Proveta

Data processing agreement

This agreement is part of the Terms of Service. It applies when GoStack Software Technologies, Unipessoal, Lda processes personal data for your organisation through Proveta. No signature is needed. To keep a copy, print this page or save it as a PDF. Email hi@gostack.dev for a signed copy.

1. Parties and roles

Your organisation is the controller and GoStack Software Technologies, Unipessoal, Lda is the processor. If your organisation is itself a processor for another controller, we are your subprocessor. Words such as personal data, processing, and personal data breach have the meanings in the GDPR (Regulation (EU) 2016/679).

2. Details of the processing

  • Subject: providing Proveta to your organisation.
  • Duration: while the contract runs, and until we erase the data as section 9 states.
  • Nature and purpose: storing and analysing GitHub alerts and repository content, recording decisions, producing reports, proposing fix PRs, and sending service emails.
  • Types of personal data: GitHub account identifiers, usernames, and email addresses, names and text in decisions and activity history, invitation email addresses, and personal data that appears in repository content, code snippets, or GitHub alerts.
  • Data subjects: your workspace members and invitees, people named in your workspace records, and people whose data appears in your repositories.

3. Instructions

We process personal data only on your documented instructions, including for transfers outside the European Economic Area. The Terms, this agreement, and your settings in Proveta are your instructions. If the law requires other processing, we tell you first, unless the law does not allow it. We tell you at once if we think that an instruction breaks data protection law.

4. Confidentiality

Each person we allow to process personal data is bound to keep it confidential.

5. Security

We apply the technical and organisational measures that GDPR Article 32 requires. The Security page lists them, and it is an annex to this agreement. We can change the measures, but we do not lower the overall level of protection.

6. Subprocessors

You give general authorisation for the subprocessors on the Subprocessors page. We email workspace admins at least 14 days before a new subprocessor starts, and you can object during that time. If we cannot resolve your objection, you can end the contract and we refund the unused part of any prepaid period. Each subprocessor has a written contract with data protection obligations equal to this agreement. We stay liable to you for their work.

7. Help with data subject requests

We help you answer requests from data subjects who use their GDPR rights. If a data subject sends such a request to us, we send it to you and do not answer it ourselves, unless you tell us to.

8. Breaches, assessments, and consultations

We tell you about a personal data breach without undue delay, and no later than 48 hours after we confirm it. We give the information of GDPR Article 33(3) as it becomes available. We also help you with security, data protection impact assessments, and prior consultations under GDPR Articles 32 to 36.

9. Return and deletion

When the contract ends, you choose if we return or delete the personal data. We return it through the export that the Terms describe. We delete it, with its copies, within 30 days after the data retrieval period ends, unless EU or Member State law requires us to keep it.

10. Audits

We give you the information you need to show that we meet GDPR Article 28. You or an auditor you choose can audit us once a year, or after a breach or a request from a supervisory authority. Give us 30 days’ notice. The auditor must keep the results confidential, and you pay the audit costs. We first answer your written questions, which can make an on-site audit unnecessary.

11. Transfers outside the European Economic Area

Some subprocessors process data in the United States. These transfers use the EU Standard Contractual Clauses (Commission Decision (EU) 2021/914) in the subprocessor’s agreement, or the EU-US Data Privacy Framework where the subprocessor is certified. If a safeguard stops being valid, we change to another valid safeguard or stop the transfer. If a public authority asks us for your data, we tell you before we answer, unless the law does not allow it.

12. Liability and precedence

The liability terms in the Terms apply to this agreement. If this agreement and the Terms disagree about personal data, this agreement applies.