Data Processing Agreement

1. Background and scope

1. This agreement sets out the terms under which Gitoro processes personal data on behalf of the Customer when providing the Gitoro service (Git hosting, code review, issues, CI/CD pipelines, AI features and related services, together “the Service”). It meets the requirements of Article 28(3) of Regulation (EU) 2016/679 (“GDPR”).
2. This agreement forms part of Gitoro’s Terms of Service (“the Main Agreement”) accepted by the Customer. If the two conflict on the processing of personal data, this agreement prevails.
3. The subject matter, nature, purpose, types of personal data and categories of data subjects are described in Annex 1.
4. This agreement applies for as long as Gitoro processes personal data on behalf of the Customer, and ends automatically when that processing has ended and the data has been deleted or returned under section 10.

2. Instructions

1. Gitoro processes personal data only on documented instructions from the Customer. The Main Agreement, this agreement and the Customer’s use and configuration of the Service are the Customer’s complete instructions. Further instructions must be in writing and consistent with the Service.
2. Gitoro may process personal data without instructions only where EU or Danish law requires it. Gitoro will inform the Customer of that requirement before processing, unless the law prohibits this.
3. Gitoro will promptly inform the Customer if, in its opinion, an instruction infringes the GDPR or other EU or member state data protection law.

3. Confidentiality

1. Gitoro grants access to personal data only to employees and contractors who need it to provide, secure or support the Service, and who are bound by a duty of confidentiality.

4. Security

1. Gitoro implements the technical and organisational measures in Annex 2, taking into account the state of the art, costs, and the nature, scope, context and purposes of the processing (Article 32 GDPR). Gitoro may update these measures as long as the overall level of security is not reduced.
2. The Customer is responsible for the security of its own account settings, including who it grants access to, its use of two-factor authentication, access tokens, and the content it chooses to store in the Service.

5. Sub-processors

1. The Customer gives Gitoro general authorisation to engage sub-processors. The sub-processors in use on the date of this agreement are listed in Annex 3 and are approved.
2. Gitoro will notify the Customer at least 30 days before adding or replacing a sub-processor, by email to the workspace owners or by notice in the Service. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may terminate the affected part of the Service and receive a pro-rata refund of prepaid fees for it.
3. Gitoro imposes on each sub-processor, by written contract, data protection obligations no less protective than those in this agreement, and remains fully liable to the Customer for each sub-processor’s performance.

6. Transfers outside the EU/EEA

1. Gitoro stores and processes Customer personal data in the EU/EEA. Gitoro will not transfer it to a country outside the EU/EEA without the Customer’s prior written consent, and then only under a valid transfer mechanism under Chapter V GDPR, such as an adequacy decision or the EU Standard Contractual Clauses.

7. Assistance to the Customer

1. Taking into account the nature of the processing, Gitoro assists the Customer with appropriate technical and organisational measures in responding to requests from data subjects exercising their rights under Chapter III GDPR. Much of this the Customer can do directly in the Service, which lets it export and delete its data. If Gitoro receives such a request directly, it will forward it to the Customer without undue delay and will not respond itself except on the Customer’s instruction.
2. Gitoro assists the Customer, taking into account the information available to Gitoro, in meeting its obligations under Articles 32 to 36 GDPR (security, breach notification, data protection impact assessments and prior consultation).
3. Gitoro may charge reasonable fees for assistance that goes beyond what the Service provides as standard, agreed in advance.

8. Personal data breaches

1. Gitoro will notify the Customer without undue delay, and no later than 48 hours, after becoming aware of a personal data breach affecting the Customer’s personal data.
2. The notification will, as far as then known, describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Gitoro will provide further information as it becomes available, and will take reasonable steps to contain the breach and limit its consequences.

9. Audits and information

1. Gitoro makes available to the Customer the information necessary to demonstrate compliance with this agreement, including through its trust center at resiliate.io/trust/gitoro-com and written answers to reasonable security questionnaires.
2. If that information is not sufficient, or a supervisory authority requires it, the Customer may conduct an audit, itself or through an independent auditor bound by confidentiality, at most once a year, with at least 30 days’ written notice, during normal business hours and without disproportionate disruption. Each party bears its own costs, unless the audit reveals a material breach of this agreement by Gitoro.

10. Deletion and return of data

1. The Customer can export its repositories and data from the Service at any time while its account is active.
2. When the Service ends, Gitoro will delete the Customer’s personal data within 30 days, unless EU or Danish law requires Gitoro to keep it (for example invoices under the Danish Bookkeeping Act). Gitoro keeps replicas of repositories, not separate backups, and replicas are deleted together with the primary copy.

11. Liability, term and law

1. Each party’s liability under this agreement is governed by the limitations of liability in the Main Agreement, except where the GDPR provides otherwise towards data subjects.
2. This agreement applies as long as the Main Agreement is in force or Gitoro processes personal data on behalf of the Customer, whichever is longer.
3. This agreement is governed by Danish law. Disputes go to the Copenhagen City Court (Københavns Byret).

12. Acceptance

1. The Customer accepts this agreement electronically in the Service. The person accepting confirms that they are authorised to bind the Customer.
2. Gitoro accepts this agreement by making it available for acceptance, and its countersignature is given on acceptance. The acceptance record, naming the Customer, the person who accepted, and the date and time, forms part of this agreement and has the same effect as a signed copy.

Annex 1: Description of the processing

Annex 2: Technical and organisational measures

Annex 3: Approved sub-processors