1. Scope and incorporation
This Data Processing Agreement (“DPA”) forms part of the Deployxa Terms of Service (or any other written agreement between you and Deployxa for the Service) and applies when Deployxa processes personal data on your behalf as part of Customer Content. It reflects the requirements of Article 28 of the EU General Data Protection Regulation (GDPR), the UK GDPR and similar laws.
It applies automatically when you accept the Terms. If your organization needs a countersigned copy, email [email protected] and tell us which entity should sign. If this DPA conflicts with the Terms, this DPA prevails for the processing of personal data.
2. Definitions
“Personal data”, “controller”, “processor”, “data subject”, “processing” and “supervisory authority” have the meanings given in the GDPR. “Customer Personal Data” means personal data in Customer Content that Deployxa processes for you. “Subprocessor” means a third party Deployxa engages to process Customer Personal Data. “Security Incident” means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
3. Roles of the parties
- You are the controller (or a processor acting for your own controller) of Customer Personal Data. You decide what data to deploy and why, and you are responsible for having a lawful basis and giving any required notices.
- Deployxa is the processor and processes Customer Personal Data only on your documented instructions. The Terms, this DPA and your use and configuration of the Service are your complete instructions.
- Deployxa will tell you if it believes an instruction breaks data protection law, and is not required to follow it.
- Deployxa is a controller for its own account, billing and operational data about you, as described in the Privacy Policy; this DPA does not apply to that data.
4. Details of processing
| Subject matter | Hosting, building, running, routing and storing your applications, databases, files and logs. |
|---|---|
| Duration | For the term of the agreement, plus the deletion period in Section 10. |
| Nature and purpose | Storage, computation, transmission, backup, logging and support, solely to provide the Service. |
| Data subjects | Determined by you; typically your end users, customers, employees and contacts. |
| Categories of data | Determined by you; typically identifiers, contact details, account data, usage data and IP addresses in access logs. |
| Special categories | None intended. Do not deploy special-category or health data unless we have agreed suitable additional terms in writing. |
5. Confidentiality
Deployxa ensures that anyone it authorizes to process Customer Personal Data is bound by confidentiality obligations and accesses the data only as needed to provide, support or secure the Service.
6. Subprocessors
You give general authorization for Deployxa to use subprocessors. Deployxa imposes data protection terms on each subprocessor that are no less protective than this DPA, and remains responsible for their performance. The categories in use are:
| Category | Purpose | Provider |
|---|---|---|
| Infrastructure hosting | Servers, storage and backups that run the Service and Customer Content | To be listed |
| Email delivery | Transactional emails such as invitations and alerts | To be listed |
| AI model provider | Only when you use AI-assisted features; processes the prompt and context you submit | Configured provider (the platform supports OpenAI, Anthropic and Google Gemini) |
| Source control | Fetching code from repositories you connect | GitHub |
Payment processors (Stripe, Paystack and Bachs) and analytics providers process Deployxa’s own customer data, not Customer Content, and are covered by the Privacy Policy. Deployxa will notify you of a new subprocessor at least 30 days before it starts processing Customer Personal Data. You may object on reasonable data protection grounds within that period; if we cannot reasonably resolve the objection, you may terminate the affected Service and receive a refund of prepaid fees for it.
7. Security measures
Deployxa maintains appropriate technical and organizational measures, which currently include:
- isolation of each workload in its own container with separate namespaces, resource limits and filtered system calls;
- a private container network reachable from outside only through the TLS-terminating edge proxy;
- TLS for all data in transit, with automatically issued certificates;
- encryption of environment variables and secrets at rest, and exclusion of secrets from build logs;
- role-based access control for your team, revocable API keys and organization audit logs;
- scheduled database snapshots; and
- least-privilege internal access to production systems.
The Security Policy describes these measures in more detail. Deployxa may update them, provided the overall level of protection does not decrease. You are responsible for securing your own application code, its configuration and access to your account.
8. Security Incident notification
Deployxa will notify you without undue delay, and in any event within 72 hours, after becoming aware of a Security Incident affecting Customer Personal Data. The notice will describe, as far as known, the nature of the incident, the data and data subjects affected, the likely consequences and the measures taken or proposed. Deployxa will take reasonable steps to contain the incident and help you meet your own notification obligations. Notice is sent to the workspace owner’s email address. Report suspected incidents to [email protected].
9. Assistance with data subject requests
The Service lets you access, correct, export and delete Customer Content yourself. If Deployxa receives a request from one of your data subjects, it will pass it to you and not respond directly except to tell the requester to contact you. Deployxa will provide reasonable assistance with data protection impact assessments and consultations with supervisory authorities, taking into account the nature of the processing.
10. Deletion and return
You can export Customer Content at any time while your account is active. When you delete a project or close your account, Deployxa deletes the related Customer Personal Data from active systems, and it is removed from backups as they rotate (30 days by default), unless the law requires us to keep it. On request, Deployxa will confirm deletion in writing.
11. Audits
Deployxa will make available the information reasonably necessary to demonstrate compliance with this DPA, including written answers to security questionnaires. Deployxa does not currently hold third-party certifications or audit reports. If that information is not enough to demonstrate compliance, or a supervisory authority requires it, you may carry out an audit, at your own cost, no more than once a year, with at least 30 days’ notice, during business hours and under confidentiality, in a way that does not disrupt the Service or expose other customers’ data.
12. International transfers and SCCs
Where Customer Personal Data is transferred from the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, the parties agree that the European Commission’s Standard Contractual Clauses (Decision 2021/914) are incorporated by reference: Module Two (controller to processor) or Module Three (processor to processor), as applicable. For UK transfers, the UK International Data Transfer Addendum applies; for Swiss transfers, the Clauses apply with references adapted to Swiss law.
For the Clauses: the optional docking clause applies; Clause 9 option 2 (general authorization) applies with the notice period in Section 6; the optional language in Clause 11 does not apply; and Annexes I and II are completed by Sections 4 and 7 of this DPA.
13. Liability and term
Each party’s liability under this DPA is subject to the limitations in the Terms, except where the law or the Standard Contractual Clauses do not allow it. This DPA remains in force for as long as Deployxa processes Customer Personal Data. Questions about this DPA: [email protected].
Questions about this document? Email [email protected].