Data Processing Addendum

“Personal data”, “processing”, “controller”, “processor”, “data subject”, and “supervisory authority” have the meanings given in the GDPR. “Sub-processor” means any third party engaged by the Processor to process personal data on the Controller’s behalf. “SCCs” means the Standard Contractual Clauses adopted by the European Commission in Decision 2021/914.

The Controller determines the purposes and means of processing. The Processor processes personal data only on the Controller’s documented instructions, which comprise the Terms of Service, this DPA, the configuration of the Controller’s Workspace, and any further written instruction the parties agree.

The Processor will inform the Controller if, in its opinion, an instruction infringes applicable data protection law, and may suspend the affected processing until the instruction is withdrawn or amended.

The Controller warrants that it has a lawful basis for the processing it instructs, has provided any notice and obtained any consent required, and is entitled to disclose the personal data to the Processor.

The Processor implements and maintains appropriate technical and organisational measures under Article 32 GDPR, including:

• Envelope encryption of secret material with AES-256-GCM, using per-secret data keys wrapped by a per-organization master key held separately from the database.
• Encryption in transit using TLS 1.2 or better for all connections.
• Role-based access control, scoped tokens, approval workflows, and short-lived brokered credentials.
• Multi-factor authentication and passkey support for user accounts; mandatory multi-factor authentication for production access by personnel.
• Append-only audit logging of credential issuance and administrative change.
• Segregation of customer data by organization, with authorization enforced on every request.
• Regular backup, restoration testing, dependency patching, and vulnerability management.
• Personnel bound by written confidentiality obligations and trained on data protection.

The Processor may update these measures provided the level of protection is not materially reduced.

The Controller grants a general authorization for the Processor to engage sub-processors. The current list is published on the sub-processors page and forms part of this DPA.

1. 01The Processor will give at least thirty (30) days’ notice before a new sub-processor begins processing personal data.
2. 02The Controller may object on reasonable data protection grounds within that period by writing to the privacy contact.
3. 03If the objection cannot be resolved, the Controller may terminate the affected part of the Service and receive a pro-rata refund of prepaid, unused fees.
4. 04The Processor imposes data protection obligations on each sub-processor no less protective than those in this DPA, and remains fully liable for their performance.

Where the Processor transfers personal data out of the EEA, the UK, or Switzerland to a country without an adequacy decision, the transfer is made under the SCCs, incorporated here by reference and completed as follows: Module Two (controller to processor) applies; the docking clause applies; the governing law and forum are those of the Controller’s member state; Annexes I to III are populated by the “Details of processing”, “Security measures”, and “Sub-processors” sections of this DPA.

For UK transfers, the ICO’s International Data Transfer Addendum to the SCCs applies. For Swiss transfers, references to the GDPR are read as references to the FADP and the competent authority is the FDPIC.

The Processor has assessed the laws of the destination countries and will notify the Controller if it becomes unable to comply with the SCCs.

• Data subject requests - the Processor will not respond directly to a data subject except to confirm the request should go to the Controller, and will assist the Controller in responding, taking into account the nature of the processing.
• Impact assessments - the Processor will provide reasonable assistance with data protection impact assessments and prior consultations with supervisory authorities.
• Government access requests - the Processor will notify the Controller of any legally binding request for disclosure unless prohibited from doing so, and will challenge requests that appear unlawful or overbroad.

The Processor will notify the Controller without undue delay, and in any event within seventy-two (72) hours, of becoming aware of a personal data breach affecting the Controller’s personal data.

The notification will describe the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed. Information will be provided in phases where it is not all available at once.

Breach notifications are sent to the Workspace owner’s email address and to any security contact the Controller has registered. Notify the Processor of a suspected breach at security@shortspan.dev.

The Processor will make available the information necessary to demonstrate compliance with this DPA, including its current security documentation and any third-party audit reports it holds.

Where documentation is insufficient, the Controller may conduct an audit no more than once in any twelve-month period, on thirty (30) days’ notice, during business hours, subject to confidentiality, and without unreasonably disrupting the Processor’s operations. The Controller bears its own costs and, where the audit requires significant Processor resource, the Processor’s reasonable costs. An audit may be triggered more often following a personal data breach.

On termination, the Controller may export its data for thirty (30) days. After that period the Processor deletes personal data from primary systems, and encrypted backups age out within a further sixty (60) days.

The Processor may retain personal data where required by law, in which case it will continue to protect it under this DPA and will process it only for the purpose requiring retention.

Liability under this DPA is subject to the limitations in the Terms of Service, except where applicable data protection law does not permit that limitation.

In the event of conflict, the order of precedence is: the SCCs, this DPA, then the Terms of Service.

Contact for data protection matters: dpo@shortspan.dev. Postal address: Shortspan Technologies, -.