Data processing agreement

Scope, purpose and duration

Your organisation is the controller, or a processor authorised by its controller. Norr Lundh Holding AB, company registration number 559412-3332, Sweden, operates Driftverk and is your processor or subprocessor. The subject matter is the provision of development environments and related storage, access and support for the duration of the service and agreed return or deletion period.

Processing may include receiving, storing, retrieving, transmitting, copying and deleting repository content, files, logs, volumes and snapshots. Data may concern your staff, contractors, users or customers and include identifiers, contact details and other personal data you choose to supply.

The purpose is to run, store, connect, troubleshoot and manage the development workloads you authorise. Processing continues while you use the service and until your data has been returned or deleted under this agreement. Your selected Cloud or Hybrid service, configured resources, supplied content and documented instructions define the scope. Special-category or criminal-offence data requires prior written agreement.

Instructions and confidentiality

We process personal data only on your documented instructions, including your authorised use of the service, except where law requires otherwise. We inform you of a legal requirement before processing unless that law prohibits notice. We immediately inform you if we believe an instruction infringes applicable data protection law.

You are responsible for lawful collection, notices, authority and instructions. We ensure that people authorised to process your data are bound by confidentiality and have access only as needed for their duties.

Security measures

We implement technical and organisational measures appropriate to the risks under GDPR Article 32. These measures include authenticated access, organisation-based access restrictions, password hashing, encryption of stored integration secrets, time-limited access tokens and separation of customer environments. We maintain confidentiality and incident-handling obligations and assess the measures in light of the processing risks. We do not materially reduce the agreed protection during the service.

For Hybrid, we are responsible for the control plane and the access functions we provide. You are responsible for securing and maintaining your hosts, networks and customer-managed backups. Keep independent backups of important work; the service does not include a guaranteed recovery time unless separately agreed. A customer-managed host does not remove our obligations for processing carried out by the control plane.

Subprocessors and transfers

You give general written authorisation to engage the providers identified on our Providers and subprocessors page to the extent they process personal data on your behalf. We provide at least 30 days’ notice before adding or replacing a subprocessor, allowing you to object on reasonable data protection grounds. If we cannot resolve an objection, you may terminate the affected service before that provider processes your data.

We impose equivalent data protection obligations on subprocessors and remain responsible for their performance of those obligations. Your instructions authorise transfers necessary to provide the selected service through the listed providers, subject to GDPR Chapter V. We require an applicable adequacy decision or appropriate transfer safeguards, including standard contractual clauses where applicable. You can request a copy of the applicable safeguards from us.

Requests, incidents and assistance

We promptly forward requests from data subjects and assist you with responding, taking account of the nature of processing. We do not answer on your behalf unless you instruct us or the law requires it.

We notify you without undue delay after becoming aware of a personal data breach affecting your data. We provide available details of its nature, affected data and people, likely consequences and measures taken or proposed, with updates as the investigation progresses.

Taking account of the processing and information available to us, we assist with security obligations, breach notifications, impact assessments and prior consultation with supervisory authorities.

Evidence and audits

We make information necessary to demonstrate compliance available to you and allow and contribute to audits, including inspections, by you or an auditor you appoint. We may agree reasonable confidentiality, security and scheduling arrangements without preventing the exercise of these rights or a supervisory authority’s powers.

Return, deletion and precedence

At the end of processing, we return or delete personal data at your choice and delete existing copies unless law requires retention. You can export accessible environment files before ending the service or ask hello@driftverk.com for assistance with return or deletion. We carry out your instructions without undue delay and provide confirmation on request. Residual backup copies remain subject to confidentiality, access restrictions and the deletion obligation; they are not retained for unrelated uses. Data legally retained remains protected and is processed only for that legal purpose.

These processing terms prevail over conflicting service terms on personal data processing. Amendments must be documented. GDPR rights and obligations cannot be reduced by the service agreement.