Skysize Cloud Data Processing Addendum

Last update: 26 Oct 2026

1. Scope and acceptance

This Cloud Data Processing Addendum (the "Addendum") forms part of the agreement under which Skysize SRL, Avenue Arnaud Fraiteur 15/23, 1050 Ixelles, Belgium, registered with the BCE/KBO under number 1011.592.808 ("Skysize"), provides its Services to the customer ("Customer"), including Skysize's Terms of Service (the "Agreement").

1.1 This Addendum applies whenever Skysize processes Customer Personal Data on behalf of Customer in providing the Services. It sets out the terms required by Article 28(3) GDPR.

1.2 Customer accepts this Addendum by accepting the Agreement or by using the Services. A signed copy is available on request via the Skysize Helpdesk.

1.3 This Addendum replaces any terms previously applicable to the processing of Customer Data.

2. Definitions

2.1 In this Addendum:

• "Applicable Data Protection Law" means Regulation (EU) 2016/679 ("GDPR"), the Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data, and, where applicable, the UK GDPR and the Swiss Federal Act on Data Protection.
• "Customer Data" means all data, including databases, files, attachments and repository contents, uploaded to or created in the Services by or on behalf of Customer.
• "Customer Personal Data" means the personal data contained in Customer Data.
• "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data on systems managed or controlled by Skysize or its Subprocessors.
• "Services" means the managed Odoo hosting, Bring Your Own Server, On-Premise and related support services provided by Skysize under the Agreement.
• "SCCs" means the standard contractual clauses approved by Commission Implementing Decision (EU) 2021/914.
• "Subprocessor" means any third party engaged by Skysize to process Customer Personal Data.

2.2 The terms "controller", "processor", "data subject", "personal data" and "processing" have the meaning given in the GDPR. Capitalised terms not defined here have the meaning given in the Agreement.

3. Roles and instructions

3.1 Skysize acts as processor of Customer Personal Data. Customer acts as controller, or as processor on behalf of its own clients (for example, an Odoo partner hosting databases for its clients). In the latter case, Customer warrants that the relevant controller has authorised Skysize's processing, Skysize acts as Customer's sub-processor, and Customer remains Skysize's sole point of contact.

3.2 Skysize processes Customer Personal Data only on Customer's documented instructions, including with regard to transfers to third countries. The Agreement, this Addendum, and Customer's configuration and use of the Services constitute Customer's complete instructions. Any further instruction must be agreed in writing.

3.3 Skysize will promptly inform Customer if, in its opinion, an instruction infringes Applicable Data Protection Law. Where Skysize is required by EU or Member State law to process Customer Personal Data otherwise than on Customer's instructions, it will inform Customer before processing, unless that law prohibits it.

3.4 Customer is responsible for the lawfulness of the processing it instructs, including having a valid legal basis and providing any required information to data subjects.

3.5 Skysize does not sell Customer Data and does not use it for its own purposes. Appendix 1 describes the subject matter and details of the processing.

4. Personnel

4.1 Skysize limits access to Customer Data to personnel who need it to provide the Services, to resolve an issue, to answer a support request from Customer, to protect the security of the Services, or to comply with the law.

4.2 All persons authorised to process Customer Personal Data are bound by a contractual or statutory obligation of confidentiality and receive appropriate data protection and security training.

5. Security

5.1 Skysize implements and maintains the technical and organisational measures described in Appendix 2, in accordance with Article 32 GDPR. These measures are operated within Skysize's information security management system, certified to ISO/IEC 27001:2022.

5.2 Skysize may update these measures over time, provided the update does not materially reduce the overall level of protection of Customer Personal Data.

5.3 Customer is responsible for its own use of the Services, including: securing its account credentials and user access to its Odoo databases; the code and modules it deploys; and any copies of Customer Data it keeps outside the Services.

6. Subprocessors

6.1 Customer gives Skysize a general authorisation to engage Subprocessors. The current Subprocessors are listed in Appendix 3.

6.2 Skysize engages each Subprocessor under a written contract imposing data protection obligations no less protective than those in this Addendum. Skysize remains fully liable to Customer for the performance of its Subprocessors' obligations.

6.3 Skysize will give Customer at least thirty (30) days' notice of any new or replacement Subprocessor, by email to Customer's account contact and by updating Appendix 3.

6.4 Customer may object to a new Subprocessor on reasonable data protection grounds within that notice period. The Parties will discuss the objection in good faith. If it cannot be resolved, Customer may terminate the affected Services and receive a refund of any prepaid fees for the unused period.

6.5 Under the Bring Your Own Server and On-Premise Services, Customer Data is stored on infrastructure chosen and contracted by Customer. That infrastructure provider is not a Subprocessor of Skysize, and its security is Customer's responsibility.

7. International transfers

7.1 Customer Data is hosted in the region selected by Customer (Appendix 3). Customer's choice of region is an instruction under Article 3.2. Skysize will not move Customer Data to another region without Customer's instruction.

7.2 Where Customer Personal Data subject to the GDPR is transferred, including by a Subprocessor, to a country not covered by an adequacy decision of the European Commission, Skysize ensures an appropriate safeguard under Chapter V GDPR: the SCCs in the relevant module, or the recipient's certification under the EU-U.S. Data Privacy Framework.

7.3 Where Customer is established outside the European Economic Area and the SCCs are required between Customer and Skysize, Module 4 (processor to controller) of the SCCs is incorporated into this Addendum by reference.

7.4 For transfers subject to the UK GDPR or the Swiss Federal Act on Data Protection, the SCCs apply with the adaptations required by those laws, including the UK International Data Transfer Addendum.

8. Data subject requests and assistance

8.1 The Services enable Customer to access, rectify, restrict, delete and export Customer Data, including a full export of its databases via the control panel. Customer is responsible for responding to data subject requests using these features.

8.2 If Skysize receives a request from a data subject relating to Customer Personal Data, it will refer the data subject to Customer, promptly notify Customer, and not respond itself without Customer's authorisation.

8.3 Taking into account the nature of the processing and the information available to it, Skysize will provide Customer with reasonable assistance in meeting its obligations under Articles 32 to 36 GDPR, including data protection impact assessments and prior consultations with supervisory authorities. Assistance going beyond the documentation Skysize makes available may be charged at Skysize's standard rates.

9. Personal Data Breach

9.1 Skysize will notify Customer without undue delay, and in any event within forty-eight (48) hours, after becoming aware of a Personal Data Breach. Notification is sent to Customer's account contact.

9.2 The notification will describe, to the extent known: the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences, the measures taken or proposed, and a contact point. Information not available at first will be provided in phases without undue delay.

9.3 Skysize will promptly take reasonable steps to contain the breach and mitigate its effects, and will cooperate with Customer. A notification is not an acknowledgement of fault or liability.

9.4 Customer remains responsible for any notification to supervisory authorities and data subjects required of the controller.

10. Return and deletion

10.1 Customer can export a complete backup of its Customer Data at any time during the Agreement via the control panel.

10.2 When a Service is cancelled, the related databases are deactivated for a grace period of four (4) weeks, during which Customer may reactivate the Service or request an export. After that period, Skysize deletes the Customer Data from its production systems.

10.3 Customer Data deleted from production may remain in Skysize's secured, immutable backups for up to twelve (12) months, after which those backups are automatically destroyed. Skysize will not use these copies for any purpose other than maintaining the integrity of its backups, unless Customer or the law requires otherwise. This Addendum continues to apply to them until their destruction.

10.4 Skysize will confirm deletion in writing on Customer's request. Skysize may retain Customer Data where EU or Member State law requires it, and will protect such data under this Addendum.

11. Audits

11.1 Skysize makes available the information necessary to demonstrate compliance with this Addendum, including its ISO/IEC 27001:2022 certificate, scope and auditor, published in the Skysize Trust Center at trust.skysize.io. Skysize will also answer reasonable security questionnaires.

11.2 Where that information is insufficient to demonstrate compliance, or where a supervisory authority requires it, Customer may carry out an audit, itself or through an independent auditor bound by confidentiality who is not a competitor of Skysize. Audits are limited to once per twelve (12) months (except following a Personal Data Breach or at a supervisory authority's request), require thirty (30) days' written notice, and take place during business hours.

11.3 Audits must not give access to other customers' data and must not unreasonably disrupt the Services. Audits of Subprocessors' facilities are covered by the Subprocessors' own certifications and audit reports. Each Party bears its own costs.

11.4 Skysize will remedy any material non-compliance identified by an audit within a reasonable period.

12. General

12.1 Liability. Each Party's liability under this Addendum is subject to the limitations of liability in the Agreement, except where Applicable Data Protection Law provides otherwise.

12.2 Duration. This Addendum remains in force for as long as Skysize processes Customer Personal Data, including in backups, and survives termination of the Agreement until that data is deleted.

12.3 Precedence. In case of conflict, the SCCs (where applicable) prevail over this Addendum, and this Addendum prevails over the Agreement with regard to the processing of Customer Personal Data.

12.4 Updates. Skysize may update this Addendum to reflect changes in Applicable Data Protection Law or in its Subprocessors (Article 6), provided the update does not reduce the protection of Customer Personal Data. Skysize will notify Customer of material changes.

12.5 Governing law. This Addendum is governed by Belgian law, and disputes fall under the exclusive jurisdiction of the courts of Brussels, unless the SCCs require otherwise.

Appendix 1: Details of processing

Appendix 2: Security measures

Further details are available in the Skysize Trust Center at trust.skysize.io.

Appendix 3: Subprocessors and locations

Subprocessors

Hosting regions

Under the Bring Your Own Server and On-Premise Services, Customer Data is stored on infrastructure selected by Customer (Article 6.5).