Legal

Data Processing Agreement

How we process personal data for Cloneto customers.

Draft — for legal review, not yet in effect. Items in dashed boxes are placeholders.

Last updated October 1, 2026

Introduction

This Data Processing Agreement (“DPA”) forms part of the Cloneto Terms of Service between Yin Yang Inc., the company behind ClonePartner (“we”), and the Customer. [Confirm: Yin Yang Inc. is the entity that offers Cloneto]

It applies when we process personal data on the Customer's behalf. Both parties will comply with applicable data protection laws, including the GDPR, UK GDPR, Swiss FADP and CCPA.

Data Protection Officer: dpo@clonepartner.com
EU representative (GDPR Art. 27): Rickert Rechtsanwaltsgesellschaft mbH – YIN YANG, INC., Colmantstraße 15, 53115 Bonn, Germany. art-27-rep-yinyang@rickert.law
UK representative (UK GDPR Art. 27): Rickert Services Ltd UK – YIN YANG, INC., PO Box 1487, Peterborough PE1 9XX, United Kingdom. art-27-rep-yinyang@rickert-services.uk
Signed copy: On request to legal@clonepartner.com

1. Roles and instructions

The Customer is the controller, or a processor acting for its own client. We are the processor, or a subprocessor.
We process personal data only on the Customer's documented instructions: the Terms, the Order Form, this DPA and later written instructions. We will tell the Customer if we believe an instruction breaks data protection law.
The Customer confirms it has the rights, notices and lawful basis needed for the personal data it gives us or runs through Cloneto.

2. Scope by deployment

Client Azure and on-premises. Cloneto runs in the Customer's or its client's environment, and the Customer operates it. Records are processed there; we do not access, receive or store them. The only outbound call is a license check, which carries no client records. [Confirm: no other outbound calls, including AI features] This DPA then covers only the personal data we do process: account, configuration, support and license-check data.
Hosted in-region. We run Cloneto for the Customer in the region named in the Order Form and process the records it moves. We do not move that data out of the region except on the Customer's instructions or where the law requires. [Hosting provider and regions for hosted in-region]
Engineering help. Where ClonePartner engineers help with a job, they act on the Customer's instructions. For regulated clients, they can support over a screen share without access to client systems or data.

3. Personnel

Only authorized personnel bound by confidentiality can access personal data. Personnel with access to customer data are background-screened at hire, where local law allows.

4. Assistance

Taking into account the nature of the processing, we help the Customer respond to data subject requests, carry out data protection impact assessments and consult supervisory authorities. Help beyond routine support may be charged at agreed rates, with the Customer's written approval in advance.

5. Security measures

Cloneto is designed to keep data and secrets in the Customer's environment:

In Azure, connector credentials live in the client's Azure Key Vault, reached through a managed identity. None sit in pipeline files.
The control plane resolves credentials at run time. The executor that moves the data never resolves secrets.
Every run records status, per-task progress and logs, down to each errored record.
Users sign in to the control plane, with single sign-on available.

Our own systems run under ClonePartner's security program:

Encryption in transit (TLS 1.2+) and at rest (AES-256).
Role-based access control and multi-factor authentication.
Continuous monitoring, centralized logging and intrusion detection.
Vulnerability scanning, prompt patching and annual third-party penetration tests.
Business continuity and disaster recovery plans with encrypted backups.
ClonePartner holds a SOC 2 Type II report and ISO 27001 certification, available under NDA at trust.clonepartner.com. [Confirm Cloneto is in audit scope]

6. Subprocessors

The Customer authorizes the subprocessors listed on our Subprocessors page.
We give at least 30 days' notice before adding or replacing a subprocessor. The Customer may object on reasonable data protection grounds. If we cannot resolve the objection within 30 days, either party may end the affected service, and we refund prepaid fees for the unused term.
Each subprocessor signs data protection terms at least as protective as this DPA. We remain liable for them.

7. International transfers

Restricted transfers are covered by the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), incorporated by reference. Module Two applies where the Customer is a controller, and Module Three where it is a processor. Clause 7 applies. Under Clause 9(a), Option 2 applies, with the notice period in section 6. The optional language in Clause 11(a) does not apply. Under Clauses 17 and 18, Irish law governs and the courts of Ireland have jurisdiction. Schedules A to C complete the Annexes.

For UK transfers, the ICO's International Data Transfer Addendum (version B1.0) applies. For Swiss transfers, the clauses apply with references to the GDPR read as references to the FADP, and the Swiss Federal Data Protection and Information Commissioner is the competent authority.

Under the CCPA, we act as a service provider. We do not sell or share personal data, and we do not retain, use or disclose it outside the Customer's instructions.

If a public authority asks for Customer data, we notify the Customer unless the law forbids it, challenge the request where there are reasonable grounds, and disclose only the minimum required.

8. AI-assisted tooling

When ClonePartner engineers build or debug pipelines for a Customer, they may use AI-assisted tools, currently Cursor, with privacy mode enforced. Inputs are not used to train models and are subject to zero- or limited-retention terms. These tools and the model providers they reach are listed as subprocessors. The Customer can prohibit their use by written notice to legal@clonepartner.com.

[Confirm where Cloneto's AI features run, and any model provider]

9. Personal data breach

We notify the Customer without undue delay and, where feasible, within 48 hours of becoming aware of a personal data breach. We help with investigation, mitigation and any notifications the law requires.

10. Deletion and return

When the service ends, we delete the Customer's personal data that we hold within 90 days, unless the law requires us to keep it, and certify deletion on request. Backups expire on a rolling cycle. [Backup retention for hosted in-region]

In Client Azure and on-premises deployments, the data stays in the Customer's environment, and the Customer deletes it.

11. Audits

We provide the information needed to show compliance with this DPA. ClonePartner holds a SOC 2 Type II report and ISO 27001 certification, available under NDA. [Confirm Cloneto is in audit scope] Once every 12 months, on 30 days' notice, the Customer may audit our processing. Additional audits may be charged.

12. Liability and precedence

Liability follows the Terms. Nothing limits either Party's liability for intentional or wilful breach of this DPA. If this DPA conflicts with the Terms, this DPA prevails. The Standard Contractual Clauses prevail over both.

Schedule A: Parties

Data exporter: The Customer. Controller (Module Two) or processor (Module Three). Receives the Service described in Schedule B.
Data importer: Yin Yang Inc., 9450 SW Gemini Dr, PMB 69868, Beaverton, Oregon 97008-7105, USA. legal@clonepartner.com. Processor.
Supervisory authority: That of the EU Member State where the Customer is established; if none, that of the Member State of the Customer's Article 27 representative; otherwise the Irish Data Protection Commission.

Schedule B: Description of processing

Nature and purpose: Providing Cloneto: one-time migrations and ongoing sync between business systems, licensing and support.
Data subjects: The Customer's users, and people whose data is in the systems the Customer migrates or syncs.
Personal data: Names, email addresses, user IDs, contact details and roles; account and log data; and any records the Customer chooses to move.
Sensitive data: Not intended. The Customer must not send special-category data unless agreed in writing.
Frequency: Continuous, or as jobs are scheduled or triggered.
Duration: The subscription term, plus the deletion period in section 10.

Schedule C: Subprocessors

The authorized subprocessors are those on our Subprocessors page, which shows each one's purpose and location.