915 711 and registered address Etterstadsletta 45A, 0660 Oslo, Norway (“Resolvo Cloud”, “Processor”), and the customer using our services (“Customer”, “Controller”).

This DPA applies whenever Resolvo Cloud processes personal data on behalf of the Customer in connection with the services, and sets out the terms required by Article 28 of the General Data Protection Regulation (EU) 2016/679 (“GDPR”), as incorporated into Norwegian law by the Personal Data Act (personopplysningsloven).

By accepting the Terms of Service, the Customer also accepts this DPA. No separate signature is required.

1. Definitions

Terms such as “personal data”, “processing”, “controller”, “processor”, “data subject”, “personal data breach” and “supervisory authority” have the meanings given in the GDPR.

• Customer Data: Personal data that the Customer or its end users store on, upload to, or transmit through the services, including data on servers, websites, databases, email accounts, containers and backups.
• Subprocessor: A third party engaged by Resolvo Cloud that processes Customer Data on behalf of the Customer.

2. Roles and Scope

• The Customer is the controller of Customer Data. Resolvo Cloud is the processor.
• Resolvo Cloud acts as an independent controller for the account, billing, security and support data it collects about the Customer itself. That processing is described in our Privacy Policy and is not covered by this DPA.
• This DPA remains in force for as long as Resolvo Cloud processes Customer Data.

3. Details of Processing

Item	Description
Subject matter	Provision of hosting, cloud server, container, dedicated server, colocation, domain, email and related services.
Duration	The term of the Customer’s services, plus the deletion period in Section 11.
Nature and purpose	Storage, hosting, transmission, backup, restoration and technical support, solely to provide the services.
Categories of data subjects	Determined by the Customer. Typically the Customer’s employees, customers, end users and website visitors.
Categories of personal data	Determined by the Customer. May include contact details, account credentials, IP addresses, log data and any other data the Customer chooses to store.
Special categories	Resolvo Cloud does not require special category data. If the Customer stores such data, the Customer is responsible for ensuring the services are appropriate for it.

4. Processor Obligations

Resolvo Cloud will:

• Process Customer Data only on the Customer’s documented instructions. The Terms of Service, this DPA and the Customer’s use and configuration of the services constitute those instructions.
• Promptly inform the Customer if, in its opinion, an instruction infringes the GDPR or other data protection law.
• Not process Customer Data for its own purposes, and not sell Customer Data.
• Ensure that personnel authorised to access Customer Data are bound by confidentiality obligations.
• Not access the contents of Customer Data except where necessary to provide the services, provide support requested by the Customer, maintain security, or comply with law.

5. Customer Obligations

The Customer will:

• Ensure it has a lawful basis for the processing and has provided any required notices to data subjects.
• Be responsible for the security of everything it controls, including operating systems, applications, credentials, firewall rules and access controls on its services.
• Ensure its instructions comply with applicable law.

6. Security Measures

Resolvo Cloud implements appropriate technical and organisational measures under Article 32 GDPR, including:

• Physical access controls at data centre facilities.
• Encryption of data in transit for the website, panel and APIs.
• Logical isolation between customer environments.
• Role-based, least-privilege access to infrastructure for authorised personnel only.
• Multi-factor authentication options for customer accounts.
• Network protection, including DDoS mitigation and monitoring.
• Regular patching and security review of the underlying infrastructure.

Resolvo Cloud may update these measures, provided the overall level of protection is not reduced.

7. Subprocessors

The Customer gives general authorisation for Resolvo Cloud to engage subprocessors. Resolvo Cloud will:

• Impose data protection obligations on each subprocessor that are no less protective than this DPA.
• Remain liable to the Customer for the performance of its subprocessors.
• Update the list below at least 30 days before a new subprocessor begins processing Customer Data.

The Customer may object to a new subprocessor on reasonable data protection grounds by emailing legal@resolvocloud.com (opens in new tab) within that 30-day period. If the parties cannot resolve the objection, the Customer may terminate the affected services and receive a refund of the unused prepaid period, as described in the Terms of Service.

Subprocessors

Infrastructure subprocessors that may process Customer Data:

Subprocessor	Purpose	Location
Data centre facility operator	Physical hosting, power, cooling and connectivity	United Kingdom
Data centre facility operator	Physical hosting, power, cooling and connectivity	Norway

Service providers that process account, billing or website visitor data (Resolvo Cloud as controller, see our Privacy Policy):

Provider	Purpose	Location
Stripe Payments Europe, Ltd.	Payment processing, including PayPal payments through Stripe	Ireland / United States
Google Ireland Limited (Google reCAPTCHA)	Bot and abuse protection on sign-in, registration and checkout	Ireland / United States
Google Ireland Limited (Google Analytics)	Website usage statistics, only after visitor consent	Ireland / United States
Registrar partner and domain registries	Domain registration, renewal and transfer	Varies by domain extension

Integrations the Customer enables, such as Discord notifications, send data to the third party at the Customer’s request. These providers are not subprocessors of Resolvo Cloud.

8. International Transfers

Customer Data is hosted in the location of the services the Customer selects. Resolvo Cloud will not transfer Customer Data outside the European Economic Area (“EEA”) unless a lawful transfer mechanism is in place, such as:

• An adequacy decision by the European Commission, including the decision for the United Kingdom.
• The EU-U.S. Data Privacy Framework, for certified recipients.
• Standard Contractual Clauses approved by the European Commission.

9. Assistance to the Customer

Taking into account the nature of the processing, Resolvo Cloud will provide reasonable assistance to the Customer with:

• Responding to data subject requests. If Resolvo Cloud receives a request directly, it will forward it to the Customer and will not respond itself unless legally required.
• Data protection impact assessments and prior consultations with supervisory authorities.
• Its security obligations under Article 32 GDPR.

Resolvo Cloud may charge a reasonable fee for assistance that goes beyond the standard features of the services.

10. Personal Data Breaches

Resolvo Cloud will notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Data. The notification will include, to the extent known:

• The nature of the breach, and the categories and approximate number of data subjects and records concerned.
• The likely consequences of the breach.
• The measures taken or proposed to address the breach and mitigate its effects.
• A contact point for further information.

This allows the Customer to meet its own obligation to notify the supervisory authority within 72 hours under Article 33 GDPR. Notification is not an acknowledgement of fault or liability.

11. Return and Deletion

• During the term, the Customer can export its Customer Data using the standard features of the services.
• After the services end, Resolvo Cloud will delete Customer Data, including backups, within 30 days, unless retention is required by law.
• The Customer is responsible for exporting any data it wishes to keep before the services end.

12. Audits

• Resolvo Cloud will make available the information reasonably necessary to demonstrate compliance with this DPA.
• If that information is insufficient, or where required by a supervisory authority, the Customer may carry out an audit, at its own cost, with at least 30 days’ written notice, during normal business hours, no more than once per year, and subject to confidentiality obligations.
• Audits must not compromise the security of the services or the data of other customers.

13. Liability

Each party’s liability under this DPA is subject to the limitations of liability in the Terms of Service, except where such limitations are not permitted by law.

14. Order of Precedence

If there is a conflict between this DPA and the Terms of Service regarding the processing of Customer Data, this DPA prevails.

15. Governing Law

This DPA is governed by the laws of the Kingdom of Norway. Disputes are subject to the jurisdiction set out in the Terms of Service.

16. Changes to this DPA

Resolvo Cloud may update this DPA to reflect changes in law or in the services. Material changes that reduce the protection of Customer Data will be notified to the Customer at least 30 days in advance. The “Last updated” date reflects the most recent revision.

17. Contact

For questions about this DPA, contact us at legal@resolvocloud.com (opens in new tab).