Data processing agreement

1. Roles and scope

You are the controller of the personal data described in Annex I. We are your processor for it, and we process it only to provide the service. This agreement applies for as long as we hold any of it and prevails over the terms of service on any question of data protection.

The personal data of your own GaugeSeal users — the colleagues you invite — is a narrower case: we are the controller for their sign-in addresses, because we decide how sign-in works. That is described in the privacy policy, not here.

2. Instructions

We process on your documented instructions. Your instructions are: this agreement, the settings you choose in the product (the workspaces you connect, the contracts you declare, the retention bounds on your account), and anything else you ask us in writing. We tell you if an instruction appears to us to breach data protection law, and we may decline it.

We do not use your data for anything else. Not to train a model, not to build a benchmark, not to derive an aggregate across customers, not for marketing.

3. Confidentiality

Access is limited to people who need it to run the service, bound by confidentiality obligations that survive the end of their engagement. Today that set is one person: whoever operates the service.

4. Security

We implement the measures in Annex II and keep them at least as effective for the life of this agreement. Annex II describes a system as built, not an intention; if a measure changes materially we tell you.

5. Sub-processors

You give general authorisation for the sub-processors in Annex III. We impose the same obligations on each of them by contract and remain responsible for their performance.

Before adding or replacing one we give you 30 days' notice. You may object on reasonable data-protection grounds within that period; if we cannot resolve the objection you may terminate the affected part of the service, and we delete accordingly.

6. Assisting you with data subjects

If a data subject comes to us we do not answer for you — we tell them to contact you and let you know. So far as we can, and taking the nature of the processing into account, we assist you with requests you receive, by appropriate technical measures:

• Erasure — one request rewrites that person's identity across every event of your account, including inside retained raw payloads. Event existence and timestamps survive, so your history stays true; the last backup copy expires within 7 days.
• Access and portability — we produce what we hold about an identified person on request.
• Rectification and restriction — handled case by case; the store is append-only by design, and erasure is the one sanctioned rewrite.

7. Personal data breaches

We notify you without undue delay and in any case within 48 hours of becoming aware of a personal data breach affecting your data, with what we know: what happened, which categories and roughly how many records, the likely consequences, and what we are doing. We do not notify your supervisory authority — that is yours to do, and 48 hours leaves you time.

8. Assessments and prior consultation

We assist you with data protection impact assessments and any prior consultation, taking into account the nature of the processing and what we know that you cannot.

9. Deletion at the end

On termination, or earlier if you ask, we delete your workspaces within 30 days: every row a workspace owns goes in a single operation. Backup snapshots containing it expire within a further 7 days and are not restored except to recover the service. We return an export first if you ask for one. We keep nothing else, except where law requires it — and then only that.

10. Information and audit

We give you the information you need to demonstrate compliance with Article 28, and this document, its annexes and the public security pages are the first answer. Beyond them you may audit us once a year on 30 days' notice, or more often after a breach affecting your data or a change of sub-processor you objected to; audits happen under confidentiality, at your cost, and without access to another customer's data. A recognised third-party report, once we hold one, satisfies this clause.

11. International transfers

We do not transfer your personal data outside the European Union. Everything is processed in one EU region, by the parties in Annex III, at the locations listed there. If that ever has to change we will tell you first, and put an Article 46 safeguard in place before it does.

12. This document

This is our template. If you have your own DPA we will read it and are usually able to sign it — the annexes below are the part you actually need either way. Governing law and venue: jurisdiction.

Annex I — the processing

A · The parties

B · Description of the processing

C · Competent supervisory authority

Yours, determined by your establishment. Ours: the authority that supervises us.

Annex II — technical and organisational measures

Article 32 measures, as implemented. Each is a property of the running system.

Annex III — sub-processors

No others. For completeness, the places your data sits:

• The server, in the European Union — one region, no replication to any other.
• Operator-controlled hardware in the European Union, holding pulled copies of the same daily backups.

Operational alerting and the certificate authority in front of the service receive no personal data: alerts carry job kinds and counts, and certificates carry a hostname.

Signatures