Data Processing Agreement

1. Parties and Scope

This Data Processing Agreement ("DPA") is part of the Terms of Service between PRFactory (org.nr 556939-4777) and the customer that uses the Service. Accepting the Terms accepts this DPA.

For the workspace content described in section 3, the customer is the controller and PRFactory is the processor. For account and billing data, PRFactory is the controller, and this DPA does not apply to it.

2. Subject Matter, Duration, Nature and Purpose

PRFactory processes workspace content to provide the Service: it stores and shows the workflow of the customer's tickets, and lets the customer's team work on it together. The processing lasts as long as the customer uses the Service, and until the data is deleted under section 11.

3. Personal Data and Data Subjects

The personal data is the workspace content the customer puts into the Service: tickets, plans, questions and answers, test plans, reviews, comments and the diffs submitted for review. The names and e-mail addresses of the customer's users are account data, for which PRFactory is the controller (see the Privacy Policy). They fall under this DPA only as they appear in workspace content, such as assignees, comments and approvals. The data subjects are the customer's users and any person named in that content.

4. Documented Instructions

PRFactory processes workspace content only on the customer's documented instructions: these Terms, this DPA and the customer's use of the features of the Service. If the law requires other processing, PRFactory tells the customer first, unless the law forbids it.

PRFactory informs the customer immediately if, in its opinion, an instruction infringes the GDPR or other data protection law.

5. Confidentiality

PRFactory makes sure that the people it authorises to process workspace content are bound by a duty of confidentiality.

6. Security Measures

PRFactory applies technical and organisational measures appropriate to the risk. They include HTTPS, with TLS 1.2 or later, for every connection; encryption of integration credentials at rest; logical separation of each customer's data from other tenants; access control by role; and daily backups, kept for up to 3 months. The Security page describes them.

7. Sub-processors

The customer gives PRFactory a general authorisation to use the sub-processors listed under Sub-processors on the Security page. PRFactory gives the customer notice of an intended addition or replacement at least 30 days ahead, by updating that list and by e-mailing the account owners.

The customer may object on reasonable data protection grounds within that time. If the parties find no solution, the customer may terminate the Service.

PRFactory imposes on each sub-processor, by written contract, data protection obligations equivalent to those in this DPA, and remains liable to the customer for the sub-processor's performance.

8. Data Subject Requests

PRFactory helps the customer, with appropriate technical and organisational measures, to answer requests from data subjects. The customer writes to [email protected].

9. Assistance with Compliance

Taking into account the nature of the processing and the information available to it, PRFactory assists the customer in ensuring compliance with the security of processing, the notification of personal data breaches, data protection impact assessments and prior consultation with a supervisory authority.

10. Personal Data Breach

PRFactory notifies the customer without undue delay after it becomes aware of a personal data breach that affects workspace content, and gives the customer the information it has so that the customer can meet its own duties.

11. Deletion or Return

When the Service ends, the customer can export its data through the product where that is available, or ask PRFactory for a copy. Once the customer has exported its data, or has told PRFactory that it does not need a copy, PRFactory deletes the workspace content. The customer asks in writing to [email protected]. PRFactory keeps a copy only where the law requires it. Copies in backups expire as described in the Privacy Policy.

12. Audit

PRFactory makes available to the customer all information necessary to demonstrate compliance with this DPA, and allows for and contributes to audits, including inspections, conducted by the customer or an auditor the customer mandates, on reasonable notice.

13. Transfers Outside the EEA

Workspace content is processed on Zerops in Prague, in the EU. Cloudflare passes traffic to the Service over its global edge network, so data in transit can pass through locations outside the EEA. Where a sub-processor processes personal data outside the EEA, the transfer relies on the EU Standard Contractual Clauses or the EU-US Data Privacy Framework, as that provider's terms provide.

14. Precedence and Liability

If the Terms and this DPA conflict on the processing of personal data, this DPA prevails. Liability under this DPA is as set out in the Terms.

15. Governing Law

This DPA is governed by Swedish law, as set out in section 12 of the Terms of Service.