Data Processing Agreement

Commission Implementing Decision (EU) 2021/915 of June 4, 2021 on standard contractual clauses between controllers and processors pursuant to Article 28 (7) of the GDPR.

SECTION I

Clause 1

Purpose and scope

(a) The purpose of these Standard Contractual Clauses (the Clauses) is to ensure compliance with Article 28(3) and (4) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

(b) The controllers and processors have agreed to these Clauses in order to ensure compliance with Article 28(3) and (4) of Regulation (EU) 2016/679.

(c) These Clauses apply to the processing of personal data as specified in Annex II.

(d) Annexes I to IV are an integral part of the Clauses.

(e) These Clauses are without prejudice to obligations to which the controller is subject by virtue of Regulation (EU) 2016/679.

(f) These Clauses do not by themselves ensure compliance with obligations related to international transfers in accordance with Chapter V of Regulation (EU) 2016/679.

Clause 2

Invariability of the Clauses

(a) The Parties undertake not to modify the Clauses, except for adding information to the Annexes or updating information in them.

(b) This does not prevent the Parties from including the standard contractual clauses laid down in these Clauses in a broader contract, or from adding other clauses or additional safeguards provided that they do not directly or indirectly contradict the Clauses or detract from the fundamental rights or freedoms of data subjects.

Clause 3

Interpretation

(a) Where these Clauses use the terms defined in Regulation (EU) 2016/679, those terms shall have the same meaning as in that Regulation.

(b) These Clauses shall be read and interpreted in the light of the provisions of Regulation (EU) 2016/679 respectively.

(c) These Clauses shall not be interpreted in a way that runs counter to the rights and obligations provided for in Regulation (EU) 2016/679 or in a way that prejudices the fundamental rights or freedoms of the data subjects.

Clause 4

Hierarchy

In the event of a contradiction between these Clauses and the provisions of related agreements between the Parties existing at the time when these Clauses are agreed or entered into thereafter, these Clauses shall prevail.

Clause 5 – Optional

[Deliberately left blank]

SECTION II – OBLIGATIONS OF THE PARTIES

Clause 6

Description of processing(s)

The details of the processing operations, in particular the categories of personal data and the purposes of processing for which the personal data is processed on behalf of the controller, are specified in Annex II.

Clause 7

Obligations of the Parties

7.1 Instructions

(a) The processor shall process personal data only on documented instructions from the controller, unless required to do so by Union or Member State law to which the processor is subject. In this case, the processor shall inform the controller of that legal requirement before processing, unless the law prohibits this on important grounds of public interest. Subsequent instructions may also be given by the controller throughout the duration of the processing of personal data. These instructions shall always be documented.

(b) The processor shall immediately inform the controller if, in the processor's opinion, instructions given by the controller infringe Regulation (EU) 2016/679 or the applicable Union or Member State data protection provisions.

7.2. Purpose limitation

The processor shall process the personal data only for the specific purpose(s) of the processing, as set out in Annex II, unless it receives further instructions from the controller.

7.3. Duration of the processing of personal data

Processing by the processor shall only take place for the duration specified in Annex II.

7.4. Security of processing

(a) The processor shall at least implement the technical and organisational measures specified in Annex III to ensure the security of the personal data. This includes protecting the data against a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access to the data (personal data breach). In assessing the appropriate level of security, the Parties shall take due account of the state of the art, the costs of implementation, the nature, scope, context and purposes of processing and the risks involved for the data subjects.

(b) The processor shall grant access to the personal data undergoing processing to members of its personnel only to the extent strictly necessary for implementing, managing and monitoring of the contract. The processor shall ensure that persons authorised to process the personal data received have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

7.5. Sensitive data

If the processing involves personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data or biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person's sex life or sexual orientation, or data relating to criminal convictions and offences (“sensitive data”), the processor shall apply specific restrictions and/or additional safeguards.

7.6 Documentation and compliance

(a) The Parties shall be able to demonstrate compliance with these Clauses.

(b) The processor shall deal promptly and adequately with inquiries from the controller about the processing of data in accordance with these Clauses.

(c) The processor shall make available to the controller all information necessary to demonstrate compliance with the obligations that are set out in these Clauses and stem directly from Regulation (EU) 2016/679. At the controller's request, the processor shall also permit and contribute to audits of the processing activities covered by these Clauses, at reasonable intervals or if there are indications of non-compliance. In deciding on a review or an audit, the controller may take into account relevant certifications held by the processor.

(d) The controller may choose to conduct the audit by itself or mandate an independent auditor. Audits may also include inspections at the premises or physical facilities of the processor and shall, where appropriate, be carried out with reasonable notice.

(e) The Parties shall make the information referred to in this Clause, including the results of any audits, available to the competent supervisory authority/ies on request.

7.7. Use of sub-processors

(a) The processor has the controller's general authorisation for the engagement of sub-processors from an agreed list. The processor shall specifically inform in writing the controller of any intended changes of that list through the addition or replacement of sub-processors at least 30 days in advance, thereby giving the controller sufficient time to be able to object to such changes prior to the engagement of the concerned sub-processor(s). The processor shall provide the controller with the information necessary to enable the controller to exercise the right to object.

(b) Where the processor engages a sub-processor for carrying out specific processing activities (on behalf of the controller), it shall do so by way of a contract which imposes on the sub-processor, in substance, the same data protection obligations as the ones imposed on the data processor in accordance with these Clauses. The processor shall ensure that the sub-processor complies with the obligations to which the processor is subject pursuant to these Clauses and to Regulation (EU) 2016/679.

(c) At the controller's request, the processor shall provide a copy of such a sub-processor agreement and any subsequent amendments to the controller. To the extent necessary to protect business secret or other confidential information, including personal data, the processor may redact the text of the agreement prior to sharing the copy.

(d) The processor shall remain fully responsible to the controller for the performance of the sub-processor's obligations in accordance with its contract with the processor. The processor shall notify the controller of any failure by the sub-processor to fulfil its contractual obligations.

(e) The processor shall agree a third party beneficiary clause with the sub-processor whereby - in the event the processor has factually disappeared, ceased to exist in law or has become insolvent - the controller shall have the right to terminate the sub-processor contract and to instruct the sub-processor to erase or return the personal data.

7.8. International transfers

(a) Any transfer of data to a third country or an international organisation by the processor shall be done only on the basis of documented instructions from the controller or in order to fulfil a specific requirement under Union or Member State law to which the processor is subject and shall take place in compliance with Chapter V of Regulation (EU) 2016/679.

(b) The controller agrees that where the processor engages a sub-processor in accordance with Clause 7.7. for carrying out specific processing activities (on behalf of the controller) and those processing activities involve a transfer of personal data within the meaning of Chapter V of Regulation (EU) 2016/679, the processor and the sub-processor can ensure compliance with Chapter V of Regulation (EU) 2016/679 by using standard contractual clauses adopted by the Commission in accordance with of Article 46(2) of Regulation (EU) 2016/679, provided the conditions for the use of those standard contractual clauses are met.

Clause 8

Assistance to the controller

(a) The processor shall promptly notify the controller of any request it has received from the data subject. It shall not respond to the request itself, unless authorised to do so by the controller.

(b) The processor shall assist the controller in fulfilling its obligations to respond to data subjects' requests to exercise their rights, taking into account the nature of the processing. In fulfilling its obligations in accordance with (a) and (b), the processor shall comply with the controller's instructions

(c) In addition to the processor's obligation to assist the controller pursuant to Clause 8(b), the processor shall furthermore assist the controller in ensuring compliance with the following obligations, taking into account the nature of the data processing and the information available to the processor:

(1) the obligation to carry out an assessment of the impact of the envisaged processing operations on the protection of personal data (a 'data protection impact assessment') where a type of processing is likely to result in a high risk to the rights and freedoms of natural persons;

(2) the obligation to consult the competent supervisory authority/ies prior to processing where a data protection impact assessment indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk;

(3) the obligations in Article 32 Regulation (EU) 2016/679.

(d) The Parties shall set out in Annex III the appropriate technical and organisational measures by which the processor is required to assist the controller in the application of this Clause as well as the scope and the extent of the assistance required.

Clause 9

Notification of personal data breach

In the event of a personal data breach, the processor shall cooperate with and assist the controller for the controller to comply with its obligations under Articles 33 and 34 Regulation (EU) 2016/679, where applicable, taking into account the nature of processing and the information available to the processor.

9.1 Data breach concerning data processed by the controller

In the event of a personal data breach concerning data processed by the controller, the processor shall assist the controller:

(a) in notifying the personal data breach to the competent supervisory authority/ies, without undue delay after the controller has become aware of it, where relevant/(unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons);

(b) in obtaining the following information which, pursuant to Article 33(3) Regulation (EU) 2016/679, shall be stated in the controller's notification, and must at least include:

(1) the nature of the personal data including where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;

(2) the likely consequences of the personal data breach;

(3) the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.

Where, and insofar as, it is not possible to provide all this information at the same time, the initial notification shall contain the information then available and further information shall, as it becomes available, subsequently be provided without undue delay.

(c) in complying, pursuant to Article 34 Regulation (EU) 2016/679, with the obligation to communicate without undue delay the personal data breach to the data subject, when the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons.

9.2 Data breach concerning data processed by the processor

In the event of a personal data breach concerning data processed by the processor, the processor shall notify the controller without undue delay after the processor having become aware of the breach. Such notification shall contain, at least:

(a) a description of the nature of the breach (including, where possible, the categories and approximate number of data subjects and data records concerned);

(b) the details of a contact point where more information concerning the personal data breach can be obtained;

(c) its likely consequences and the measures taken or proposed to be taken to address the breach, including to mitigate its possible adverse effects.

Where, and insofar as, it is not possible to provide all this information at the same time, the initial notification shall contain the information then available and further information shall, as it becomes available, subsequently be provided without undue delay.

The Parties shall set out in Annex III all other elements to be provided by the processor when assisting the controller in the compliance with the controller's obligations under Articles 33 and 34 of Regulation (EU) 2016/679.

SECTION III – FINAL PROVISIONS

Clause 10

Non-compliance with the Clauses and termination

(a) Without prejudice to any provisions of Regulation (EU) 2016/679, in the event that the processor is in breach of its obligations under these Clauses, the controller may instruct the processor to suspend the processing of personal data until the latter complies with these Clauses or the contract is terminated. The processor shall promptly inform the controller in case it is unable to comply with these Clauses, for whatever reason.

(b) The controller shall be entitled to terminate the contract insofar as it concerns processing of personal data in accordance with these Clauses if:

(1) the processing of personal data by the processor has been suspended by the controller pursuant to point (a) and if compliance with these Clauses is not restored within a reasonable time and in any event within one month following suspension;

(2) the processor is in substantial or persistent breach of these Clauses or its obligations under Regulation (EU) 2016/679;

(3) the processor fails to comply with a binding decision of a competent court or the competent supervisory authority/ies regarding its obligations pursuant to these Clauses or to Regulation (EU) 2016/679.

(c) The processor shall be entitled to terminate the contract insofar as it concerns processing of personal data under these Clauses where, after having informed the controller that its instructions infringe applicable legal requirements in accordance with Clause 7.1 (b), the controller insists on compliance with the instructions.

(d) Following termination of the contract, the processor shall, at the choice of the controller, delete all personal data processed on behalf of the controller and certify to the controller that it has done so, or, return all the personal data to the controller and delete existing copies unless Union or Member State law requires storage of the personal data. Until the data is deleted or returned, the processor shall continue to ensure compliance with these Clauses.

Controller: Controller is the Customer pursuant to the T&C above.

Signature and accession date: Occurs when the Customer agrees to the T&C.

Processor:

Name: Blocks Holding GmbH

Address: Kurfürstendamm 207- 208, 10719 Berlin

Contact person's name, position and contact details: heyData GmbH, Schützenstraße 5, 10117 Berlin, www.heydata.eu, datenschutz@heydata.eu

Signature and accession date: Occurs when the Customer agrees to the T&C.

Categories of data subjects whose personal data is processed

Employees, contractors, and authorized users of the Controller (Member) whose personal data is contained in the AWS accounts, billing logs, usage metadata, or who utilize the Blocks Platform.

Categories of personal data processed

Master Data: First name, last name, business email address, business telephone number, job title.

Technical Data: IP addresses, device IDs, login credentials (encrypted), and browser user agents.

Cloud Metadata: AWS Account IDs, Resource IDs (ARNs), and resource tags (e.g., “Owner: John Doe”) found within the Cost & Usage Reports (CUR).

Sensitive data processed (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.

Excluded data categories, and consequences if such data is nevertheless received

1. The Processor represents and warrants that it does not receive, store or process (a) data concerning health or any other special category of personal data within the meaning of Art. 9 (1) GDPR, or (b) personal data of the controller's customers or end users. The categories of personal data processed by the Processor are limited to those set out in this Annex II.

2. Should data falling under paragraph 1 nevertheless reach the Processor, the Processor shall (a) notify the controller within 24 hours of becoming aware, (b) immediately cease all processing of that data and isolate it, (c) delete it and confirm deletion to the controller in writing, and (d) not use it for any purpose whatsoever, including service improvement, benchmarking or the training or evaluation of AI models, and not disclose it to any sub-processor or third party.

3. Paragraph 2 applies irrespective of whether the data has been pseudonymised, masked, hashed, aggregated or otherwise transformed by the Processor, and irrespective of whether the Processor considers the data to be anonymous in its own hands.

4. The Processor receives billing and infrastructure metadata only and does not receive the content of the controller's customer or end-user data. The technical measures preventing such access are set out in Annex III.

There is no intentional processing of sensitive personal data within the meaning of Art. 9 (1) GDPR. If a text transmitted by the Customer nevertheless contains such data, the Customer may transmit this data if

the data subject has been duly informed in advance in accordance with Art. 13 and 14 GDPR,

effective consent within the meaning of Art. 9 (2) (a) GDPR has been obtained or another ground for permission under Art. 9 (2) GDPR has been fulfilled,

and the processing is necessary for the respective processing purpose.

If these conditions are not met, the Customer shall pseudonymize or anonymize the sensitive data before providing it, provided that pseudonymization or anonymization does not conflict with the purpose of processing.

Nature of the processing

Collection, storage, organization, structuring, analysis (via AI models), and retrieval of data to provide cloud cost optimization, billing management, and resale services.

Purpose(s) for which the personal data is processed on behalf of the controller

1. To provide the Blocks Platform and Services (optimization, billing resale).

2. To manage the commercial relationship (invoicing, support).

3. To produce aggregate statistical measures that carry no personal reference. The controller's personal data is not used to train, fine-tune or evaluate AI models.

Duration of the processing

For the duration of the contractual relationship. Personal data processed on behalf of the controller is deleted within 30 days of termination, in accordance with Annex III. Statutory retention obligations on the Processor's side (10 years under German HGB/AO) apply only to the Processor's own accounting records, for which the Processor is its own controller, and not to personal data processed on behalf of the controller.

Measures of pseudonymisation and encryption of personal data

In Transit: All data transmission between the Member's cloud environment, the Processor's infrastructure (AWS), and third-party integrations is encrypted using TLS 1.2 or higher.

At Rest: Personal data stored in databases (e.g., ClickHouse and AWS RDS) and object storage (e.g., AWS S3) is encrypted using industry-standard algorithms (e.g., AES-256).

Measures for ensuring ongoing confidentiality, integrity, availability and resilience of processing systems and services

High-Availability Architecture: The Processor's infrastructure is hosted on AWS and architected across multiple Availability Zones (AZs) to ensure resilience against data center failures. Critical services (e.g., including the “Major Tom” AI engine and ClickHouse clusters) are deployed in redundant configurations to maintain availability.

Network Segregation: Processing systems are isolated within a Virtual Private Cloud (VPC). Database instances and internal tools (e.g., Airflow, Grafana) reside in private subnets with no direct public internet access, reachable only via secure bastions or VPNs.

Immutable Infrastructure: Infrastructure changes are managed via Infrastructure-as-Code (IaC) tools (e.g., Terraform or CloudFormation) to ensure configuration integrity and prevent “configuration drift”.

Data Integrity: Usage data ingested into ClickHouse utilizes checksums to verify data integrity during transfer and storage.

Measures for ensuring the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident

Automated Backups:

Databases: Automated daily snapshots are taken for all production databases (e.g., AWS RDS and ClickHouse) and retained for a minimum of 30 days.

Object Storage: AWS S3 buckets containing raw billing logs utilize Versioning to allow for the restoration of accidental deletions or overwrites.

Disaster Recovery (DR): The Processor maintains a Disaster Recovery plan that leverages Infrastructure-as-Code to rapidly re-provision the entire application stack in a fresh AWS region in the event of a catastrophic region-wide failure.

Recovery Testing: Backup restoration procedures are tested at least annually to verify that data can be recovered within the targeted Recovery Time Objective (RTO).

Processes for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures in order to ensure the security of the processing

Continuous Vulnerability Scanning: Automated security scanning tools are integrated into the CI/CD pipeline to detect vulnerabilities in code dependencies and container images before deployment.

Code Review: All changes to the Blocks Platform and “Major Tom” codebase require approval prior to merging.

Annual Review: The Processor conducts an annual review of access rights, removing dormant accounts and verifying that employee access levels remain appropriate for their roles.

Measures for user identification and authorisation

Access Control: Access to production systems and internal tools (including e.g., Grafana dashboards and Airflow UI) is restricted to authorized personnel on a “need-to-know” basis (Principle of Least Privilege).

Authentication: Multi-Factor Authentication (MFA) is strictly enforced for all administrative access to the AWS console, Identity Provider (IdP), and internal engineering tools.

Role-Based Access: Granular permissions are managed via AWS IAM to ensure services (like Airflow workers) only have the specific permissions required to perform their tasks.

Measures for the protection of data during transmission

Encryption in Transit: All data transmitted between the Member's infrastructure and the Processor's platform over public networks is encrypted using industry-standard protocols (e.g., TLS 1.2 or higher) to prevent interception or tampering.

Private Connectivity: Internal communication between system components (e.g., between the application layer and databases like ClickHouse) occurs within a private virtual network (e.g., AWS VPC). These internal networks are isolated from the public internet using private subnets and firewalls (Security Groups).

Secure Administration: Administrative access to the production environment is restricted to secure channels (e.g., VPN or encrypted SSH tunnels via Bastion Hosts/Session Manager) and is never exposed directly to the public internet.

Measures for the protection of data during storage

Encryption at Rest: All personal data stored in databases, object storage, and block storage volumes is encrypted using strong encryption algorithms (e.g., AES-256). Encryption keys are managed via a centralized Key Management Service (e.g., AWS KMS) with strict access logging.

Public Access Blocking: Storage repositories (e.g., AWS S3 buckets) are configured with “Block Public Access” settings enabled by default to prevent accidental exposure of data.

Logical Separation: Customer data is logically separated within the multi-tenant architecture to prevent unauthorized cross-tenant access. Unique identifiers (e.g., Organization IDs) are enforced at the application and database level to ensure data isolation.

Media Disposal: When storage media is retired or repurposed by the cloud provider, it is sanitized or destroyed in accordance with NIST 800-88 guidelines (as part of the underlying cloud provider's compliance commitments).

Measures for ensuring physical security of locations at which personal data are processed

Data Centers: Blocks utilizes Amazon Web Services (AWS) for hosting. AWS data centers are ISO 27001, SOC 2, and PCI-DSS certified. Blocks personnel do not have physical access to the servers.

Measures for ensuring events logging

System Monitoring: System health, API performance, and security events are continuously monitored and visualized using Grafana.

Audit Trails: Apache Airflow is configured to log all execution attempts, failures, and retries of data pipelines to ensure traceability of data processing activities.

Log Retention: Application and infrastructure logs are retained securely for forensic analysis in the event of a security incident.

Measures for ensuring system configuration, including default configuration

Infrastructure as Code (IaC): All cloud infrastructure resources are provisioned and managed using declarative Infrastructure-as-Code tools (e.g., Terraform or AWS CloudFormation). Configurations are version-controlled, peer-reviewed, and applied via automated pipelines to prevent configuration drift and ensure consistency.

Hardening & Minimal Privilege: Default vendor configurations are reviewed and hardened before deployment. Unnecessary services, ports, and protocols are disabled. Container images are built from minimal, trusted base images (distroless or similar) to reduce the attack surface.

Secrets Management: Configuration files do not contain plain-text secrets. API keys, database credentials, and certificates are managed via a dedicated secrets management service (e.g., AWS Secrets Manager) and injected into applications only at runtime.

Default Deny Policy: Network firewalls and Security Groups are configured with a “Default Deny” policy for inbound traffic, allowing only explicitly authorized protocols and ports required for the service to function.

Measures for internal IT and IT security governance and management

Employee Training: All employees undergo data privacy and security awareness training upon hire and annually thereafter.

Device Security: All employee workstations are encrypted (FileVault/BitLocker) and centrally managed to ensure security updates are applied.

Measures for certification/assurance of processes and products

Reliance on Certified Infrastructure: The Processor builds exclusively on top of AWS, inheriting the physical security and compliance certifications of the underlying provider (ISO 27001, SOC 2 Type II).

Measures for ensuring data minimisation

Restricted Ingestion: The “Major Tom” AI engine and the Blocks Platform are technically configured to ingest only metadata (e.g., AWS Cost & Usage Reports, CloudWatch metrics) and explicitly exclude the content of customer data (e.g., database records, S3 object contents).

Role-Based Filtering: The Processor accesses the controller's AWS accounts only through IAM roles that the controller itself deploys via CloudFormation or Terraform. Each role can be assumed only by a single Processor role (BlocksCustomerAccessRole) presenting a controller-specific External ID, with sessions limited to one hour. Every role carries, in addition to its permissions, an explicit deny layer (the BlocksDataProtectionPolicy, or the BlocksEstimationsDataProtectionPolicy for the estimation role) which removes access to the content of stored data, including secrets, database items, log events, query results, object content, code and instance access. The deny layer applies to the read-only roles and to the execution role alike. The roles differ as follows:

• Read-only roles: BlocksEstimationsReadRole (initial cost estimation), BlocksReadRole and MajorTomReadRole attach the AWS-managed ReadOnlyAccess, AWSBillingReadOnlyAccess, AWSSavingsPlansReadOnlyAccess and AWSOrganizationsReadOnlyAccess policies (and, depending on the role, SecurityAudit or AWSAccountManagementReadOnlyAccess) together with a Blocks custom read policy. These roles cannot create, modify or delete workload resources, purchase commitments, or change IAM, billing, budget or AWS Organizations settings. Their only non-read permissions are (i) starting Cost Explorer Savings Plans recommendation and commitment purchase analyses, IAM policy simulation and CloudWatch Logs Insights queries (whose results are denied by the deny layer), and (ii) for BlocksReadRole and MajorTomReadRole, configuring the enrollment and preferences of AWS's own cost-recommendation services (AWS Trusted Advisor, AWS Compute Optimizer, AWS Cost Optimization Hub and AWS cost optimization automation).
• Execution role (read and limited write): BlocksExecutionRole is used to implement cost optimisation actions. It holds the same read policies and deny layer as BlocksReadRole and, in addition, the AWS-managed AWSSavingsPlansFullAccess policy and the BlocksCostOptimizationWritePolicy, which grant the following write access:
  • Commitment purchases: purchase, queue, return and tag Savings Plans; purchase, modify and exchange Reserved Instances and reserved capacity for Amazon EC2 (including Dedicated Host reservations and EC2 Capacity Blocks), Amazon RDS, Amazon ElastiCache, Amazon Redshift, Amazon OpenSearch Service, Amazon MemoryDB and Amazon DynamoDB; Amazon CloudFront Savings Bundles; AWS Elemental MediaConvert reserved queues and MediaConnect offerings; and Amazon SageMaker training plans. Savings Plans write operations are additionally restricted by a Service Control Policy (BlocksSavingsPlansDenyPolicy), deployed with the stack, to BlocksExecutionRole and to accounts in the Blocks optimisation organisational unit.
  • AWS Organizations (management account only): invite accounts to the organisation, accept, describe and cancel handshakes, move accounts between organisational units, create organisational units, tag and untag organisation resources and enable trusted access for AWS services. These permissions are used to transfer the Blocks-managed commitment accounts into and out of the controller's organisation.
  • Budgets and cost anomaly detection: create and modify AWS Budgets (Budget Actions, which could attach IAM policies or stop instances, are not granted) and create and update Cost Anomaly Detection monitors and subscriptions.
  • Amazon CloudWatch: create, delete, enable and disable alarms whose names begin with "Blocks-".
  • Amazon EventBridge and Amazon SNS: create, modify and delete EventBridge rules, targets and event buses, and SNS topics and subscriptions, whose names begin with "Blocks", and publish events to those event buses.
  • AWS CloudTrail (management account only): create and configure the Blocks organisation trail (trails named "blocks-org-trail-*") and restart logging on an existing, stopped organisation trail of the controller. The Processor cannot reconfigure or delete the controller's own trails.
  • Billing data configuration (management account only): activate cost allocation tags and start their backfill, create and manage AWS Cost and Usage Report and BCM Data Exports definitions, and create and configure (versioning, bucket policy, public access block, encryption, lifecycle, ownership) the S3 bucket named "blocks-cur-data-*" that receives these exports. The execution role holds no permission to write S3 objects.
  • Cost-recommendation services: manage AWS Compute Optimizer settings and enrollment and opt in to AWS Cost Optimization Hub, including creating its service-linked role.
  • Service quotas and support: request service quota increases and, in the management account, open and follow up on AWS Support cases to request an AWS Organizations account-quota increase.
  • Service-linked roles: create the AWS service-linked roles for AWS CloudTrail, Service Quotas and AWS Cost Optimization Hub, and update the policy of the Cost Optimization Hub service-linked role. No other IAM role or policy can be created or changed.
• Scope and audit: In member accounts the execution role holds only the commitment purchase, budget, anomaly detection, CloudWatch, EventBridge, SNS, cost-recommendation, service quota and service-linked role permissions listed above; the AWS Organizations, CloudTrail, billing data configuration and support permissions are deployed in the management account only. All actions taken through any of the roles are recorded in the controller's AWS CloudTrail under the role name. The complete list of allowed and denied API actions for each role is available to the controller on request and is visible in the CloudFormation or Terraform templates the controller deploys.

Controller-applied restrictions: The controller may at any time, without the Processor's consent, apply, extend or amend a permissions boundary, Service Control Policy or Resource Control Policy restricting the roles used by the Processor. The Processor shall not object to, circumvent or seek to have removed any such restriction, and shall assist the controller in defining it on request.

No self-extension of permissions: The Processor shall not extend, amend or add to the permissions held by those roles, shall not create or amend any IAM role or policy applying to them, and shall not create, amend, replace or delete any CloudFormation stack in the controller's AWS environment, in each case without the controller's prior written consent. This obligation applies whether or not the action is technically possible at the time.

Measures for ensuring data quality

Source of Truth Synchronization: The Blocks Platform automatically synchronizes with the AWS API (the “Source of Truth”) multiple times per day to ensure that cost and usage data displayed in the dashboard matches the actual state of the Member's infrastructure.

Automated Validation: Data ingestion pipelines (managed via Airflow) include automated schema validation and integrity checks to reject and alert on corrupt or malformed data packets.

Measures for ensuring limited data retention

Automated Deletion: Customer data is logically segregated by Tenant ID. Upon termination of the Agreement, automated scripts are triggered to delete the Tenant's data from the active database (ClickHouse) and object storage (S3) within 30 days, in accordance with the Agreement.

Log Rotation: System and application logs are subject to a strict retention policy (e.g., 90 days) and are automatically rotated and permanently deleted after the retention period expires.

Measures for ensuring accountability

Record of Processing: The Processor maintains a Record of Processing Activities (ROPA) as required by Art. 30 GDPR.

DPA Management: The Processor enters into Data Processing Agreements with all sub-processors (e.g., AWS, Stripe) to ensure a consistent chain of liability and compliance.

Measures for allowing data portability and ensuring erasure

Continuous Data Availability: The Processor configures the underlying cloud billing data exports (specifically the AWS Cost & Usage Reports) to be delivered directly to a storage bucket (e.g., AWS S3) located within the Controller's own cloud environment. This ensures that the Controller retains a complete, independent, and continuously available archive of all cost and usage data (including historic billing records), which remains fully accessible to the Controller regardless of the status of the Blocks membership.

Right to be Forgotten: Blocks maintains a defined internal procedure to handle “Right to Erasure” requests, which includes the manual purging of specific user identifiers (e.g., email addresses) from support tickets and CRM systems (e.g., Attio/ Pylon).

The controller has authorised the use of the following sub-processors:

Services not engaged as sub-processors

The following services are used by the Processor but do not process personal data on behalf of the controller, and are accordingly not sub-processors under these Clauses. The Processor will notify the controller in advance if this position changes in respect of any of them.

Grafana: the Processor’s observability stack is self-hosted within the Processor’s own AWS environment, in private subnets without public access. No data is transmitted to Grafana Labs.

Supabase: authentication and user profile data for the Blocks Platform are handled by Amazon Cognito within the Processor’s AWS environment, as recorded in entry 1 above. Supabase holds only the Processor’s own sales and customer-relationship records, for which the Processor is its own controller.

Attio and Mailchimp: used for the Processor’s own commercial relationship management and product communications, for which the Processor is its own controller under its own privacy notice.

Fallback mechanism for transfers to third countries: Where a transfer to a recipient outside the EEA is based on the EU-US Data Privacy Framework and that framework is annulled, suspended or ceases to cover the transfer, or where the recipient's certification lapses, the 2021 Standard Contractual Clauses, Module 3, apply automatically to that transfer from that date, without the need for a further agreement between the Parties.