Standard terms under which Standard Compute processes personal data on behalf of its business customers, under the GDPR and the UK GDPR.
This Data Processing Agreement ("DPA") forms part of the agreement between Standard Compute AS, org. no. 938 498 806, Oslo, Norway ("Standard Compute", "Processor") and the customer ("Customer", "Controller") for the use of the Standard Compute services (the "Agreement").
These are our standard terms and the starting point for each customer. They can be adapted to your requirements, and the signed version is the one that applies.
To sign it or request changes, email contact@standardcompute.com. We send a copy for signature, normally the same day.
1.1"Data Protection Law" means the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, the Norwegian Personal Data Act, and other data protection laws applicable to the processing.
1.2"Customer Content" means prompts, inputs, files, tool data and model outputs submitted to or returned by the services. "Customer Personal Data" means personal data in Customer Content or account data processed by Standard Compute on the Customer's behalf.
1.3Terms such as "controller", "processor", "personal data breach" and "data subject" have the meanings given in Data Protection Law.
1.4The Customer is the controller and Standard Compute is the processor of Customer Personal Data. Details of the processing are set out in Annex 1.
2.1Standard Compute processes Customer Personal Data only on the Customer's documented instructions, including the Agreement, this DPA and the Customer's settings in the service (such as region rules and provider allow-lists), unless required otherwise by law. In that case Standard Compute will inform the Customer before processing, unless the law prohibits it.
2.2Standard Compute will inform the Customer if, in its opinion, an instruction infringes Data Protection Law.
3.1No training. Standard Compute will not use Customer Content to train, fine-tune or otherwise improve any artificial intelligence model. It will not permit its sub-processors to do so.
3.2No retention. Standard Compute processes Customer Content transiently, in memory, for the purpose of fulfilling each request. It does not write Customer Content to persistent storage or logs.
3.3Inference providers. For workspaces under a region rule or provider allow-list, Standard Compute routes Customer Content only to inference endpoints that commit to no training and zero data retention. Transient caching strictly necessary to perform inference is permitted.
3.4Metadata. Standard Compute retains request metadata (such as time, key identifier, model, serving provider, token counts, cost and status) and account data as needed to provide, bill and secure the service. Metadata does not include Customer Content.
4.1Standard Compute ensures that personnel authorised to process Customer Personal Data are bound by confidentiality obligations and have access only as needed.
4.2Standard Compute implements and maintains the technical and organisational measures in Annex 2. It may update these measures, provided the overall level of protection is not reduced.
5.1The Customer gives general authorisation for Standard Compute to engage the sub-processors listed in Annex 3.
5.2Standard Compute will give at least 14 days' written notice before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds within that period. The parties will then discuss in good faith. If no solution is found, the Customer may terminate the affected services and receive a pro-rata refund of prepaid fees.
5.3Where the Customer has configured a provider allow-list, Standard Compute will not route Customer Content to an inference provider that is not on that list.
5.4Standard Compute imposes data protection obligations on its sub-processors that are no less protective than this DPA, to the extent applicable to the service provided. It remains responsible to the Customer for its sub-processors' performance.
6.1Where the Customer configures a region rule, Standard Compute processes Customer Content only in the selected region, as described in Annex 1.
6.2Where Customer Personal Data is transferred outside the EEA or the UK to a country without an adequacy decision, the transfer is governed by the EU Standard Contractual Clauses and, for UK data, the UK International Data Transfer Addendum, or another valid transfer mechanism.
7.1Standard Compute will notify the Customer without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data.
7.2The notice will describe, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, likely consequences, and measures taken or proposed. Standard Compute will provide further information as it becomes available and will not delay notice to complete its investigation.
7.3Standard Compute will take reasonable steps to contain and remediate the breach and will cooperate with the Customer in meeting its own notification obligations.
8.1Taking into account the nature of the processing, Standard Compute will assist the Customer with data subject requests, data protection impact assessments and prior consultations with supervisory authorities.
8.2Standard Compute will promptly forward to the Customer any data subject request it receives relating to Customer Personal Data.
9.1Standard Compute will make available the information reasonably necessary to demonstrate compliance with this DPA. This includes completing the Customer's security questionnaire once per year and sharing available third-party audit reports or certifications.
9.2If that information is not sufficient, the Customer may carry out an audit, by itself or through an independent auditor bound by confidentiality, no more than once in any 12-month period. The Customer must give at least 30 days' written notice, except where a supervisory authority requires otherwise or following a personal data breach. Audits are conducted during business hours and with minimal disruption.
10.1Customer Content is not retained (section 3). On termination of the Agreement, Standard Compute will delete or return all other Customer Personal Data within 30 days, unless retention is required by law. Data held in backups is deleted in the normal backup cycle and kept protected until then.
11.1This DPA remains in force for as long as Standard Compute processes Customer Personal Data under the Agreement.
11.2Liability under this DPA is subject to the limitations in the Agreement, except where Data Protection Law provides otherwise.
11.3If this DPA conflicts with the Agreement, this DPA prevails for matters of data protection. If the Standard Contractual Clauses apply and conflict with this DPA, the Standard Contractual Clauses prevail.
11.4This DPA is governed by Norwegian law, with Oslo District Court as the agreed venue, unless the Standard Contractual Clauses or Data Protection Law require otherwise.
The authorised sub-processors are listed on the Sub-processors page in force at signature, as updated under section 5.