Data Processing Addendum

Version 2026-09-25-v1 · Effective 25 September 2026

This Data Processing Addendum (“DPA”) forms part of the SaveState Terms of Service or Organization Agreement when a business uses SaveState through savestate.dk or any of its subdomains to process personal data.

Parties and roles

If the customer determines the purposes and means of the backed-up data, the customer is controller and SaveState is processor. If a hosting organization processes that data on behalf of its own end customer, that end customer is normally controller, the hosting organization is processor, and SaveState is the hosting organization’s subprocessor. “Customer” in this DPA means the party instructing SaveState in either chain. Each party remains independently responsible for personal data it controls, including SaveState’s account administration, security, support, contract, and billing records.

Processing instructions and scope

SaveState processes customer personal data only to provide, secure, support, and delete the encrypted backup service; to comply with documented customer choices in the product; or as required by law. If SaveState believes an instruction infringes applicable data-protection law, it will inform the customer before processing that instruction unless law prohibits the notice. The subject matter is encrypted backup storage and restore. Processing lasts for the subscription and deletion lifecycle. Data may include any categories selected by the customer for backup, plus paths, timestamps, file counts, sizes, schedules, and job status. Data subjects may include the customer’s staff, users, clients, or other people represented in the backed-up systems.

The customer is responsible for lawful instructions, notices, legal bases, data minimisation, and ensuring that SaveState is suitable for the data being backed up. A hosting organization also warrants that it is authorised by each relevant end customer to appoint SaveState as subprocessor and must pass through any lawful controller instructions. The customer must not use the service for processing that requires controls SaveState has not expressly agreed to provide.

Confidentiality and security

SaveState limits access to authorised persons bound by confidentiality and uses measures appropriate to the service, including encryption in transit, client-side authenticated encryption of backup contents, restricted administrative access, encrypted operational secrets, rate limits, security logging, private Backblaze buckets, and provider access controls. The customer controls the backup selection and key material and must protect recovery credentials.

Subprocessors

The customer authorises SaveState to use the following subprocessors for the backup service:

• Backblaze, Inc. — encrypted object storage in the EU Central region, Amsterdam.
• Cloudflare, Inc. — network, edge security, Workers, queues, and database infrastructure.

Stripe processes payments separately and is not used to store customer backup contents. SaveState uses written data-processing terms with its subprocessors and remains responsible to the customer for its processor obligations; those obligations cannot be assigned away merely because an incident occurs inside Backblaze or Cloudflare. SaveState will give at least 30 days’ notice of a planned material subprocessor addition or replacement where reasonably possible. A customer with a documented data-protection objection may contact SaveState during that period. The parties will try to resolve the objection; if no reasonable solution is available, the affected service may be terminated before the change takes effect.

International transfers

SaveState-managed encrypted backup objects are configured for Backblaze’s EU Central region without cross-region replication. If the customer chooses its own storage destination, it selects that provider and region and should assess its own provider agreement and any relevant international transfer. SaveState’s desktop app connects directly to that provider; SaveState does not receive its access keys or backup objects. Cloudflare may process network and operational data globally. Where SaveState’s own processing involves a restricted transfer from the EEA, SaveState will rely on an adequacy decision, approved Standard Contractual Clauses made available by the provider, or another lawful transfer mechanism.

Assistance and incidents

Taking into account the nature of the processing and information available, SaveState will reasonably assist the customer with data-subject requests, security obligations, breach assessment, and legally required impact assessments. SaveState will notify the customer without undue delay after confirming a personal-data breach affecting customer personal data and will provide available information needed for the customer’s legal duties. SaveState targets an initial notice within 24 hours after confirmation, but that target is operational and not a guaranteed service level.

Deletion and return

During an active subscription and the documented three-day restore-only grace period, the customer can retrieve SaveState-managed encrypted backups through the service. At the grace deadline, SaveState deletes the managed service’s object versions, storage bucket, snapshot/folder metadata, and related service state. Customer-owned bucket objects stay with the customer’s provider and are not deleted by SaveState at subscription expiry. The encrypted account-key envelope remains while the login account is open so customer-owned repositories can still be unlocked client-side. On a verified full-erasure instruction, SaveState deletes that envelope and queues deletion of subscriptions and customer-linked account metadata; customer-owned objects must be managed separately with their provider. Minimal records may remain only where law requires them or where needed to prove completion without retaining backup contents.

Storage dependency and allocation of responsibility

Backblaze operates SaveState-managed B2 storage and Cloudflare operates material application infrastructure. Their availability, durability, incident response, and contractual safeguards form part of SaveState’s technical risk management, but the customer’s DPA remains with SaveState. Provider failure does not turn Backblaze or Cloudflare into the customer’s processor under this DPA, and does not remove SaveState’s obligations under applicable data-protection law. The customer remains responsible for deciding whether the managed single-region, non-replicated service or its selected customer-owned provider is appropriate for its risk level and for maintaining any independent copy its continuity plan requires.

Information and audits

SaveState will provide information reasonably necessary to demonstrate compliance with this DPA. Audits must be proportionate, protect other customers and security information, use existing reports first, and be arranged on reasonable notice. The customer bears its audit costs unless an audit identifies a material breach by SaveState.

Priority and law

If this DPA conflicts with the Terms on processing customer personal data, this DPA controls. The remaining Terms, including Danish governing law and mandatory consumer protections, continue to apply.