Legal

Data Processing Agreement

The terms under which ShadowDB processes personal data on your behalf, for customers subject to GDPR and similar laws.

Draft · This document is under legal review and is not yet in effect. Text in [BRACKETS] is still to be filled in.

01Roles and scope

This DPA forms part of the Terms of Service. You are the controller and ShadowDB is the processor of personal data contained in the repositories, migrations and metadata you send to the service.

02Our commitments

We process personal data only on your documented instructions, which are the Terms of Service and your use of the service.

Everyone with access is bound by confidentiality. We apply the technical and organisational measures described on the Security page.

We help you answer data subject requests and carry out impact assessments, and notify you of a personal data breach without undue delay, within [48] hours of becoming aware of it.

03Sub-processors

You authorise the sub-processors listed at [SUB-PROCESSOR LIST URL]. We will give [30] days' notice before adding or replacing one, and you may object.

04International transfers

[STANDARD CONTRACTUAL CLAUSES MODULE 2/3, UK ADDENDUM, AND TRANSFER IMPACT ASSESSMENT]

05Deletion and audits

When the agreement ends, deleting your organisation purges its data after 30 days. We make available the information needed to show compliance with this DPA. [AUDIT RIGHTS AND FREQUENCY]

06Annexes

[ANNEX I: PARTIES AND DESCRIPTION OF PROCESSING] [ANNEX II: SECURITY MEASURES] [ANNEX III: SUB-PROCESSORS]