Data Processing Agreement

1. Overview

This DPA governs the processing of personal data by Macyou on behalf of its customers in connection with the provision of dedicated Apple Mac Mini M4 Pro cloud servers. It is designed to meet the requirements of Article 28 of Regulation (EU) 2016/679 (the “GDPR”) and applies wherever Macyou processes personal data on behalf of a customer who acts as a data controller.

This DPA supplements and is incorporated into our Terms of Service and Privacy Policy.

2. Scope

In the context of this DPA, Macyou acts as a data processor, and you (the customer) act as the data controller for personal data that you or your end-users store, process, or transmit on your dedicated Macyou servers.

Macyou does not determine the purposes or means of processing your end-users' personal data and processes it only on your documented instructions, which the Terms of Service and this DPA constitute.

This DPA does not apply to data that Macyou processes as a data controller in its own right (e.g., your account registration data, billing information), which is governed by our Privacy Policy.

3. Processing Details

Types of Personal Data

The types of personal data processed depend on the applications and services you run on your Macyou server. This may include but is not limited to: names, email addresses, IP addresses, device identifiers, location data, financial data, health data, or any other personal data your applications collect from your end-users.

Categories of Data Subjects

Data subjects may include your end-users, customers, employees, contractors, partners, or any other individuals whose personal data is processed on your Macyou server.

Duration of Processing

Macyou will process personal data for the duration of your subscription. Upon termination of your account, data will be handled in accordance with Section 7 (“Macyou's Obligations”) regarding deletion and return.

Nature and Purpose of Processing

The nature of processing is the provision of dedicated cloud hosting infrastructure. Macyou provides the physical hardware, network connectivity, power, and environmental controls necessary for you to run your applications. The purpose of processing is to enable you to operate your software and services on dedicated Mac Mini hardware.

4. Macyou's Obligations

As a data processor, Macyou commits to the following obligations under Article 28 GDPR:

• Processing on documented instructions — Macyou will process personal data only on your documented instructions, unless required to do so by applicable law. If such a legal requirement arises, Macyou will inform you before processing (unless prohibited by law).
• Confidentiality — all Macyou personnel who have access to personal data are bound by contractual obligations of confidentiality and have received appropriate training on data protection.
• Security measures — Macyou implements and maintains appropriate technical and organizational measures to protect personal data against unauthorized access, loss, destruction, or alteration, as detailed in Section 7.
• Sub-processor management — Macyou will not engage a sub-processor without your prior general authorization. We will notify you of any intended changes to sub-processors, giving you the opportunity to object, as detailed in Section 5.
• Assistance with data subject requests (DSARs) — Macyou will assist you, insofar as technically possible and by appropriate technical and organizational measures, in fulfilling your obligations to respond to data subject access requests and other rights under the GDPR (access, rectification, erasure, portability, restriction, objection).
• Deletion or return after termination — upon termination of your subscription, Macyou will, at your choice, delete or return all personal data and delete existing copies, unless applicable law requires retention. Erasure is completed within 30 days of account termination by the process set out in the Terms of Service.
• Audit rights— Macyou will make available the information necessary to demonstrate compliance with Article 28 GDPR. Macyou may satisfy this obligation by providing existing audit reports, certifications or security documentation. Where that is insufficient, you may conduct an audit no more than once in any twelve (12) month period, at your own cost, during business hours, on thirty (30) days' prior written notice, subject to confidentiality obligations and to reasonable measures to avoid disruption of the service or access to other customers' data. An auditor who is a competitor of Macyou may not be mandated. An additional audit may be conducted where required by a supervisory authority.

5. Sub-processors

Macyou uses the following sub-processors in the delivery of its services. By agreeing to this DPA, you provide general authorization for the use of these sub-processors:

Macyou will notify you by email at least 30 days before adding or replacing a sub-processor. You may object on reasonable data-protection grounds within fourteen (14) days of that notice. If the objection cannot be resolved, you may terminate the affected service on written notice; Macyou will refund any fees prepaid for the unused remainder of the then-current billing period, and that refund is your sole remedy for the objection.

6. International Transfers

Where personal data is transferred outside the European Economic Area (EEA), the United Kingdom, or Switzerland, Macyou ensures that appropriate safeguards are in place:

6.1 Customer (Controller) to Macyou (Processor) — transfer to Georgia

Macyou LLC is established in Georgia, which is not currently the subject of an EU adequacy decision under GDPR Article 45. Where the Customer is established in the EEA, the United Kingdom, or Switzerland and Macyou processes personal data on the Customer's behalf at the Tbilisi, Georgia data center or in support systems operated under Georgian law, this DPA incorporates by reference the European Commission's Standard Contractual Clauses set out in Commission Implementing Decision (EU) 2021/914 of 4 June 2021, Module 2 (Controller → Processor), with:

• the Customer as data exporter and Macyou LLC as data importer;
• the docking clause (Clause 7) selected (the SCCs may be acceded to by additional parties);
• Option 2 of Clause 9(a) selected — general written authorisation for sub-processors with the notice mechanism described in Section 5;
• Option 1 of Clause 17 selected — the SCCs are governed by the law of the EU Member State in which the data exporter is established (or, where that law does not allow third-party beneficiary rights, the law of Ireland);
• Clause 18 — the competent supervisory authority is the authority of the EU Member State in which the data exporter is established.

For personal data subject to the UK GDPR, the UK Addendum to the EU Standard Contractual Clauses (version B1.0) issued by the UK Information Commissioner's Office under section 119A(1) of the Data Protection Act 2018 is incorporated and amends the SCCs accordingly. For Swiss personal data, the SCCs are read with the modifications published by the Swiss Federal Data Protection and Information Commissioner (FDPIC).

Annexes I, II, and III of the SCCs are completed in the Annex section of the executable DPA PDF available at Macyou DPA (PDF).

6.2 Macyou to Sub-processors

Macyou has executed the European Commission's Standard Contractual Clauses (Module 2: Controller → Processor, and Module 3: Processor → Processor as applicable) with all sub-processors located outside the EEA that process personal data. Where applicable, transfers may also be made to countries that the European Commission has determined provide an adequate level of data protection (e.g., the EU-U.S. Data Privacy Framework).

6.3 Transfer Impact Assessment

Macyou maintains a transfer impact assessment covering the Georgian legal environment, the technical and organisational measures in Section 7, and the contractual commitments in this DPA. A summary is available on request to privacy@macyou.co.

Macyou will inform you if it becomes aware that it or a sub-processor is unable to comply with the transfer safeguards described above, as required by the Standard Contractual Clauses.

7. Security Measures

Macyou implements the following technical and organizational measures to protect personal data processed on our infrastructure:

• Encryption at rest — credentials held by Macyou are encrypted with AES-256-GCM, and the internal storage of each machine is hardware-encrypted by Apple Silicon. As sole system administrator of your machine, you are responsible for any further encryption of your own content.
• Encryption in transit — all network communications are encrypted using TLS 1.3. Older TLS versions (1.0, 1.1) are disabled.
• Access controls — Macyou employs strict role-based access controls (RBAC) for all internal systems. Administrative access to customer infrastructure requires multi-factor authentication and is logged.
• Monitoring & logging — Macyou maintains infrastructure monitoring and audit logs of administrative actions. Retention periods are set out in the Privacy Policy.
• Physical security — machines are housed in a facility with physical access controls and environmental protection.
• Incident response — Macyou maintains an incident response process.

8. Breach Notification

In the event of a personal data breach (as defined in Article 4(12) GDPR), Macyou will notify you without undue delay after becoming aware of it. To the extent the information is available to Macyou, the notification will describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the measures taken or proposed to address it, and a point of contact. Information not available at the time of notification may be provided in phases as it becomes available.

Macyou will provide reasonable assistance, at your cost, with your own notification obligations under Articles 33 and 34 GDPR. Notification under this Section is not an acknowledgement of fault or liability.

9. How to Execute This DPA

To enter into this DPA with Macyou, download the pre-signed PDF version, counter-sign it, and return the executed copy to us by email.

Send your counter-signed DPA to legal@macyou.co. Macyou will return a fully executed copy for your records.

10. Contact

For questions, concerns, or requests related to this DPA or data protection matters, please contact us:

Also see our Terms of Service, Privacy Policy, and DMCA & Takedown Policy.