Data Processing Agreement
The short version
- You (the customer) decide what personal data goes into your workspace and why; we process it only to run QuxPulse for you, on your instructions.
- Our staff and subprocessors are bound to confidentiality and to the security measures listed here.
- We use a short list of subprocessors, named below, and tell you before we add one.
- We tell you without undue delay, and within 72 hours, if a breach affects your data.
- When you leave, we return your data on request and then delete it.
1. Parties and scope
This Data Processing Agreement (“DPA”) is between DevQux, of [Registered address] (“QuxPulse”, “we”, the “Processor”), and the customer that holds a QuxPulse workspace under our Terms of Service or a signed order form (the “Customer”, the “Controller”). It forms part of that agreement and applies whenever we process personal data on the Customer's behalf in providing the Service (“Customer Personal Data”).
Where this DPA and the agreement conflict about Customer Personal Data, this DPA wins. Terms such as “personal data”, “processing”, “controller”, “processor” and “data subject” have the meanings given in the applicable data protection law, including the EU and UK General Data Protection Regulation and US state privacy laws where they apply.
2. What we process, and why
| Subject matter | Providing QuxPulse: delivery tracking, stand-ups, requests and requirement changes, reports, the assistant and the desktop companion. |
|---|---|
| Duration | For as long as the Customer's workspace exists, then until deletion under section 9. |
| Nature and purpose | Hosting, storing, syncing, computing delivery figures, generating assistant replies and meeting summaries, sending service email, and support, solely to provide the Service. |
| Data subjects | The Customer's members and the people on its roster; people named in content the Customer adds or syncs (for example in tickets, pull requests, mail and meeting notes the Customer chooses to send). |
| Categories of data | Names, work email addresses, job titles, sign-in and security records, stand-up entries and commitments, ticket and pull request metadata from connected tools, meeting transcripts and notes and mail sent by the desktop companion, and anything else the Customer puts in. |
| Special categories | None are required, and the Customer agrees not to send them. |
3. Our obligations as processor
We process Customer Personal Data only on the Customer's documented instructions, which are this DPA, the agreement and the Customer's use and configuration of the Service, unless the law requires otherwise (in which case we tell the Customer first, unless the law forbids it). We tell the Customer if we believe an instruction breaks data protection law.
We do not sell Customer Personal Data, use it to train models, or use it for any purpose of our own.
Everyone we authorise to process Customer Personal Data is bound by a duty of confidentiality.
4. Security
We keep technical and organisational measures appropriate to the risk, including:
- each workspace's data separated from every other's by the database itself (forced row-level security), not only by application code;
- encryption in transit (TLS) for every connection to the Service, and the credentials a workspace gives us for its tools sealed with AES-256-GCM before they are stored;
- passwords held only as salted, peppered one-way hashes (argon2id); single sign-on through the Customer's own identity provider, trusted only for the email domains the Customer has proved it controls;
- an append-only, hash-chained activity trail of workspace changes, readable and (on Enterprise) exportable by the Customer's admins, and a trail of every action our staff take in the operator console;
- least-privilege database access: the application connects as a role that cannot bypass the isolation; and
- no third-party analytics, advertising or tracking in the Service.
5. Subprocessors
The Customer authorises us to use these subprocessors:
| Subprocessor | What it does for QuxPulse | Where |
|---|---|---|
| DigitalOcean, LLC | Hosting: the application, the worker and the managed PostgreSQL database that holds Customer Personal Data | [Hosting region] |
| Cloudflare, Inc. | Transactional email (sign-in, invitations, notices), and Workers AI, which generates the assistant's replies and meeting summaries; the text of a request is processed to answer it and not kept by us beyond its token count | Global network |
| Stripe, Inc. | Card payments for the Standard plan: the billing contact and payment details. Not used for Enterprise workspaces invoiced by bank transfer | United States |
Connected sources are not subprocessors. When a workspace connects Linear or GitHub, we read from that service on the Customer's instruction and with the Customer's credentials; the Customer's relationship with it is its own.
We impose data protection terms on each subprocessor that are no less protective than this DPA, and remain responsible for its performance. We will give the Customer at least 30 days' notice, by email to its workspace owners or on this page, before a new subprocessor processes Customer Personal Data. The Customer may object on reasonable data protection grounds within that time; if we cannot reasonably accommodate the objection, the Customer may end the affected Service and receive a refund of prepaid fees for the unused period.
6. Helping the Customer
Taking into account the nature of the processing, we help the Customer, by appropriate technical and organisational measures, to respond to requests from data subjects exercising their rights: the Customer's admins can see, correct, export and remove roster entries and content in the Service themselves, and we assist with anything they cannot do there. If a data subject contacts us directly about Customer Personal Data, we pass the request to the Customer and do not answer it ourselves unless the Customer asks us to.
We also help the Customer, with the information available to us, with security, breach notification, data protection impact assessments and consultation with supervisory authorities.
7. Personal data breaches
We notify the Customer without undue delay, and in any case within 72 hours, after becoming aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data. The notice describes, as far as we then know, what happened, the data and people affected, the likely consequences and what we are doing about it, and we update it as we learn more. Notice goes to the workspace's owners and to any security contact the Customer has given us.
8. International transfers
Customer Personal Data is stored in [Hosting region]. Where it is transferred out of the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, the transfer is made under the European Commission's Standard Contractual Clauses (Module Two, controller to processor, and Module Three for onward transfers to subprocessors) and the UK Addendum, which are incorporated into this DPA by reference, with this DPA supplying their annexes.
9. Return and deletion
On the end of the agreement, the Customer's workspace owner may export its data and ask us to return it. Within 30 days after the agreement ends we delete Customer Personal Data from the Service, and from backups as they expire on their normal schedule, unless the law requires us to keep it, in which case it stays protected by this DPA for as long as we keep it.
10. Audits
We make available to the Customer the information reasonably needed to show compliance with this DPA, including our answers to the Customer's reasonable security questionnaires and, on Enterprise, the workspace's own activity trail. Where that is not enough to satisfy a supervisory authority or the law, the Customer may audit our compliance, on at least 30 days' written notice, no more than once a year, during business hours, at its own cost, under confidentiality, and without access to other customers' data.
11. Liability and term
Each party's liability under this DPA is subject to the limitations in the agreement. This DPA lasts as long as we process Customer Personal Data for the Customer. It is governed by the law that governs the agreement ([Governing law]), except where data protection law or the Standard Contractual Clauses require otherwise.
12. Contact
Data protection questions, a signed copy, and objections to a subprocessor: [Legal and privacy contact email]. Post: DevQux, [Registered address].