Data processing agreement

This data processing agreement ("DPA") is made between the organisation using Bifröst Orbit (the "controller") and Eirik Saman Kyrkjeeide, Kolonnenstr. 8, 10827 Berlin, Germany (the "processor"). It forms part of our terms of service and meets the requirements of Art. 28 GDPR.

1. Subject and duration

The processor processes personal data on behalf of the controller to provide Bifröst Orbit and its satellites. This DPA lasts as long as the processor processes personal data for the controller.

2. Nature and purpose

Hosting, storing, displaying, delivering and transmitting the controller's content and data, managing its users and sign-in, translating text when the controller asks, sending emails the controller triggers, and keeping backups and records of changes.

3. Types of data and data subjects

• Data subjects: the controller's employees and other users, the people its content is about, and visitors to its websites and apps where their data is stored in the service.
• Types of data: names, email addresses, profile pictures, roles and memberships, sign-in and activity records including IP addresses, and any personal data the controller puts into content, files and forms.

The controller should not put special categories of personal data (Art. 9 GDPR) into the service unless it has assessed that this is lawful and appropriate.

4. Instructions

The processor processes personal data only on the controller's documented instructions, which are given through these terms, this DPA and the controller's use of the service, unless the law requires otherwise. The processor will tell the controller if it believes an instruction breaks data protection law.

5. Confidentiality

Everyone who processes personal data for the processor is bound to confidentiality.

6. Security

The processor takes the technical and organisational measures described in the annex below, and may improve them as long as the level of protection does not fall.

7. Sub-processors

The controller gives general authorisation for the sub-processors listed on the sub-processors page. The processor will announce new or replaced sub-processors there and tell the controller at least 30 days in advance, so it can object for good reason. Each sub-processor is bound by data protection terms that protect the data at least as well as this DPA.

8. Transfers outside the EU

Personal data is transferred outside the EU or EEA only where an adequacy decision or Standard Contractual Clauses apply, as shown on the sub-processors page.

9. Helping the controller

The processor helps the controller, as far as it reasonably can, to answer requests from data subjects, to keep data secure, to assess and report breaches, and with data protection impact assessments. Most requests can be handled directly in the service, for example by correcting or deleting content and people.

10. Breaches

The processor tells the controller without undue delay, and within 48 hours where possible, after becoming aware of a personal data breach affecting the controller's data, with the information it has.

11. Deletion and return

At the end of the service, the controller can export its content, and the processor then erases the controller's personal data, unless the law requires it to be kept. Erased data can remain in encrypted backups for up to 14 days.

12. Audits

The processor makes available the information needed to show it meets this DPA and allows audits by the controller or an auditor it appoints, with reasonable notice, during business hours and under confidentiality, at most once a year unless there is a breach or an authority requires it.

13. Liability and precedence

Liability follows the terms of service, unless the law requires otherwise. If this DPA and the terms conflict on data protection, this DPA prevails.

Annex: technical and organisational measures

Area	Measure
Encryption	Connections use TLS. Secrets such as sign-in credentials are stored encrypted. Backups are kept in a versioned, encrypted storage bucket.
Access control	Sign-in by email code or the organisation's single sign-on. Roles and permissions are checked on the server for every request, and access can be limited to regions.
Separation	Every record carries its organisation, and data is always read and written within it.
Logging	An audit trail of changes, with who made them, when and on whose behalf.
Availability	Nightly backups kept for 14 days, and monitoring of the service.
Reversibility	Deletion moves content to the bin first. Erasing an organisation needs the owner's confirmation.
AI agents	Agents act within the rights of the person who connected them, and page changes they draft need a person's approval.
Minimisation	No analytics or advertising tracking in the service.