Data
processing.

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between Værft ApS (the processor) and the Customer (the controller). It covers personal data contained in Customer Content — the code, databases, files, logs, and environment data you deploy or store on the Service (“Customer Personal Data”).

It does not cover the account, billing, and operational data we process as a controller ourselves; that is described in the Privacy Policy.

We process Customer Personal Data only to provide the Service: building, hosting, running, backing up, restoring, and transmitting your applications and their data, for the duration of the agreement. Subject matter, categories of data subjects, and types of data are determined entirely by what you choose to deploy.

• We process Customer Personal Data only on your documented instructions — given through your use and configuration of the Service — unless EU or Danish law requires otherwise, in which case we inform you unless the law forbids it.
• Everyone we authorise to process the data is bound by confidentiality.
• We assist you, as far as reasonably possible, with data-subject requests (arts. 12–23) and with your obligations under arts. 32–36 (security, breach notification, DPIAs).
• We notify you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, with the information art. 33(3) requires as it becomes available.
• We make available the information reasonably necessary to demonstrate compliance with art. 28, and allow audits as described in section 07.

Taking into account the state of the art and the risks of the processing, we implement measures including:

• encryption of data in transit (TLS) and encryption of stored secrets and environment variables;
• workload isolation between tenants at the container and network level;
• role-based access control, two-factor authentication, and scoped API tokens;
• audit logging of administrative and deployment actions;
• scheduled encrypted backups with defined retention, and tested restore procedures;
• vulnerability and secret scanning in the build pipeline, and timely patching of platform components.

You give general written authorisation for the subprocessors listed on the subprocessors page. We will announce additions or replacements at least 30 days before they take effect (by email or in the dashboard), giving you the opportunity to object; if we cannot resolve a reasonable objection, you may terminate the affected service. We impose data-protection obligations on every subprocessor equivalent to those in this DPA and remain fully liable for their performance.

Customer Personal Data is stored and processed in the European Union. If a transfer outside the EU/EEA ever becomes necessary, it will only happen under an adequacy decision or the EU Standard Contractual Clauses, and the subprocessors page will say so per vendor.

Once per 12-month period, and on reasonable written notice, you may audit our compliance with this DPA — in the first instance through documentation, security summaries, and written answers to reasonable questions. On-site inspections are limited to what art. 28 requires, must not endanger other customers’ data, and are at your cost.

During the agreement you can export or delete Customer Personal Data yourself through the Service. When the agreement ends, we keep Customer Content available for export for 30 days (per the Terms), then delete it, including from backups within the backup retention window — unless EU or Danish law requires longer storage.

If this DPA conflicts with the Terms, the DPA prevails for data-protection matters. It is governed by the same law and venue as the Terms. Questions: [email protected].