This Data Processing Agreement ("DPA") forms part of the Terms of Service or other written or electronic agreement ("Principal Agreement") between HashOps ("Data Processor", "Provider") and the customer ("Customer", "Data Controller") using HashOps mining infrastructure management services.
1.Definitions and Roles
1.1. Roles: In relation to the processing of Customer Data, the Customer acts as the Data Controller (determining the purposes and means of processing) and HashOps acts solely as the Data Processor processing data on behalf of the Customer.
1.2. Scope of Processing: HashOps employs a Privacy-First architecture. Processing is strictly limited to technical and operational data necessary for system integrity.
2.Nature and Categories of Data Processed
2.1. Processed Data: HashOps processes only the following telemetry and network data:
- Telemetry: Equipment Temperature, Fan RPM, Hashrate status.
- Network Identifiers: Internal IP addresses, MAC addresses.
- Administrative Data: Basic Customer/Admin Email.
2.2. Excluded Data: HashOps explicitly DOES NOT process, monitor, or store:
- Exact financial earnings or balances.
- Cryptocurrency wallet addresses.
- Payout histories.
- Raw mining pool traffic (handled via split-tunneling, completely bypassing HashOps servers).
3.Exemption for On-Premises and White-Label Deployments
3.1. In instances where the Customer subscribes to an Enterprise or White-label plan and deploys the HashOps software on their own infrastructure (On-Premises), Customer acknowledges that HashOps does not host, process, or have access to Customer Data.
3.2. In such deployments, HashOps acts strictly as a software licensor. The data processing obligations outlined in this DPA shall not apply, and HashOps disclaims any and all liability for data breaches, unauthorized access, or data loss occurring within the Customer-controlled infrastructure.
4.Security and Confidentiality
4.1. Technical Measures: HashOps implements strict security measures, including:
- Encryption in transit via SSTP over Port 443 (AES-256).
- Customer environment isolation using dedicated /24 IP subnets to prevent cross-tenant data leakage or NAT overlapping.
- Strict Role-Based Access Control (RBAC). Support access is limited to tokenized, time-bound Temporary Support Access granted explicitly by the Customer.
4.2. Personnel Confidentiality: HashOps ensures that any personnel authorized to process Customer Data are bound by strict obligations of confidentiality.
5.Sub-processors
5.1. General Authorization: Customer grants HashOps general authorization to use third-party Sub-processors (listed in Appendix 1) to provide cloud infrastructure.
5.2. Changes and Objections: HashOps will notify Customer of any changes concerning the addition or replacement of Sub-processors. Customer has ten (10) days to object in writing based on reasonable data protection grounds. If HashOps cannot accommodate the objection, Customer's sole and exclusive remedy is the termination of the affected services without liability to HashOps.
6.Data Subject Requests (DSR)
6.1. The responsibility for responding to requests from end-users or Data Subjects rests entirely with the Customer.
6.2. If HashOps receives a direct request, it will promptly forward it to the Customer. HashOps's obligation is limited to providing the existing technical functionality within the platform to allow the Customer to retrieve or delete data. Any additional manual assistance requested by the Customer shall be subject to a separate written agreement and additional professional service fees.
7.Audit Rights
7.1. Due to the multi-tenant nature of the cloud environment, HashOps does not permit physical access to data centers or infrastructure.
7.2. Customer's audit rights are strictly fulfilled through HashOps's provision of written responses to reasonable security questionnaires, limited to one (1) time per calendar year.
8.Personal Data Breach Management
8.1. In the event of a confirmed security incident leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of Customer Data, HashOps will notify the Customer without undue delay and, where feasible, within seventy-two (72) hours after becoming aware of it.
8.2. HashOps will provide reasonable cooperation to assist the Customer in mitigating the impact and fulfilling reporting obligations.
9.Data Deletion and Retention
9.1. Upon termination of the Principal Agreement or upon explicit written request by the Customer, HashOps will delete or irreversibly anonymize all telemetry and network data within thirty (30) days, unless further retention is required by applicable law.
10.Limitation of Liability
10.1. Absolute Cap: Notwithstanding any other provision in this DPA or the Principal Agreement, HashOps's total aggregate liability for any claims, data breaches, or violations arising out of or related to this DPA shall be strictly limited to the total amounts paid by the Customer for the specific services during the six (6) months immediately preceding the event causing the liability. Maximum liability is calculated as:
10.2. Exclusion of Damages: In no event shall HashOps be liable for any indirect, incidental, punitive, or consequential damages, including but not limited to loss of profits, lost mining revenue, or hardware depreciation, even if advised of the possibility of such damages.
11.Governing Law and Jurisdiction
11.1. This DPA and any dispute or claim arising out of or in connection with it shall be governed by and construed in accordance with the laws of the Sultanate of Oman.
11.2. The competent courts of Muscat, Sultanate of Oman shall have exclusive jurisdiction to settle any dispute or claim arising out of or in connection with this DPA.
A1.Appendix 1: Approved Sub-processors
As of the Effective Date, Customer authorizes HashOps to engage the following Sub-processors for the hosting and infrastructure of the cloud-based services (Starter and Professional plans):
Note: HashOps relies on the strict security measures implemented by these providers; however, HashOps's liability regarding these Sub-processors remains subject to the limitations defined in Section 10 of this DPA.