Data processing

When this addendum applies

This addendum applies where a customer uses Infrafused to process personal data. It sits alongside the terms of service, and where the two disagree about personal data, this addendum applies.

Who is who

The customer is the controller of the personal data in its tenancy. Infrafused is the processor, and handles that data on the customer’s documented instructions.

The customer decides what goes in and who may see it. We act on those decisions, and we tell the customer if an instruction appears to conflict with the law.

What is processed

What the customer puts in: source material read from its own systems, the documentation built from it, configuration and policy set by its administrators, and the records of what developer tooling read.

The categories of person involved are set out in the privacy policy. The customer is best placed to know what its own repositories contain, and choosing which resources we may read is its decision.

What we do

As a processor, we:

• process the data only on the customer’s instructions
• keep everyone who handles it under confidentiality obligations
• apply the security measures the agreement describes
• help with data subject requests and risk assessments
• report a personal data breach without undue delay

Security

Access is limited to those who need it, data is encrypted in transit and at rest, and access is logged. The measures are described in more detail in the agreement, and we do not weaken them during the term.

Subprocessors and transfers

We engage the subprocessors named on the subprocessors page, and we place the same data protection obligations on them that this addendum places on us.

Where data is transferred outside the EEA, the transfer relies on a safeguard the law recognises, such as the European Commission’s standard contractual clauses.

Data subject requests

If someone asks us directly about data in a customer’s tenancy, we pass the request to that customer and do not answer it ourselves.

We give the customer the help it needs to answer, using the features built for that purpose.

When the agreement ends

The customer can export its data before the agreement ends, and should.

Afterwards we delete the customer’s personal data, which ages out of backups, unless the law requires us to keep something longer. We confirm the deletion in writing if asked.

Audits

We answer reasonable questions about how we protect personal data, and take part in an audit where the agreement provides for one. Reports from independent testing are shared under confidentiality, where they exist.

Where this addendum sits

This addendum forms part of the agreement between us and the customer. Where it conflicts with the terms of service about personal data, this addendum applies.