Data Processing Addendum

How Node Lodge processes personal data in your workloads as your processor: instructions, security, sub-processors, breaches, transfers and SCCs.

1. Scope and acceptance

1.1. This Data Processing Addendum (“DPA”) forms part of the Terms of Service between Vision Digitale TI Inc. (“VDTI”, “Processor”) and the Business Customer (“Customer”, “Controller”).

1.2. It applies when VDTI processes Customer Personal Data on the Customer’s behalf and a Data Protection Law applies to that processing. “Data Protection Law” means, as applicable: the GDPR (Regulation (EU) 2016/679); the UK GDPR and the UK Data Protection Act 2018; the Swiss Federal Act on Data Protection; Québec’s Act respecting the protection of personal information in the private sector; Canada’s Personal Information Protection and Electronic Documents Act; and US state privacy laws, including the California Consumer Privacy Act.

1.3. The Customer accepts this DPA by accepting the Terms. A Customer that needs a countersigned copy can ask privacy@nodelodge.com.

2. Definitions

Customer Personal Data: personal data contained in Customer Content that VDTI processes on the Customer’s behalf.
Sub-processor: a third party engaged by VDTI that may process Customer Personal Data, including Secure infrastructure partners and Community Hosts.
Personal Data Breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data, including a “confidentiality incident” under Québec law.
SCCs: the standard contractual clauses approved by Commission Implementing Decision (EU) 2021/914.
UK Addendum: the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner.

Other capitalized terms have the meaning given in the Terms or in Data Protection Law.

3. Roles

3.1. For Customer Personal Data, the Customer is the controller (or a processor acting for its own controller) and VDTI is the processor, or service provider under US state laws.

3.2. For account, billing, security and website data, VDTI is an independent controller, as described in the Privacy Policy. This DPA does not apply to that data.

4. Instructions

4.1. VDTI processes Customer Personal Data only on the Customer’s documented instructions, which are the Terms, this DPA and the Customer’s use and configuration of the Service, including the tier and country of each Session. VDTI follows other written instructions that are consistent with the Terms.

4.2. If the law requires VDTI to process Customer Personal Data otherwise, VDTI informs the Customer first, unless the law forbids it.

4.3. VDTI informs the Customer if, in its opinion, an instruction breaches Data Protection Law.

4.4. As a service provider under US state laws, VDTI does not sell or share Customer Personal Data, does not retain, use or disclose it outside the direct business relationship with the Customer or for any purpose other than providing the Service, and does not combine it with other data, except as those laws allow.

4.5. The Customer is responsible for the lawfulness of its instructions, including its legal basis, the information given to the people concerned, and the choice of tier and country. The Customer will not process on Community the categories of data listed in section 5 of the Community Service Terms.

5. Confidentiality and security

5.1. VDTI ensures that people authorized to process Customer Personal Data are bound by confidentiality.

5.2. VDTI implements the technical and organizational measures of Annex 2. It may update them, provided the overall level of protection does not decrease.

5.3. The Customer acknowledges the security characteristics of each tier described in the Secure and Community Service Terms, in particular that a Community Host keeps physical and administrator access to its machine.

6. Sub-processors

6.1. The Customer gives VDTI a general authorization to engage Sub-processors. Current Sub-processors are listed by category and country on our Sub-processors page, which forms Annex 3. Community Hosts are engaged per Session, from the pool of reviewed Hosts in the country the Customer chooses.

6.2. VDTI imposes on each Sub-processor, by written contract, data protection obligations that offer at least the same level of protection as this DPA, to the extent applicable to its service. VDTI remains liable to the Customer for its Sub-processors’ performance of those obligations.

6.3. VDTI gives at least 30 days’ notice before a new category of Sub-processor, or a Sub-processor in a new country, starts processing Customer Personal Data, by updating the Sub-processors page and its feed, and by email to Customers who subscribed. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may stop using the affected part of the Service, or end the Terms and receive a refund of unused purchased Credit.

7. Personal Data Breach

7.1. VDTI notifies the Customer without undue delay, and no later than 48 hours after becoming aware of a Personal Data Breach.

7.2. The notice describes, as far as known, the nature of the breach, the categories and approximate number of people and records concerned, the likely consequences, and the measures taken or proposed, and names a contact. VDTI supplements it as information becomes available.

7.3. VDTI records every Personal Data Breach in its incident register and assists the Customer with its own notifications.

7.4. A notice is not an admission of fault.

8. Assistance

8.1. Taking into account the nature of the processing and the information available to it, VDTI assists the Customer in answering requests from people exercising their rights, with data protection and privacy impact assessments and prior consultations, and with its security and breach obligations.

8.2. VDTI does not access Customer Content. Requests about Customer Personal Data are handled by the Customer directly on its Machines, while the Session runs.

9. International transfers

9.1. Customer Personal Data is processed in the country of the Machine the Customer chooses, shown before launch, and transits through the Session relay and the network operators between the Customer and the Machine.

9.2. EU transfers. To the extent VDTI’s processing involves a transfer of Customer Personal Data subject to the GDPR to a country without an adequacy decision, the SCCs are incorporated by reference: Module 2 where the Customer is a controller, Module 3 where it is a processor. Clause 7 applies. Under clause 9(a), option 2 applies, with the notice period of section 6.3. The optional wording of clause 11(a) does not apply. Under clauses 17 and 18, the law and courts of Ireland apply. Annex I is completed by Annex 1 of this DPA, Annex II by Annex 2, and Annex III by the Sub-processors page. Transfers to Canada rely on the adequacy decision for Canada.

9.3. UK transfers. For transfers subject to the UK GDPR, the UK Addendum applies, completed with the information of this DPA. Either party may end it as its Table 4 allows.

9.4. Swiss transfers. For transfers subject to the Swiss Federal Act on Data Protection, the SCCs apply with the adaptations the Swiss Federal Data Protection and Information Commissioner requires: the Commissioner is the competent authority, and “Member State” includes Switzerland.

9.5. Québec transfers. Before communicating Customer Personal Data outside Québec, VDTI conducts the privacy impact assessment Québec law requires for its own communications to Sub-processors, and relies on a written agreement with each of them.

10. Audits

10.1. On written request, no more than once a year, VDTI provides the information reasonably needed to demonstrate compliance with this DPA, such as a description of its measures and answers to a security questionnaire.

10.2. If that information is not sufficient, or if a supervisory authority requires it, the Customer may carry out an audit at its own cost, with 30 days’ notice, during business hours, under confidentiality, without access to other customers’ data or to Sub-processors’ facilities beyond what their own terms allow. The parties agree on its scope in advance.

11. Deletion and return

11.1. Customer Content is deleted at the end of each Session: Secure Machines and their disks are deleted at the partner and the deletion is confirmed; Community work disks are made unreadable by erasing their encryption key, then deleted. VDTI keeps no backup of Machines.

11.2. The Customer copies the data it needs before the end of each Session. VDTI keeps no Customer Personal Data after the end of a Session, except where the law requires it.

12. Liability, term and precedence

12.1. The limitations of liability of the Terms apply to this DPA, except where Data Protection Law or the SCCs do not allow it.

12.2. This DPA lasts as long as VDTI processes Customer Personal Data.

12.3. If this DPA conflicts with the Terms, this DPA prevails. If it conflicts with the SCCs or the UK Addendum, they prevail.

Annex 1. Description of the processing

Item	Description
Parties	Data exporter: the Customer. Data importer: VDTI, contact privacy@nodelodge.com
Subject matter	Virtual machines with GPUs on which the Customer runs its own workloads
Duration	Each Session, from launch to deletion of the Machine
Nature	Storage and computation on the Machine’s disk, memory and GPUs; network transfer to and from the Machine
Purpose	Running the Customer’s workloads
Data subjects	Determined by the Customer
Categories of data	Determined by the Customer. On Community, excluding the categories of section 5 of the Community Service Terms
Sensitive data	Only on Secure, and only after the Customer has assessed that the Machine and its country are suitable
Frequency	Continuous during each Session
Retention	Until the end of the Session
Competent supervisory authority	The authority of the Member State where the Customer’s EU representative or establishment is located, or Ireland by default

Annex 2. Technical and organizational measures

All Sessions

Each Session runs in a virtual machine dedicated to it, with its GPUs attached to that VM alone.
SSH access with the Customer’s public key, installed for that Session only. VDTI installs no key of its own and does not sign in.
Outbound TCP port 25 blocked.
Budget-based stop and deletion at the end of each Session; deletions confirmed and retried until confirmed; leftover machines detected and deleted.

Secure

Machines in partner datacenters with physical access control.
Firewall in front of each Machine, allowing inbound SSH only from the Customer’s IP address or range.

Community

Micro-VM per Session, jailed on the host, with the GPU passed through to it alone.
Signed, read-only system image verified block by block.
Work disk encrypted inside the VM; the key is delivered by the platform through an encrypted tunnel, never written to the host’s disk, and destroyed at the end of the Session.
No inbound port on the host; access through the Node Lodge relay.
Hosts reviewed before listing; contractual prohibition of access to Sessions; metadata-only network records for abuse handling.

Platform

Platform and database hosted in Canada; database not exposed to the internet; server administration through a private network only.
Encryption in transit for the website, console, API, agents and relay.
Passwords hashed with argon2id; tokens, links, pairing codes, API keys and recovery codes stored as hashes; authenticator secrets encrypted with AES-256-GCM.
Two-factor authentication mandatory for VDTI administrators, a recent second factor, a reason and an audit entry for every administrative change.
Session cookie HttpOnly, Secure, SameSite=Strict, restricted to our host; origin checks against cross-site requests.
API keys limited by scope, expiry, spending caps and concurrency caps.
Append-only activity log and ledger.
Logs scrubbed of passwords, cookies, authorization headers, signatures and tokens.
Daily database backups with an off-site copy in a private bucket, under a key limited to that bucket.
Incident tracking, a kill switch for new Secure launches, and a register of confidentiality incidents.

Annex 3. Sub-processors

See the Sub-processors page.