1Purpose and Scope

This DPA applies solely to the extent that GitSec Processes Customer Personal Data on behalf of the Customer in connection with the Services.

This DPA does not apply where GitSec Processes Personal Data as an independent Controller, including for purposes such as account registration and administration, authentication, billing, payment processing, fraud prevention, security monitoring, compliance with legal obligations, customer support, service communications, or the operation and improvement of the Services.

This DPA applies only where and to the extent required by applicable Data Protection Laws.

The Parties acknowledge that the Services may be used by Customers acting either as Controllers or as Processors. Where the Customer acts as a Processor on behalf of a third party, the Customer represents and warrants that it is authorised to appoint GitSec as a sub-processor and to enter into this DPA on behalf of the relevant Controller, where required by applicable Data Protection Laws.

2Definitions

1. For the purposes of this DPA:

"Applicable Data Protection Laws" means all applicable laws and regulations relating to the Processing of Personal Data, including, where applicable, the UK GDPR, the EU GDPR, the UK Data Protection Act 2018, and any other applicable data protection or privacy laws.

"Controller", "Processor", "Data Subject", "Personal Data", "Processing", "Personal Data Breach", and "Supervisory Authority" shall have the meanings given to them under the Applicable Data Protection Laws.

"Customer Personal Data" means any Personal Data contained in, or derived from, Customer Content that GitSec Processes on behalf of the Customer in connection with the Services.

"Security Incident" means any actual or reasonably suspected event that compromises the confidentiality, integrity, or availability of the Services or Customer Personal Data.

"Services" means the GitSec services provided under the applicable Terms of Service, Subscription, or Order.

"Subprocessor" means any third party appointed by GitSec to Process Customer Personal Data on behalf of the Customer in connection with the Services.

"Terms of Service" means the GitSec Terms of Service governing the Customer's use of the Services.

"Technical and Organisational Measures" or "TOMs" means the technical and organisational security measures implemented by GitSec to protect Customer Personal Data, as described in Annex II.

3Roles of the Parties

The Parties acknowledge and agree that, with respect to the Processing of Customer Personal Data carried out by GitSec on behalf of the Customer in connection with the Services, the Customer acts as the Controller (or, where applicable, as a Processor acting on behalf of another Controller), and GitSec acts as the Processor.

The Customer is solely responsible for determining the purposes and means of the Processing of Customer Personal Data and for ensuring that it has a valid legal basis and all necessary rights, permissions, and authorisations to disclose Customer Personal Data to GitSec and to instruct GitSec to Process such Customer Personal Data.

Nothing in this DPA shall affect GitSec's role as an independent Controller with respect to Personal Data Processed for its own independent purposes, including:

• account registration and administration,
• authentication and account security,
• billing and payment processing,
• fraud prevention and abuse detection,
• customer support,
• compliance with legal obligations,
• service communications,
• maintaining the security, availability, and integrity of the Services.

Where the Customer acts as a Processor on behalf of a third party, the Customer represents and warrants that it is authorised to appoint GitSec as a Subprocessor and to enter into this DPA on behalf of the relevant Controller, where required by Applicable Data Protection Laws.

4Processing of Customer Personal Data

GitSec shall Process Customer Personal Data only on the documented instructions of the Customer, as set out in the applicable agreement, the Customer's use of the Services, or any additional documented instructions provided by the Customer, unless otherwise required by Applicable Data Protection Laws. Where GitSec is required by law to Process Customer Personal Data other than on the Customer's instructions, GitSec shall, unless prohibited by law, inform the Customer before carrying out such Processing.

The Customer instructs GitSec to Process Customer Personal Data solely to provide the Services, including the backup, storage, restoration, protection, and management of Customer Content, together with any related support, security, maintenance, and operational activities necessary for the provision of the Services.

GitSec shall not Process Customer Personal Data for its own marketing purposes or for any purpose unrelated to the provision of the Services, except where required or permitted by Applicable Data Protection Laws.

GitSec shall promptly inform the Customer if, in GitSec's reasonable opinion, any documented instruction received from the Customer infringes Applicable Data Protection Laws. Nothing in this Section shall require GitSec to undertake an independent legal assessment of the Customer's Processing activities.

Further details regarding the subject matter, nature, purpose, duration of the Processing, and the categories of Personal Data and Data Subjects are set out in Annex I, which forms an integral part of this DPA.

5Security and Confidentiality

GitSec shall implement and maintain appropriate technical and organisational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Customer Personal Data, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the Processing, and the risks presented to the rights and freedoms of natural persons.

The technical and organisational measures implemented by GitSec are described in Annex II (Technical and Organisational Measures). GitSec may update such measures from time to time, provided that any such updates do not materially reduce the overall level of protection afforded to Customer Personal Data.

GitSec shall ensure that persons authorised to Process Customer Personal Data are subject to appropriate confidentiality obligations or are under an appropriate statutory obligation of confidentiality.

GitSec shall implement appropriate access controls designed to ensure that access to Customer Personal Data is limited to personnel who require such access for the performance of their duties.

Where the Customer elects to use a Customer-managed or third-party storage environment, GitSec shall remain responsible only for the Processing activities performed by GitSec within the Services. The Customer acknowledges that the availability, configuration, security, resilience, retention, and ongoing operation of such storage environment remain the responsibility of the Customer or the applicable third-party storage provider.

Nothing in this DPA shall be construed as requiring GitSec to implement any specific security technology or certification, provided that the technical and organisational measures implemented by GitSec satisfy the requirements of Applicable Data Protection Laws.

6Subprocessors

The Customer authorises GitSec to engage Subprocessors to Process Customer Personal Data in connection with the provision of the Services, provided that GitSec remains responsible for the performance of its obligations under this DPA.

GitSec shall maintain an up-to-date list of its authorised Subprocessors, which shall be made available to Customers at: [Subprocessor List URL]. The Subprocessor List forms part of this DPA and may be updated from time to time in accordance with Section 6.5.

GitSec shall ensure that each Subprocessor is subject to written contractual obligations that provide a level of protection for Customer Personal Data that is substantially equivalent to the obligations imposed on GitSec under this DPA, to the extent applicable to the services performed by the Subprocessor.

GitSec shall remain responsible for the acts and omissions of its Subprocessors to the same extent as if such acts or omissions had been performed by GitSec itself, where required by Applicable Data Protection Laws.

Where required by Applicable Data Protection Laws, GitSec shall provide reasonable notice of any intended addition or replacement of a Subprocessor by updating the Subprocessor List or through another reasonable notification mechanism.

Where the Customer has a reasonable and documented objection to the appointment of a new Subprocessor on data protection grounds, the Parties shall work together in good faith to address such concerns. If the Parties are unable to reach a mutually acceptable solution within a reasonable period, the Customer may terminate the affected Services in accordance with the applicable agreement.

7International Data Transfers

To the extent that the Processing of Customer Personal Data involves a transfer of Personal Data to a country or territory that does not provide an adequate level of protection under the Applicable Data Protection Laws, GitSec shall ensure that such transfer is carried out using an appropriate transfer mechanism recognized under the Applicable Data Protection Laws.

Where required, such transfer mechanism may include, without limitation:

• an adequacy decision issued by the competent authority,
• the European Commission's Standard Contractual Clauses ("SCCs"),
• the UK International Data Transfer Agreement ("IDTA"),
• the UK Addendum to the EU Standard Contractual Clauses, or
• any other lawful transfer mechanism recognized under the Applicable Data Protection Laws.

GitSec shall implement any supplementary measures reasonably required under Applicable Data Protection Laws where the selected transfer mechanism requires such measures.

Upon written request and to the extent reasonably necessary for the Customer to demonstrate compliance with Applicable Data Protection Laws, GitSec shall make available information regarding the applicable transfer mechanism.

8Assistance to the Customer

Taking into account the nature of the Processing and the information available to GitSec, GitSec shall provide the Customer with reasonable assistance to enable the Customer to comply with its obligations under Applicable Data Protection Laws relating to the exercise of Data Subject rights.

Where GitSec receives a request directly from a Data Subject relating to Customer Personal Data Processed on behalf of the Customer, GitSec shall, unless legally prohibited, promptly notify the Customer and shall not respond to such request except on the Customer's documented instructions or as otherwise required by Applicable Data Protection Laws.

Taking into account the nature of the Processing and the information available to GitSec, GitSec shall provide reasonable assistance to the Customer in relation to:

• security of Processing,
• notification and management of Personal Data Breaches,
• Data Protection Impact Assessments ("DPIAs"),
• prior consultation with competent Supervisory Authorities, where required under Applicable Data Protection Laws.

GitSec's obligation to provide assistance under this Section shall be limited to assistance that is reasonable and proportionate, taking into account the nature of the Services and the information available to GitSec. Nothing in this DPA requires GitSec to provide legal advice or to assume the Customer's compliance obligations under Applicable Data Protection Laws.

9Personal Data Breaches

GitSec shall notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data Processed on behalf of the Customer.

Such notification shall include, to the extent the information is reasonably available at the time:

• a description of the nature of the Personal Data Breach,
• the categories of Customer Personal Data affected,
• the likely consequences of the Personal Data Breach, where known, and
• the measures taken, or proposed to be taken, by GitSec to investigate, mitigate, and remediate the Personal Data Breach.

Where all relevant information cannot reasonably be provided at the same time, GitSec may provide the information in phases as it becomes available.

GitSec shall take appropriate measures to investigate, contain, mitigate, and remediate any Personal Data Breach and shall reasonably cooperate with the Customer in relation to the Customer's compliance with Applicable Data Protection Laws.

Notification of a Personal Data Breach under this Section shall not be construed as an acknowledgement by GitSec of fault or liability.

10Audits

Upon the Customer's written request, GitSec shall make available information reasonably necessary to demonstrate its compliance with this DPA and Applicable Data Protection Laws.

GitSec may satisfy its obligations under Section 10.1 by providing relevant documentation, security documentation, independent audit reports, compliance summaries, or other information reasonably demonstrating the effectiveness of its Technical and Organisational Measures, to the extent such information is available.

Where the information provided under Sections 10.1 and 10.2 is reasonably insufficient for the Customer to satisfy its obligations under Applicable Data Protection Laws, the Customer may request an audit of GitSec's Processing activities. Any such audit shall:

• be conducted only where reasonably necessary,
• be limited to matters directly relevant to the Processing of Customer Personal Data under this DPA,
• be conducted during normal business hours,
• be subject to reasonable prior written notice,
• avoid unreasonable disruption to GitSec's business operations,
• be subject to appropriate confidentiality obligations, and
• not compromise the security, confidentiality, or privacy of GitSec, its systems, or other customers.

Unless otherwise required by Applicable Data Protection Laws or agreed by the Parties, the Customer may exercise its audit rights under this Section no more than once in any twelve (12)-month period.

Each Party shall bear its own costs arising from any audit conducted under this Section, unless otherwise agreed in writing.

11Retention and Deletion of Customer Personal Data

Upon termination or expiry of the applicable agreement, GitSec shall cease Processing Customer Personal Data, except as otherwise provided in this DPA or required by Applicable Data Protection Laws.

Customer Personal Data shall remain available for retrieval during the applicable retention period specified in the Terms of Service or other applicable agreement.

Following the expiry of the applicable retention period, GitSec shall delete or render inaccessible Customer Personal Data Processed on behalf of the Customer, unless continued Processing or retention is required or permitted by Applicable Data Protection Laws.

Notwithstanding the deletion of Customer Personal Data or Customer Content, GitSec may retain limited Personal Data and related records where necessary to:

• comply with applicable legal obligations,
• establish, exercise, or defend legal claims,
• maintain security, fraud prevention, or audit records,
• evidence the Customer's acceptance of applicable legal terms and policies, or
• otherwise comply with Applicable Data Protection Laws.

Any such retained information shall be limited to the minimum necessary for the relevant purpose and shall remain subject to the confidentiality and security obligations set out in this DPA.

Upon the Customer's written request and where reasonably practicable, GitSec shall confirm completion of the deletion of Customer Personal Data, except where Applicable Data Protection Laws require or permit continued retention.

12Liability

The liability of each Party arising out of or in connection with this DPA shall be subject to the limitations and exclusions of liability set out in the applicable Terms of Service, except to the extent that such limitations or exclusions are prohibited by Applicable Data Protection Laws.

Nothing in this DPA excludes or limits either Party's liability to the extent such exclusion or limitation is not permitted under Applicable Data Protection Laws.

13General

This DPA forms part of the applicable Terms of Service, Subscription, or Order governing the Customer's use of the Services.

In the event of any conflict between this DPA and the applicable Terms of Service with respect to the Processing of Customer Personal Data, this DPA shall prevail to the extent of such conflict.

Except as expressly amended by this DPA, the Terms of Service shall remain in full force and effect.

If any provision of this DPA is held to be invalid or unenforceable, the remaining provisions shall remain in full force and effect.

This DPA may be updated by GitSec from time to time where such changes are required by law or reasonably necessary to reflect changes in Applicable Data Protection Laws, regulatory guidance, the Services, or GitSec's Processing activities. Where such changes materially affect the Parties' rights or obligations under this DPA, GitSec shall provide reasonable notice before such changes become effective.

IN WITNESS WHEREOF, the Parties have caused this Data Processing Agreement to be executed by their duly authorised representatives.

Annexes

This DPA includes the following Annexes, which form an integral part of this DPA:

Annex I — Details of Processing

Annex II — Technical and Organisational Measures (TOMs)