GDPR and European Rocks
PetRock.cloud is a data processor under the General Data Protection Regulation (GDPR). This article covers EU data residency, lawful bases, data subject rights, and how to host your rocks in our EU region.
Our role
When you use PetRock.cloud, you are the data controller for any personal data associated with your workspace, and PetRock.cloud is the data processor. Our Data Processing Agreement (DPA) is automatically incorporated into your subscription terms and is available at petrock.cloud/legal/dpa.
EU data residency
To host your workspace and rocks within the European Union:
- Navigate to Settings → Workspace → Region Lock.
- Toggle EU Data Residency on.
- Confirm. The change cannot be reverted without contacting support.
With EU residency enabled:
- New rocks default to
eu-west-stone-1(Frankfurt, Germany) - Existing rocks in non-EU regions must be migrated or archived
- Audit logs and metadata are stored in EU databases
- Customer support tickets are handled by EU-based staff during EU business hours
- Backups are taken to encrypted storage within the EU only
Note: Enabling EU residency does not change the rock's behavior. EU rocks are inert under the same conditions as rocks in other regions. The setting governs where metadata and management plane data is stored, not the rock's activity (of which there is none).
Lawful basis for processing
We process the following personal data on your behalf, with the following lawful bases:
| Data | Purpose | Lawful basis |
|---|---|---|
| Workspace user emails | Authentication | Contract |
| Audit log actor records | Security monitoring | Legitimate interest |
| Billing contact info | Invoicing | Contract |
| Support ticket content | Issue resolution | Contract |
We do not process special category data (Article 9) and customers should not submit such data to the platform.
Data subject rights
GDPR grants data subjects the following rights, all of which we support:
- Access: Workspace owners can export all data via Settings → Data Export.
- Rectification: Personal data can be edited via Settings → Profile.
- Erasure: Account deletion is available at Settings → Account → Delete Account, subject to the retention requirements detailed in Canceling Your Subscription.
- Portability: The export at Settings → Data Export is provided in JSON format suitable for portability.
- Objection / Restriction: Contact our DPO at dpo@petrock.cloud.
We respond to data subject requests within 30 days.
International transfers
If you have not enabled EU Data Residency, your data may be transferred to the United States. These transfers are protected by:
- Standard Contractual Clauses (SCCs) with our US-based subprocessors
- Supplementary measures including end-to-end encryption and pseudonymization where applicable
- Adherence to the EU-US Data Privacy Framework where the subprocessor is certified
Subprocessors
Our subprocessor list is published at petrock.cloud/legal/subprocessors. EU-residency workspaces use a reduced subprocessor list scoped to EU-based providers.
Data Protection Officer
Contact our DPO for any GDPR-related questions:
- Email: dpo@petrock.cloud
- Postal address available on request