Data processing agreement (Team)

When you need this

Wharfbase runs on your server, and we have no access to it or to your databases. Most customers therefore don’t need a data processing agreement with us. One applies where we process personal data on your behalf:

• Support bundles you send us (wharfbase doctor --bundle). They are redacted, but can still contain names of databases, containers and users, and log lines.
• Data you share while asking for support: screenshots, query results, logs.

The license server’s own data (your account and licenses) is not covered: for that, we are the controller (privacy policy).

To sign it, write to [email address] with your company’s name and address. We send it back countersigned. The text below is the template.

Template

Between [Customer name, address] (“Controller”) and [Company name, address] (“Processor”).

1. Subject and duration. The Processor processes personal data for the Controller only to provide support for Wharfbase under the Team subscription, for as long as the subscription runs and any support request is open.
2. Nature and purpose. The data is received, stored, read and deleted, only to analyse and fix problems the Controller reports.
3. Types of data and data subjects. Identifiers and names contained in support material: usernames and email addresses of the Controller’s Wharfbase users; names of databases, containers and hosts; log lines; any data the Controller chooses to send. The data subjects are the Controller’s staff and, through the material sent, possibly its customers.
4. Instructions. The Processor acts only on the Controller’s documented instructions, including on transfers to third countries. This agreement and support requests are those instructions.
5. Confidentiality. Everyone handling the data is bound to confidentiality.
6. Security. The Processor takes the technical and organisational measures in Annex 1.
7. Sub-processors.
   • The Processor uses the sub-processors in Annex 2.
   • It tells the Controller at least 30 days before adding or replacing one, and the Controller may object.
   • Each sub-processor is bound by the same obligations.
8. Assistance. The Processor helps the Controller answer data subjects’ requests, and with security, breach notification, impact assessments and prior consultation (Art. 32–36 GDPR), as far as its processing is concerned.
9. Breaches. The Processor reports a personal data breach to the Controller without undue delay, and within 48 hours of becoming aware of it.
10. Deletion. Support material is deleted within 30 days after the support request is closed, unless the law requires keeping it. At the end of the agreement, the rest is deleted or returned, at the Controller’s choice.
11. Audits. The Processor makes available the information needed to show compliance. It allows audits by the Controller, or an auditor the Controller appoints, with reasonable notice and at most once a year, except after a breach.
12. Third countries. Data leaves the EU/EEA only under Art. 44 ff. GDPR (an adequacy decision or the Commission’s standard contractual clauses).
13. Liability and law. Liability follows Art. 82 GDPR and the Terms of Service. [Governing law and jurisdiction.]

Annex 1: technical and organisational measures. [To be completed. For example: encryption in transit and at rest; access limited to named staff with two-factor authentication; support material kept in [system] and deleted on schedule; staff confidentiality agreements; incident procedure.]

Annex 2: sub-processors. [Email and helpdesk provider, file storage: name, location, purpose.]

Signatures: [Controller], [Processor], [place, date].