Data Processing Agreement

This agreement is between the customer that accepts our Terms of Service (“you”) and Reply Intelligence Group Ltd, company number 17040048, registered office 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, registered with the Information Commissioner's Office under number ZC192287 (“we”, “us”).

It applies to Customer Personal Data that we process when providing Slipmark Cloud (the “Service”).

If this agreement and the Terms of Service conflict on the protection of personal data, this agreement wins.

“UK GDPR” and “Data Protection Act 2018” have their usual meanings. Together with any other law on personal data that applies in the UK, they are the “Data Protection Laws”.

“Controller”, “processor”, “data subject”, “personal data”, “personal data breach” and “processing” have the meanings given in the UK GDPR.

“Customer Personal Data” means the personal data in your repository and committer records that we process on your behalf, as described in Annex 1.

“Sub-processor” means another processor we engage to process Customer Personal Data.

For Customer Personal Data, you are the controller and we are your processor.

For account administration, billing contacts, website visitors and our own business operations, we are the controller. Our privacy notice covers that data, not this agreement.

You are responsible for having a lawful basis for the processing you instruct us to carry out, and for giving your committers any information the Data Protection Laws require.

We will process Customer Personal Data only on your documented instructions, unless the law requires otherwise. If it does, we will tell you before processing unless the law forbids that.

Your instructions are the Terms of Service, this agreement, and the way you configure and use the Service.

We will tell you straight away if we think an instruction breaks the Data Protection Laws.

We will make sure that anyone we authorise to process Customer Personal Data is under a duty of confidentiality. Access is limited to our staff, currently our founder.

We will take the technical and organisational measures required by Article 32 of the UK GDPR. They are listed in Annex 2.

We may update these measures over time, as long as the overall level of protection does not go down.

You give us general authorisation to use sub-processors. Our current sub-processors are listed on our sub-processors page.

We will give at least 30 days' notice before adding a new sub-processor. We will post the change on the sub-processors page and, for customers on the Business plan, email your billing contacts.

You may object to a new sub-processor by emailing us within the notice period. We will work with you in good faith to address your objection. You can also cancel your subscription at any time, as set out in the Terms of Service.

We will put data protection obligations on each sub-processor that are the same in substance as those in this agreement. We remain responsible to you for their performance of those obligations.

Where Customer Personal Data is transferred outside the UK, we will rely on UK adequacy regulations where they apply, including the UK Extension to the EU-US Data Privacy Framework for certified US recipients. Otherwise we will use the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

Taking into account the nature of the processing, we will help you respond to requests from data subjects exercising their rights, including requests for access and erasure.

If we receive a request directly from one of your data subjects, we will pass it to you and will not respond ourselves except on your instructions.

On request, we will erase a committer's GitHub login. After erasure, their records show “erased” and cannot be linked back to them.

We will help you, taking into account the information available to us, with your obligations on security, personal data breaches, data protection impact assessments and prior consultation with the Information Commissioner, under Articles 32 to 36 of the UK GDPR.

We will notify you of a personal data breach affecting Customer Personal Data without undue delay, and in any event within 48 hours of becoming aware of it.

Our notice will describe, as far as we know at the time, what happened, the categories and approximate number of data subjects and records affected, the likely consequences, and what we have done or propose to do. We will send further information as it becomes available.

We will make available to you the information you reasonably need to show that we comply with Article 28 of the UK GDPR.

We will allow for and contribute to audits, including inspections, by you or an auditor you appoint, on reasonable notice.

When we stop providing the Service to you, we will, at your choice, delete or return Customer Personal Data, unless the law requires us to keep it.

The ledger, run records, policy results, verification results and account log are append-only by design and cannot be deleted. We will keep them in pseudonymised form. On request we will erase committer GitHub logins so that these records can no longer be linked back to individuals.

You acknowledge that the daily digest we publish to the public Rekor transparency log is permanent. It contains only opaque identifiers and hashes, and no personal data.

Each party's liability under this agreement is subject to the limits and exclusions in the Terms of Service.

This agreement is governed by the law of England and Wales. The courts of England and Wales have exclusive jurisdiction.

All traffic is encrypted in transit using TLS.

Data is encrypted at rest by our hosting providers.

Row-level security is enabled on the database, with no client access to it. Only our server code can access the database, using a service role.

Every run sent to the Service is authenticated by verifying its GitHub OIDC token.

Database triggers make the ledger tables append-only. The ledger is hash-chained, and its heads are anchored daily in a public transparency log.

The GitHub App asks only for the permissions it needs: checks (write), contents (read), metadata (read), pull requests (read) and members (read).

Session cookies are encrypted and HttpOnly.

Access to Customer Personal Data is limited to our staff, currently our founder.

Personal data breaches are notified to customers without undue delay and in any event within 48 hours of our becoming aware of them.

We help customers respond to data subject requests, as set out in clause 9.

At the end of the Service, data is deleted or returned, except append-only records retained in pseudonymised form as set out in clause 12.

The current list is on our sub-processors page, which forms part of this agreement.