Data Processing Agreement
Last updated: 5 October 2026
This Data Processing Agreement ("DPA") is entered into between:
- Bernhard van Staveren, EI, trading as Bearded Dutchman Services and operating the service peedee.es, SIREN 922 817 093, registered at 49c rue Saint-Georges, 71100 Chalon-sur-Saone, France (the "Processor");
and
- the customer who has subscribed to a peedee.es PDS hosting offering (the "Client" or "Controller").
This DPA is incorporated by reference into peedee.es's Terms of Service and forms an integral part of them. It applies to the Processor's processing of personal data belonging to the Client's own end users (the people holding an account on the Client's PDS instance) - it does not cover the Client's own data as a peedee.es customer (billing, subscriber identity), which is governed by peedee.es's Privacy Policy, under which peedee.es is itself the controller.
1. Subject matter and duration
The Processor processes personal data on behalf of the Client in connection with providing hosting for one or more AT Protocol personal data server ("PDS") instances. Processing continues for the duration of the Client's subscription, until termination or deletion of data under Section 7 below.
2. Nature and purpose of processing
- Nature: hosting, storage, provisioning, and the automated technical processing necessary to operate a PDS (account creation, authentication, and storage of content, media and metadata).
- Purpose: to allow the Client to operate a service, for its own end users, compliant with the AT Protocol (accounts, identities, content), without the Processor making any decisions about those end users (account creation, suspension, or deletion remain the Client's decisions).
Processing outside this DPA: checking the media uploaded to the Client's PDS instances against known child sexual abuse material, and quarantining matching files, is carried out by the Processor for its own purposes as a hosting provider, and applies to every PDS instance it hosts. For that processing the Processor acts as an independent controller, not on the Client's instructions; it is described in peedee.es's Privacy Policy and Terms of Service. The Processor informs the Client when it quarantines a file on the Client's PDS instance.
3. Categories of data subjects
End users holding an account on the Client's PDS instance (the "End Users").
4. Categories of personal data processed
| Data | Nature |
|---|---|
| Email address | Personal, non-public |
| First name, last name (where provided) | Personal, non-public |
| DID (AT Protocol identifier) | Personal, publicly resolvable by nature of the protocol |
| Handle (AT Protocol identifier/username) | Personal, public by nature of the protocol |
| Avatar and other uploaded media | Personal, public by nature of the protocol (where set) |
| Repository content (posts, follows, and other records) | Personal where it relates to an identifiable person, public by nature of the protocol |
| Connection data (IP addresses, request metadata) in operational logs | Personal, non-public, kept for 3 days |
Note on the public nature of the DID/handle/avatar: by construction of the AT Protocol, these elements are resolvable and publicly accessible as soon as an account exists - this is not a choice the Processor makes to expose them, but an intrinsic characteristic of the service the Client is asking to have hosted. This remains personal data under the GDPR regardless (an identifier relating to an identifiable natural person), and does not exempt either the Client or the Processor from their respective obligations - the public nature of the data is relevant to assessing the severity of an incident (Section 5(g)), not to whether it qualifies as personal data at all.
Note on connection data and identification records: the Processor keeps End Users' connection data (such as IP addresses) only in operational logs, which are deleted after 3 days. Specific entries may be kept longer only where needed to investigate an outage or security incident, and only for as long as that investigation requires. The Processor keeps no record identifying the authors of content hosted on the Client's PDS instance, and does not give the Client access to its operational logs, for security reasons. Any obligation under applicable law to retain data identifying the authors of content, including under the French Law No. 2004-575 of 21 June 2004 on confidence in the digital economy (LCEN) and its implementing decrees, rests with the Client as the provider of the service to its End Users.
5. Processor obligations
In accordance with Article 28(3) GDPR, the Processor undertakes to:
a. Process personal data only on documented instructions from the Client, including with regard to transfers to a third country, unless required to do otherwise by Union or Member State law;
b. Ensure confidentiality: anyone authorized to process data in the course of operating the service commits to confidentiality;
c. Implement the security measures required by Article 32 GDPR, proportionate to the risk - at minimum: encryption of communications, network isolation of PDS instances, redundant storage, and access logging. The Processor does not take backups or other copies of PDS instances;
d. Respect the conditions for engaging a further sub-processor (see Section 6 below);
e. Assist the Client, to the extent possible given the nature of processing, in responding to End Users' requests to exercise their rights (access, rectification, erasure, portability);
f. Assist the Client in complying with its obligations under Articles 32 to 36 GDPR (security, breach notification, impact assessment, prior consultation), taking into account the nature of processing and the information available to the Processor;
g. Notify the Client without undue delay after becoming aware of a personal data breach affecting End Users' data;
h. Delete or return all data at the end of the service, at the Client's choice, in accordance with Section 7;
i. Make available to the Client all information necessary to demonstrate compliance with this DPA, and allow for reasonable audits, subject to reasonable notice and the confidentiality of the Processor's other customers.
6. Sub-processors
The Client authorizes the Processor to engage the following sub-processors, for the purposes stated:
| Sub-processor | Purpose | Location |
|---|---|---|
| Cyso BV (Wognumsebuurt 3, 1817 BH Alkmaar, Netherlands) | Hosting of the server infrastructure (compute, storage) on which the Client's PDS instances run | Netherlands (EU) |
| Cloudflare, Inc. (101 Townsend Street, San Francisco, CA 94107, USA) | Object storage (Cloudflare R2) for media uploaded to the Client's PDS instances | Data at rest in the EU (R2 EU jurisdiction); transfers covered by Standard Contractual Clauses and the EU-US Data Privacy Framework |
| Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany) | Hosting of the outgoing mail relay that delivers email sent by the Client's PDS instances (e.g. account confirmation, password reset) | European Union |
Stripe (payment processing) is not a sub-processor under this DPA: Stripe only processes the Client's own billing data as a peedee.es customer, never End User data covered here. Processing of the Client's payment data is governed by peedee.es's Privacy Policy and, where applicable, Stripe's own terms as an independent controller for that activity.
The Canadian Centre for Child Protection (Arachnid Shield) is likewise not a sub-processor under this DPA: media is checked through it as part of the Processor's own processing as an independent controller (see Section 2).
The Processor will inform the Client of any intended change concerning the addition or replacement of a sub-processor, giving the Client the opportunity to object on legitimate grounds.
7. Data on termination
- Return: for the duration of the service, the Client and its End Users can export the relevant PDS instance's repositories and media in the AT Protocol's standard formats (CAR repository archives and raw blobs) through the instance's own export endpoints. When the service is restricted for non-payment or for a breach of the Processor's Terms of Service, the instance stays online in read-only mode, in which signing in, export and account migration to another provider remain available; after a cancellation for non-payment it stays in that mode for 14 days before deletion. The Processor does not produce exports by other means.
- Deletion: when the Client cancels the service, the Processor
permanently deletes the data as soon as the cancellation takes effect,
except stored media files (blobs), which are erased from the
Processor's storage sub-processor within 3 days of that deletion;
it is the Client's responsibility to inform its End Users beforehand
and give them the opportunity to export or migrate. In all other cases
- at the end of the non-payment timeline, or on explicit request - the Processor permanently deletes the data within a reasonable period not exceeding 90 days, unless a longer legal retention obligation applies. The Processor's Terms of Service state the specific timelines that apply to non-payment.
- Quarantined media: files the Processor has quarantined, and its records of media checks, are held by the Processor as an independent controller (Section 2) and are governed by peedee.es's Privacy Policy; quarantined files are deleted with the rest of the PDS instance's data unless the law or a competent authority requires the Processor to preserve them.
8. Liability
Each party is responsible for its own breaches of the GDPR arising from its respective role (Controller for the Client, Processor for the Processor).
9. Governing law
This DPA is governed by French law.