Data Processing Agreement

1. Purpose and structure

The purpose of this DPA is to set out the parties' obligations under Article 28 of Regulation (EU) 2016/679 (the "GDPR") in respect of any personal data that fDeploy processes on the Customer's behalf. In the event of a conflict between this DPA and the General Terms or Product Terms in respect of personal data, this DPA prevails.

2. Definitions

Terms such as "controller", "processor", "data subject", "personal data", "processing", "supervisory authority", and "personal data breach" have the meaning given in the GDPR. Capitalised terms not defined here have the meaning given in the General Terms.

3. Roles and the no-end-user-data principle

3.1 The Software is self-hosted

The Software is installed on, and operated from, infrastructure that the Customer controls. The Software does not transmit deployment data, project data, audit logs, user accounts, configuration, or any data the Customer or its users put into the Software back to fDeploy or to any third party. fDeploy does not have access to the data inside the Customer's fDeploy Server instance, and fDeploy is not the processor of that data.

3.2 The Customer is sole controller of its data

In respect of all personal data inside the Customer's fDeploy Server instance — including any personal data of the Customer's users, customers, employees, contractors, and any data subjects whose personal data may be embedded in deployment artefacts — the Customer is the sole controller. fDeploy has no role.

3.3 Where this DPA does apply

This DPA applies to the limited categories of personal data that the Customer voluntarily provides to fDeploy in connection with the Subscription, as described in Section 4.

4. Where personal data is actually involved

4.1 Customer contact data — fDeploy is controller

fDeploy holds limited contact details for individuals at the Customer who act as billing, notice, legal, technical, or licence-administration contacts. fDeploy uses this data to invoice the Customer, to send service and renewal communications, to provide technical support, and to comply with its own legal obligations (for example, accounting and tax law). For this data, fDeploy is the controller and processes it under its own Privacy Notice. It is not personal data processed on the Customer's behalf and is therefore not within the scope of this DPA.

4.2 Support material the Customer chooses to send — fDeploy is processor

When the Customer raises a support request, the Customer may voluntarily send fDeploy material that contains personal data (for example, log files, screenshots, configuration exports, or stack traces). fDeploy processes that material solely to investigate and resolve the support request. For this material, fDeploy acts as the Customer's processor, and this DPA applies. The Customer is responsible for redacting or minimising personal data before sending material to fDeploy where it is reasonable to do so.

4.3 Licence records — fDeploy is controller

fDeploy issues offline-signed licence files to the Customer. These contain the Customer's legal name, the scope of the Subscription, and the licence period. fDeploy retains a record of issued licences for the purposes of contract administration, audit, and the prevention of unauthorised use of the Software. fDeploy is the controller of these records.

4.4 Customer warranty of lawful basis

The Customer warrants that, in respect of any personal data it provides to fDeploy for processing under Section 4.2, (a) it has a lawful basis under Article 6 GDPR for the processing, (b) where the data includes special categories of personal data within the meaning of Article 9 GDPR, an exception under Article 9(2) applies, (c) it has provided any required notices to the relevant data subjects under Articles 13 and 14 GDPR, and (d) fDeploy's processing in accordance with this DPA will not cause the Customer to breach the GDPR or any other applicable data protection law. The Customer is responsible for assessing whether the personal data it sends fDeploy is necessary for the support request and for redacting or minimising it where it is reasonable to do so.

5. Processor obligations

To the extent fDeploy acts as a processor under Section 4.2, fDeploy will:

• process the personal data only on documented instructions from the Customer (the act of sending the support material is itself a documented instruction to investigate the relevant request), and only to the extent and for the purposes described in Annex A;
• ensure that personnel authorised to process the personal data are bound by appropriate confidentiality obligations;
• implement and maintain the technical and organisational measures described in Annex C;
• assist the Customer, taking into account the nature of the processing and the information available, in fulfilling its obligations under Articles 32 to 36 GDPR (security, breach notification, data protection impact assessments, and prior consultation), at the Customer's reasonable request;
• not engage any sub-processor in respect of such personal data without complying with Section 6;
• on the Customer's request, return or delete the personal data in accordance with Section 12;
• make available to the Customer the information reasonably necessary to demonstrate compliance with Article 28 GDPR, in accordance with Section 11;
• immediately inform the Customer if, in fDeploy's opinion, an instruction infringes the GDPR or any other applicable data protection law.

6. Sub-processors

At the date of this DPA, fDeploy uses no sub-processors in respect of personal data processed on the Customer's behalf under Section 4.2. The current sub-processor list is set out in Annex B.

The Customer gives a general authorisation for fDeploy to engage sub-processors, subject to the conditions in this Section. Before engaging a new sub-processor that will process personal data on the Customer's behalf, fDeploy will:

• update Annex B (published at fdeploy.com/legal/dpa) and notify the Customer at the contact email address held on file at least thirty (30) days before the new sub-processor begins processing personal data;
• enter into a written agreement with the sub-processor that imposes data protection obligations no less protective than those in this DPA;
• remain liable to the Customer for the acts and omissions of the sub-processor as if they were its own.

The Customer may object to a new sub-processor on reasonable data-protection grounds by written notice within thirty (30) days of being notified. If the parties cannot resolve the objection in good faith within a further thirty (30) days, the Customer may terminate the affected Subscription on written notice and will receive a pro rata refund of any prepaid fees for the unused portion of the License Term. This is the Customer's sole remedy.

7. Security

fDeploy implements and maintains the technical and organisational measures described in Annex C, designed to ensure a level of security appropriate to the risk of the limited processing it performs under this DPA. fDeploy may update Annex C from time to time provided that the overall level of protection is not reduced.

8. Personal data breaches

fDeploy will notify the Customer without undue delay, and in any event within seventy-two (72) hours of becoming aware, of any personal data breach affecting personal data processed on the Customer's behalf under Section 4.2. The notification will include, to the extent then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed.

For the avoidance of doubt, fDeploy has no visibility into and no obligation to notify the Customer about security incidents affecting the Customer's own fDeploy Server instance or the Customer's own infrastructure. The Customer is solely responsible for monitoring, detecting, and responding to incidents in its environment.

9. Assisting with data subject requests

Because the personal data fDeploy processes on the Customer's behalf is limited to support material the Customer chooses to send, the most effective response to a data subject request relating to that data is normally action by the Customer in its own systems. To the extent fDeploy receives a data subject request relating to personal data processed on the Customer's behalf, fDeploy will, taking into account the nature of the processing and the information available, assist the Customer by appropriate technical and organisational measures to fulfil its obligation to respond to that request. fDeploy will not respond to the data subject directly except as required by law or as instructed by the Customer.

10. International transfers

fDeploy is established in Sweden, and the servers on which it stores and processes any personal data it holds on the Customer's behalf under this DPA are located in Sweden. fDeploy does not currently transfer such personal data to a country outside the European Economic Area. If that changes, fDeploy will rely on a transfer mechanism recognised under Chapter V GDPR (such as the European Commission's standard contractual clauses) and will update Annex B accordingly.

11. Audits

fDeploy will, on the Customer's reasonable written request and no more than once in any twelve-month period (except where required by a supervisory authority or following a confirmed personal data breach), make available to the Customer information reasonably necessary to demonstrate compliance with Article 28 GDPR.

Where information alone is not sufficient, fDeploy will allow for and contribute to audits, including inspections, conducted by the Customer or by an independent auditor mandated by the Customer and reasonably acceptable to fDeploy. Audits will be carried out (a) on at least thirty (30) days' prior written notice, (b) during normal business hours, (c) in a manner that minimises disruption to fDeploy's operations, and (d) subject to appropriate confidentiality obligations. The Customer bears its own and the auditor's costs unless the audit reveals a material breach by fDeploy of this DPA, in which case fDeploy will bear reasonable costs.

12. Term, return, and deletion

This DPA applies for as long as fDeploy processes personal data on the Customer's behalf. On termination of the Agreement, or at the Customer's earlier written request, fDeploy will delete the personal data it processes on the Customer's behalf, except to the extent retention is required by law (in which case the data remains subject to this DPA for as long as it is retained). Routine support records may include limited personal data which fDeploy retains for the purposes set out in Annex A.

13. Liability

Each party's liability arising out of or in connection with this DPA is subject to the limitations and exclusions of liability set out in the General Terms. Nothing in this DPA limits or excludes either party's direct liability to a data subject under Article 82 GDPR.

Annex A — Processing details

Subject matter of the processing: investigation and resolution of support requests raised by the Customer.

Duration of the processing: for the duration of the Subscription, plus any period of statutory retention.

Nature and purpose of the processing: review of material the Customer voluntarily provides to fDeploy as part of a support request, in order to diagnose and resolve the issue.

Types of personal data: any personal data the Customer chooses to include in support material — typically names, email addresses, IP addresses, hostnames, user identifiers, and any free-text content present in logs, screenshots, or configuration exports.

Categories of data subjects: any data subject whose personal data the Customer chooses to include in support material — typically the Customer's users, administrators, employees, and contractors.

Retention of raw support material: support material in its original form as submitted by the Customer (including log files, screenshots, configuration exports, and stack traces) is retained only for as long as is necessary to resolve the relevant support request and is deleted no later than sixty (60) days after the support request is resolved.

Retention of summarised material: where useful for recurring-issue analysis, audit, or quality improvement, fDeploy may retain a summarised or pseudonymised record of the support interaction for up to twenty-four (24) months after the support request is resolved. "Summarised or pseudonymised" means that direct personal identifiers (such as names, email addresses, IP addresses, and free-text content from which a data subject could be identified) have been removed or replaced with non-reversible identifiers. Pseudonymised data remains personal data under the GDPR and continues to be processed in accordance with this DPA.

Earlier deletion: on the Customer's written request, fDeploy will delete material earlier where it is not required for the purposes set out above and where retention is not required by law.

Annex B — Sub-processors

At the effective date of this DPA, fDeploy uses no sub-processors for the processing of personal data on the Customer's behalf under this DPA. The Customer is notified of additions in accordance with Section 6.

Disclosure of other third-party processors (outside the scope of this DPA)

For transparency, fDeploy uses the following third-party services in connection with its own controller-side processing of Customer billing-contact and payment data described in Section 4.1. These services do not process the Customer Data described in Section 4.2 and are therefore outside the scope of this DPA. fDeploy's relationship with each of them is governed by that provider's own data-protection terms.

• Cloudflare, Inc. (United States; with EU entity Cloudflare Germany GmbH) — content delivery, DDoS protection, and bot mitigation for fdeploy.com and docs.fdeploy.com. Processes HTTP request data (including the IP addresses of visitors to those sites) for security and operational purposes.
• Microsoft Ireland Operations Limited (Ireland) — Microsoft 365 services, including the business email account that handles correspondence to and from [email protected] and the Outlook mailbox used to maintain fDeploy's customer-update mailing list.
• Stripe Payments Europe, Limited (Ireland) — payment processing, billing, and tax determination (Stripe Tax) for paid Subscriptions. Acts as an independent controller for its own anti-money-laundering, fraud-prevention, and regulatory obligations, and as fDeploy's processor in respect of the payment-processing service. Stripe's data-protection terms are published at stripe.com.

Annex C — Technical and organisational measures

fDeploy implements the following technical and organisational measures, appropriate to the limited processing performed under this DPA:

• Access control. Support material is stored in systems accessible only to fDeploy personnel who require access for support purposes. Access is granted on a least-privilege basis, requires individual user accounts, and requires multi-factor authentication for any account that can access support material.
• Encryption. Support material is encrypted in transit using current industry-standard protocols (at minimum TLS 1.2) and is stored on systems that provide encryption at rest.
• Personnel. fDeploy personnel with access to personal data are bound by contractual confidentiality obligations and receive training on data protection obligations relevant to their role.
• Storage and retention. Support material is retained only for as long as is necessary for the purposes set out in Annex A and is then deleted in accordance with documented retention rules.
• Logging and monitoring. Access to systems holding support material is logged. Logs are reviewed periodically and on the occurrence of any security event.
• Incident response. fDeploy maintains a documented incident-response process covering the detection, assessment, containment, and notification of personal data breaches affecting personal data processed on the Customer's behalf.
• Vendor due diligence. Before engaging any sub-processor that will process personal data on the Customer's behalf, fDeploy assesses the sub-processor's security and data protection practices and enters into a written agreement imposing obligations no less protective than those in this DPA.
• Review. fDeploy reviews these measures periodically and updates them to reflect changes in risk, technology, and applicable law.