360 DataCraft Data Processing Addendum
Our data protection commitments
360 Degree Cloud Technologies LLC (USA) | 360 Degree Cloud Technologies Pvt. Ltd. (India)
- Your data stays with you. Your Salesforce data stays in your own Salesforce org, and your backups and archives are stored in your own AWS account. While a job runs, data passes through the DataCraft Platform encrypted, and is not kept.
- We keep only what we need to run the Service. That is your users’ details and the roles you assign, encrypted connection details, policy settings, and job and audit logs, plus billing details. Connection credentials are deleted within 15 days after you leave, and everything else within 30 days.
- No selling, no AI training. We never sell your data or use it to train AI models.
- 72-hour breach notice. We notify you without undue delay, and in any event within 72 hours.
- Security tested. Vulnerability assessment and penetration testing (VAPT), with the report available on request.
- Global coverage. Covers processor requirements under GDPR, UK GDPR, CCPA, FERPA and India’s DPDP Act, with EU and UK transfer clauses included.
This summary is for convenience. The Data Processing Addendum below sets out the binding terms.
Data Processing Addendum
This Data Processing Addendum (“DPA”) forms part of the agreement for 360 DataCraft between the customer that accepts the 360 DataCraft Terms of Service (“Client”) and the 360 Degree Cloud entity that Client contracts with under Section 1 of those Terms (“360 Degree Cloud”). That entity is 360 Degree Cloud Technologies LLC (USA) for Clients based in the United States or Canada, and 360 Degree Cloud Technologies Pvt. Ltd. (India) for Clients based anywhere else, unless an Order names a different entity. The agreement consists of the Terms of Service, the Order and any statements of work (the “Agreement”).
Client accepts this DPA when it accepts the Terms of Service or an Order, and no separate signature is required. If Client and 360 Degree Cloud have signed a separate data processing agreement for 360 DataCraft, that agreement prevails.
1. Definitions
- “Account Data” means the name and business email address of Client’s billing contacts, and Client’s subscription, invoice and payment records.
- “Applicable Data Protection Laws” means the privacy and data protection laws that apply to the Processing, including the CCPA and other US state privacy laws, FERPA, GLBA, the GDPR, the UK GDPR and India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”).
- “Client Environment” means Client’s own Salesforce organizations, Client’s own Amazon Web Services (“AWS”) account, and any other system or storage that Client controls or selects.
- “Operational Data” means the information the Platform stores to run the Services, as described in Section 4.3 of the Terms of Service:
- account and user details of Client’s Authorised Users, and the permissions and roles Client assigns;
- connection details for the Client Environment, such as org IDs, usernames, access tokens, bucket names, regions and access credentials;
- policy settings, such as selected objects, filters, SOQL queries and schedules; and
- job and audit logs, such as who ran which job and when, record counts, record IDs, durations and error messages.
- “Order” has the meaning given in the Terms of Service, and includes an order form, quotation, online checkout, AppExchange listing or invoice.
- “Personal Data” means personal information that 360 Degree Cloud Processes on Client’s behalf under the Agreement, including personal information within data that passes through the Platform and within Operational Data, but excluding Account Data. “Process” means any operation performed on Personal Data.
- “Platform” means the 360 DataCraft web application that 360 Degree Cloud hosts, through which Client creates, runs and monitors backup, restore, archive and file transfer jobs.
- “Security Incident” means a confirmed breach of security leading to the accidental or unlawful destruction, loss, alteration or unauthorized disclosure of, or access to, Personal Data in 360 Degree Cloud’s possession or control.
- “Services” means 360 DataCraft, including the Platform and the 360 Data Craft Salesforce package, and related implementation and support.
- “Sub-processor” means a third party engaged by 360 Degree Cloud to Process Personal Data. Salesforce, and AWS when used under Client’s own AWS account, are platforms Client contracts with directly and are not Sub-processors.
- “Terms of Service” means the 360 DataCraft Terms of Service at https://360datacraft.com/terms-of-service, as updated under Section 20 of those Terms.
Capitalized terms not defined here have the meanings given in the Agreement.
2. Roles and scope
2.1 Client is the controller (“business” under the CCPA, “data fiduciary” under the DPDP Act). 360 Degree Cloud is the processor (“service provider” under the CCPA, “data processor” under the DPDP Act). Account Data, and personal information 360 Degree Cloud collects through its website, are handled under the 360 DataCraft Privacy Policy and are outside this DPA. 360 Degree Cloud may use Authorised Users’ contact details in Operational Data to provide the Services, including sending service notices and job alerts.
2.2 Your data stays in your environment. Client’s backups and archives are stored only in the Client Environment, in the AWS region Client chooses. Personal Data is not stored on 360 Degree Cloud’s systems, except:
- in transit: while a job runs, data passes through the Platform, encrypted, between Client’s Salesforce organization and Client’s AWS account;
- transient processing: to carry out an operation Client has configured, such as a backup, restore, archive, dry run or archive search, after which it is deleted; and
- Operational Data: which the Platform stores to run the Services. It includes Authorised Users’ details and may contain limited Personal Data from Client’s Salesforce data, such as record IDs, filter values and error messages. This DPA applies in full to Operational Data.
2.3 Processing in Client’s AWS account. Some processing, such as compressing backups [and keeping the pre-restore snapshots used to roll back a restore], may run using AWS services in Client’s own AWS account. That processing takes place in the Client Environment, under Client’s AWS agreement and at Client’s cost.
2.4 360 Degree Cloud’s obligations cover the Platform, its own systems and Personal Data in its possession or control. They do not extend to the configuration, security or administration of the Client Environment or of third-party platforms that 360 Degree Cloud does not operate. Annex 1 describes the Processing.
3. Our commitments
3.1 Instructions. 360 Degree Cloud Processes Personal Data only on Client’s documented instructions, being the Agreement, this DPA and Client’s configuration of the Services (including the backup, restore and archive policies Client creates), unless the law requires otherwise. It will tell Client if it believes an instruction breaks the law.
3.2 Restrictions. 360 Degree Cloud will not:
- sell or share Personal Data;
- retain, use or disclose it for any purpose other than providing the Services;
- combine it with other personal data, except as Applicable Data Protection Laws allow; or
- use it, or allow any Sub-processor to use it, to train or improve any AI or machine-learning model.
This does not prevent 360 Degree Cloud from creating aggregated or de-identified technical statistics about how the Services perform, such as licence status, version, job counts and error codes, and using them to support and improve the Services, as described in Section 13.4 of the Terms of Service. These statistics do not include Customer Data or identify Client or any individual, and 360 Degree Cloud will not try to re-identify them.
3.3 Compliance. 360 Degree Cloud will meet its obligations as a processor under Applicable Data Protection Laws and will notify Client if it can no longer do so.
3.4 People. Personnel who Process Personal Data are bound by confidentiality, trained in security and privacy, and given access only as needed to provide the Services. They do not access Customer Data except to provide support Client requests, to keep the Services secure, or as required by law, and they access data in the Client Environment only through access Client grants.
3.5 Client responsibilities. Client is responsible for:
- the lawfulness of its Personal Data and instructions, including providing any required notices, obtaining necessary consents and having a lawful basis for processing;
- choosing which objects, fields and records to back up, restore or archive;
- the retention, deletion and security settings of its AWS account; and
- reviewing dry-run results before running a restore or archive.
3.6 Client’s right to stop unauthorized use. Client may take reasonable and appropriate steps to stop and remediate any unauthorized Processing of Personal Data, including by revoking the Platform’s access to the Client Environment.
4. Group entities and sub-processors
4.1 360 Degree Cloud Technologies LLC (USA) and 360 Degree Cloud Technologies Pvt. Ltd. (India) may each perform the Services on the other’s behalf. Each is bound by obligations no less protective than this DPA, and the contracting entity remains responsible to Client.
4.2 Client authorizes Sub-processors in the categories in Annex 3. Their names and locations are available on Client’s written request. 360 Degree Cloud will give at least thirty (30) days’ notice of a new Sub-processor. Client may object on reasonable data protection grounds within ten (10) business days. If the parties cannot resolve the objection, Client may terminate the affected Services.
4.3 Each Sub-processor is bound by written data protection terms no less protective than this DPA, and 360 Degree Cloud remains responsible for its performance.
5. Security
5.1 360 Degree Cloud maintains a written information security program with administrative, technical and physical safeguards, overseen by a designated security officer and evaluated regularly. Annex 2 summarizes the measures, which may be updated provided protection is not materially reduced.
5.2 Client is responsible for the security of the Client Environment, including user access, AWS identity and access management (IAM) permissions, encryption keys, bucket policies and the DataCraft permissions and roles Client assigns.
6. Security incidents
6.1 360 Degree Cloud will notify Client without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Security Incident. Notice will go to the email address given for Client in the Order or, if none, to the email address on Client’s account. It will describe, as far as known, what happened, the data and individuals affected, likely consequences and the steps taken.
6.2 360 Degree Cloud will investigate, contain and remediate the Security Incident and help Client meet its own notification duties. Client decides whether to notify individuals or regulators. Unsuccessful attempts that do not compromise Personal Data, such as blocked log-ins or port scans, are not Security Incidents. A notification is not an admission of fault.
7. Assistance
7.1 Because Personal Data is stored in the Client Environment, Client can find, correct, export and delete it directly in its Salesforce organization and AWS account. 360 Degree Cloud will promptly forward to Client any request it receives from an individual, and will give reasonable help with such requests, data protection impact assessments and regulator consultations.
8. Audits
8.1 On request, 360 Degree Cloud will provide information reasonably needed to show compliance, under confidentiality. This includes its latest vulnerability assessment and penetration test (VAPT) report, other assessment reports and security questionnaire responses.
8.2 If that is not sufficient, or a regulator requires it, Client or an independent auditor may carry out an assessment, subject to these conditions:
- the auditor is bound by confidentiality and is not a competitor of 360 Degree Cloud;
- no more than once in any twelve (12) months, on thirty (30) days’ notice, during business hours;
- at Client’s cost, unless a material breach is found; and
- no penetration testing or scanning unless agreed, and never extending to other customers’ data.
An additional assessment may follow a Security Incident caused by 360 Degree Cloud.
9. Return and deletion
9.1 Client’s backups and archives remain in Client’s AWS account when the Agreement ends. 360 Degree Cloud does not delete them, and Client decides how long to keep them.
9.2 Within thirty (30) days after the Agreement ends, 360 Degree Cloud will delete Operational Data and any other Personal Data in its possession or control, unless the law requires otherwise, and will confirm deletion on request. Connection credentials are deleted within fifteen (15) days after the Agreement ends, or sooner if Client removes a connection. Backup copies of 360 Degree Cloud’s own systems are deleted in the ordinary course and stay protected until then.
9.3 Client should revoke the Platform’s access to its Salesforce organizations and AWS account when the Agreement ends. Uninstalling the 360 Data Craft package removes its components from Salesforce, including real-time backup triggers and Archive Search.
10. Education and health data
10.1 FERPA. Where Personal Data includes education records, Client designates 360 Degree Cloud as a “school official” with a legitimate educational interest under 34 C.F.R. § 99.31(a)(1)(i)(B). 360 Degree Cloud will use education records only to provide the Services, under Client’s direct control, and will not redisclose them except as FERPA permits.
11. International transfers
11.1 The Personal Data passes through it while jobs run. Personnel may access Personal Data from the United States and India only as needed to provide the Services and, for data in the Client Environment, only through access Client grants.
11.2 Where the GDPR or UK GDPR applies to a transfer, the EU Standard Contractual Clauses (Decision (EU) 2021/914, Module Two or Three) and the UK International Data Transfer Addendum are incorporated by reference, completed by the Annexes to this DPA. Transfers from India comply with the DPDP Act.
11.3 For the Standard Contractual Clauses:
- Clause 7 (docking clause) applies;
- under Clause 9(a), Option 2 (general written authorization) applies, with the notice period in Section 4.2;
- the optional wording in Clause 11(a) does not apply;
- under Clause 17, they are governed by the law of Ireland, and under Clause 18, disputes are resolved by the courts of Ireland; and
- the competent supervisory authority is the one determined under Clause 13.
The UK International Data Transfer Addendum is completed with the information in this DPA and its Annexes.
11.4 Client chooses the AWS region where its backups and archives are stored, and may use separate AWS destinations for Salesforce organizations in different countries.
12. Liability and general
12.1 Each party’s liability under this DPA is subject to the limitations and exclusions of liability in the Agreement.
12.2 If this DPA conflicts with the Agreement on the Processing of Personal Data, this DPA prevails, except on liability. This DPA lasts as long as 360 Degree Cloud Processes Personal Data, and terms meant to survive will survive. The parties will update it in good faith to reflect changes in law. It is governed by the law governing the Agreement, except where the Standard Contractual Clauses require otherwise.
12.3 360 Degree Cloud may update this DPA as described in Section 20 of the Terms of Service, without materially reducing the protection of Personal Data. The version current when an Order Form is signed applies to that Order Form unless the parties agree otherwise. Earlier versions are available from legal@360degreecloud.com.
Annex 1: Description of processing
| Item | Description |
|---|---|
| Subject matter and purpose | Providing 360 DataCraft: backing up, restoring, archiving and transferring Client’s Salesforce data between Client’s Salesforce organizations and Client’s AWS account, showing archived records inside Salesforce, and related implementation and support |
| Nature of processing | Reading, transmitting, compressing (in Client’s AWS account), comparing (dry runs), writing back and deleting (archive) records, as Client configures |
| Frequency | Continuous for real-time backup policies; otherwise on the schedules Client sets, or when Client runs a job |
| Duration | The term of the Agreement, plus the deletion period in Section 9 |
| Individuals | Any individuals whose data Client holds in the Salesforce objects it selects, such as customers, prospects, contacts, employees and students; and Client’s Authorised Users, in Operational Data |
| Personal Data | Any data in the objects and fields Client selects, such as names, contact details, account and activity records, notes and email content; files and attachments where file transfer is included in Client’s DataCraft Order (File Sync, if purchased separately, is covered by its own terms); and, in Operational Data, Authorised Users’ names, email addresses, user IDs, permissions and roles, and record IDs, filter values, error messages and audit log entries |
| Sensitive data | None intended. Client controls which objects are processed. Health data requires a Business Associate Agreement first |
| Retention by 360 Degree Cloud | Customer data passing through the Platform: none beyond transient processing. Connection credentials: until Client removes the connection, and no more than fifteen (15) days after the Agreement ends. Other Operational Data: the term of the Agreement plus thirty (30) days (Section 9) |
Annex 2: Security measures
| Area | Measures |
|---|---|
| Governance | Written security program; designated security officer |
| Data minimization | Backups and archives stored only in Client’s AWS account; data passes through the Platform transiently and is not kept; no AI training on Personal Data |
| Encryption | TLS 1.2 or higher in transit between Salesforce, the Platform and AWS; connection credentials and tokens encrypted at rest; encryption at rest for any other data 360 Degree Cloud holds; encrypted VPN for infrastructure access |
| Access control | Unique IDs, multi-factor authentication, least-privilege roles, prompt removal on exit, no local admin rights |
| Product safeguards | Role-based permissions separating view, configure, run and delete rights for backup, restore and archive; typed confirmations before real-time backup, restore and archive; dry-run previews; audit logs of who ran each job; job failure alerts; pausing jobs before Client’s Salesforce API limit is reached; rolling back a restore for 14 days where supported |
| People | Background checks for new hires, confidentiality agreements, security and privacy training at onboarding and annually |
| Secure development | Documented SDLC, peer code review, static code analysis, dependency review, penetration testing (VAPT) |
| Operations | Endpoint protection and vulnerability scanning, tested patching, platform-level firewall and DDoS protection, security logging and monitoring |
| Resilience | Documented incident response plan; business continuity and disaster recovery plan tested annually; daily off-site backups of 360 Degree Cloud’s own systems |
| Physical security | Access-controlled offices with card or biometric entry and CCTV; Platform hosted with [cloud provider name], which holds its own independent security attestations |
Annex 3: Sub-processor categories
| Category | Purpose |
|---|---|
| Group entities: 360 Degree Cloud Technologies LLC (USA) and 360 Degree Cloud Technologies Pvt. Ltd. (India) | Implementation, engineering, support and billing |
| Cloud infrastructure provider | Hosting the Platform and Operational Data |
| [Email delivery provider] | [Sending job alerts and service notices] |
| [Error monitoring and logging tools] | [Diagnosing Platform errors, which may include error messages] |
Names and locations of current Sub-processors are available on written request to legal@360degreecloud.com. Salesforce, and AWS when used under Client’s own AWS account, are not Sub-processors.