Data Processing Agreement

1. Definitions

"Customer Data" means personal data contained in the databases you connect to the Service, in the results of queries you run, and in content you submit to the Service (such as query text, dashboards, and export destinations), to the extent it constitutes personal data under the GDPR. Terms such as "controller", "processor", "data subject", "processing", and "personal data breach" have the meanings given in the GDPR. Capitalised terms not defined here have the meanings given in the Terms & Conditions.

2. Roles of the Parties

For Customer Data, you are the controller (or a processor acting on behalf of another controller) and we are your processor. For personal data we collect for our own purposes, such as account, authentication, billing, support, and usage data, we act as an independent controller as described in our Privacy Policy; that processing is outside the scope of this DPA.

3. Details of Processing

We do not use Customer Data for any purpose other than providing the Service. We do not use Customer Data to develop or train artificial intelligence or machine learning models, and we do not sell it.

4. Processor Obligations

We will:

• process Customer Data only on your documented instructions, including with regard to international transfers, unless required to do otherwise by EU or Member State law (in which case we will inform you before processing, unless the law prohibits this). Your use and configuration of the Service, including the queries you run and the destinations you configure, constitute your documented instructions;
• inform you if, in our opinion, an instruction infringes the GDPR or other applicable data protection law;
• ensure that persons authorised to process Customer Data are bound by confidentiality obligations;
• implement the technical and organisational measures described in Section 5;
• respect the subprocessor conditions in Section 6;
• assist you as described in Sections 7 through 9;
• delete or return Customer Data as described in Section 10; and
• make available the information described in Section 11.

5. Security (Technical and Organisational Measures)

Taking into account the state of the art and the nature of the processing, we implement appropriate measures to protect Customer Data, including:

• encryption in transit (TLS) for all connections to and from the Service;
• encryption of stored database credentials, SSH private keys, cloud access keys, and integration tokens at the application layer, in addition to encryption at rest provided by our infrastructure providers;
• access controls including role-based permissions within the Service, optional two-factor authentication (TOTP), and scoped API keys;
• the principle that query results are processed transiently for delivery and display and are not retained as a copy of your databases;
• logical separation of customer workspaces;
• monitoring, rate limiting, and operational alerting to detect abuse and incidents; and
• restriction of production data access to authorised personnel.

We may update these measures from time to time, provided the overall level of protection is not materially reduced.

6. Subprocessors

You grant us general authorisation to engage subprocessors to provide the Service. Our current subprocessors are listed in Section 15 of the Privacy Policy. We will update that list before adding or replacing a subprocessor. If you object to a new subprocessor on reasonable data protection grounds, you may terminate the affected subscription before the change takes effect; continued use of the Service after the change constitutes acceptance.

We impose data protection obligations on each subprocessor that are materially equivalent to those in this DPA, and we remain liable to you for their performance.

7. Assistance with Data Subject Rights

Taking into account the nature of the processing, we will assist you with appropriate technical and organisational measures, insofar as this is possible, in fulfilling your obligation to respond to data subject requests under Chapter III of the GDPR. In practice, because the Service queries your own databases rather than storing a copy of them, you can usually fulfil such requests directly in your source systems. If a data subject contacts us directly about Customer Data, we will refer them to you.

8. Personal Data Breach

We will notify you without undue delay after becoming aware of a personal data breach affecting Customer Data, and will provide information reasonably available to us to help you meet your obligations under Articles 33 and 34 of the GDPR, including the nature of the breach, the categories and approximate number of data subjects and records concerned where known, the likely consequences, and the measures taken or proposed.

9. Data Protection Impact Assessments

We will provide reasonable assistance with data protection impact assessments and prior consultations with supervisory authorities under Articles 35 and 36 of the GDPR, insofar as they relate to our processing of Customer Data and the necessary information is available to us.

10. Deletion and Return of Customer Data

Customer Data held by the Service is limited to content you have saved (such as query text, connection configurations, dashboards, and cached results needed to display them). You can delete connections, queries, and other content at any time through the Service. Upon termination of your account, we will delete Customer Data within ninety (90) days, unless retention is required by applicable law. You are responsible for exporting any content you wish to keep before termination. Your source databases are never stored by us and are unaffected by deletion of your account.

11. Audits and Information

We will make available to you information reasonably necessary to demonstrate compliance with this DPA, and will allow for and contribute to audits, including inspections, conducted by you or an auditor mandated by you. Audits may be conducted no more than once per twelve (12) months (except following a personal data breach or at the instruction of a supervisory authority), on at least thirty (30) days' written notice, during normal business hours, without disrupting our operations, and at your cost. We may first satisfy an audit request by providing recent third-party certifications or audit reports from ourselves or our infrastructure subprocessors.

12. International Transfers

Customer Data may be processed by subprocessors located outside the European Economic Area, including in the United States, as listed in the Privacy Policy. Where such transfers occur, we rely on adequacy decisions of the European Commission (including the EU-U.S. Data Privacy Framework where the recipient is certified) or the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), which are incorporated into our agreements with the relevant subprocessors. Where we transfer Customer Data to you outside the EEA at your instruction (for example, delivering query results to a destination you configure), you are responsible for the lawfulness of that transfer.

13. Liability, Term, and Governing Law

The liability of each party under this DPA is subject to the limitations of liability in the Terms & Conditions. This DPA takes effect when you first use the Service, remains in force for as long as we process Customer Data on your behalf, and automatically terminates upon deletion of Customer Data under Section 10. In case of conflict between this DPA and the Terms & Conditions regarding the processing of Customer Data, this DPA prevails. This DPA is governed by the laws of Finland, and disputes are subject to the exclusive jurisdiction of the courts of Helsinki, Finland.

14. Contact

Questions about this DPA, requests for a countersigned copy, and data protection enquiries may be submitted through the contact form in the Service.