Data processing agreement

Variables

Parties’ roles

Customer will act as the data controller (”Controller“)

Abstr AB (org. no. 559512-2739) will act as the data processor (”Processor“)

Processor Contact

Name: Abstr AB

Email: privacy@abstraction.com

Main Agreement

Abstraction Terms of Service and, if applicable, the relevant Order Form (the ”Agreement”).

Breach Notification

48 hours after becoming aware of a personal data breach (the ”Breach Notification Period“)

Sub-Processor Notification

30 days before a new Sub-Processor is granted access to personal data (the ”Sub-Processor Notification Period“)

Liability Cap

Each Party’s liability for one or more breaches of this DPA shall be subject to the limitations and exclusions of liability set out in the Agreement. In no event shall either Party’s liability for a breach of this DPA exceed the liability cap set out in the Agreement. Neither Party limits nor excludes any liability that cannot be limited or excluded under applicable law.

Governing Law

As outlined in the Agreement

Data Protection Laws

All laws, regulations and court orders which apply to the processing of personal data in the European Economic Area (EEA).

This includes, amongst other things:

Regulation (EU) 2016/679 of the European Parliament and the Council as amended, supplemented and/or varied from time to time (the ”GDPR”);
Regulation (EU) 2024/1689 (the ”AI Act”); and
any applicable supplementary legislation to the GDPR, or any competent supervisory authority’s, at any given time, binding decisions, advice, recommendations and opinions

The above are jointly referred to as ”Data Protection Laws“.

Transfer Mechanism

Primary transfer mechanism:

Where applicable, the EU–US Data Privacy Framework (or a comparable adequacy-based transfer mechanism) shall be used.

Secondary transfer mechanism:

In the event that the primary transfer mechanism is not, or ceases to be, applicable, appropriate Standard Contractual Clauses (SCCs) shall be used.

1. Introduction

1.1 Purpose. When providing the Service under the Agreement, the Processor will process personal data on behalf of the Controller. Therefore, the Parties have entered this Data Processing Agreement (the “DPA”) which forms an integral part of the Terms and the Agreement. By entering into the Agreement, the Parties are also entering into this DPA, including all its appendices.

1.2 Applicability. This DPA applies to the Processor’s processing of personal data on behalf of and under the instructions of the Customer in connection with the provision of the Service (as detailed in Annex 2), to the extent the processing of personal data is subject to the Data Protection Laws.

1.3 Definitions. Lower case terms used but not defined in this DPA or the Agreement, such as “data controller”, “data processor”, “processing”, and “personal data” shall have the same meaning set forth in Data Protection Laws. Capitalized terms used, but not defined in this DPA, shall have the same meaning as in the Terms and applicable Order Form. Under this DPA:

”Adequate Country” means a country or territory that is recognised under Data Protection Laws from time to time as providing adequate protection for the processing of personal data,
”Sub-Processor” means a third-party processor engaged by the Processor for the purpose of carrying out specific processing activities with personal data under this DPA, on the Processor’s behalf.

2. Instructions

2.1 Permitted processing. The Processor shall process the personal data to fulfil the Agreement as specified in the Controller’s written instructions set forth in Annex 2. The Processor may not process the personal data for any other purposes or in any other way than as instructed by the Controller from time to time. The Parties shall update Annex 2 in the event of new or amended instructions. The Processor is entitled to reasonable compensation for any assistance provided to the Controller, or otherwise as separately agreed between the Parties. Notwithstanding the above, the Processor may undertake reasonable day-to-day actions with the personal data without having received specific written instructions from the Controller, provided that the Processor acts for and within the scope of the purposes stated in Annex 2. The Processor may always undertake the actions necessary to fulfil its obligations under the Agreement.

2.2 Unlawful instructions. In the event that the Processor considers that any instruction violates Data Protection Laws, the Processor shall refrain from acting on such instructions and shall promptly notify the Controller and await amended instructions.

3. Obligations of the Parties

3.1 Controller’s obligations. The Controller shall ensure that a legal ground recognized under Data Protection Laws applies for processing of the personal data under this DPA. The Controller shall further meet all other obligations of a data controller under Data Protection Laws and must ensure that the instructions for processing in Annex 2 comply with Data Protection Laws. The Controller has sole responsibility for the accuracy, quality, and legality of the Data and the means by which it acquired the personal data covered by this DPA.

3.2 Processor’s obligations. Processor shall:

only process personal data in accordance with Section 2 of this DPA and Annex 2 (unless legally required to do otherwise);
instruct Sub-Processor to process personal data in accordance with this DPA, and is responsible for sharing Controller’s instructions in Annex 2 with Sub-Processor prior to the processing of personal data for the purposes of this DPA;
not sell, retain or use any personal data for any purpose other than as permitted by this DPA and the Agreement;
inform Controller immediately if (in its opinion) any instructions infringe Data Protection Laws;
maintain adequate technical and organisational measures, as described in Annex 1, when processing personal data to ensure an appropriate level of security in relation to the risk involved;
notify Controller of a personal data breach within the Breach Notification Period and provide assistance to Controller as required under Data Protection Laws in responding to it;
ensure that anyone authorised to process personal data is committed to confidentiality obligations reflecting those undertaken by the Processor under the Agreement;
without undue delay, provide Controller with reasonable assistance with:
1. data protection impact assessments;
2. responses to data subjects’ requests to exercise their rights under Data Protection Laws; and
3. engagement with supervisory authorities;
if requested, provide Controller with information necessary to demonstrate its compliance with obligations under Data Protection Laws and this DPA; and
allow for audits at Controller’s reasonable request, provided that audits are limited to once a year and during business hours except in the event of a personal data breach.

3.3 Return and deletion of personal data. The Processor shall upon termination of the Agreement transfer the personal data to the Controller in a common machine-readable format upon the Controller’s written request. The Processor must erase the personal data from its systems no earlier than 30 days and no later than 60 days after the effective date of termination of the Agreement, unless retention is required by applicable law or regulations.

3.4 Warranties. The Parties warrant that they and any staff and/or subcontractors acting on that Party’s behalf will comply with their respective obligations under Data Protection Laws for the term of this DPA.

4. Sub-Processors

4.1 Use of Sub-Processors. The Controller provides the Processor with a general authorisation to engage Sub-Processors to process personal data or any part thereof on the Processor’s behalf. Processor’s existing and approved Sub-Processors, as updated from time to time, are listed in abstraction.com/subprocessors.

4.2 Sub-Processor requirements. Processor shall:

enter into a written agreement with every Sub-Processor, in which each Sub-Processor undertakes obligations reflecting those undertaken by the Processor under this DPA;
ensure appropriate safeguards are in place before internationally transferring personal data to its Sub-Processor; and
be liable towards the Controller for each Sub-Processor’s acts and omissions as for its own.

4.3 Approvals. Processor may appoint new Sub-Processors provided that they notify Controller in writing in accordance with the Sub-Processor Notification Period.

4.4 Objections. Controller may reasonably object in writing to any future Sub-Processor as notified by the Processor. Such objection must be made within the Sub-Processor Notification Period. If the Controller objects to any such Sub-Processor and shows reasonable grounds for such objection, the Processor shall refrain from using such Sub-Processor for the processing of personal data and shall use reasonable efforts to make available to the Controller a change in the Service or recommend a commercially reasonable change to Controller’s configuration or use of the Service to avoid processing of personal data by that Sub-Processor. In the event the Processor finds that such change is not practically or commercially reasonable, the Processor shall notify the Controller thereof and the Controller shall be entitled to terminate the Agreement to the extent necessary to avoid processing of personal data by that Sub-Processor. If the Controller has not objected to the appointment of a Sub-Processor within the Sub-Processor Notification Period, the Controller shall be deemed to have approved such Sub-Processor. When the Controller has approved a Sub-Processor, the Controller may no longer object to such Sub-Processor.

5. International personal data transfers

5.1 Instructions for transfers. The Processor may transfer personal data outside the EU/EEA, including to the approved Sub-Processors specified at abstraction.com/subprocessors, provided that a valid legal ground applies for such transfer under the Data Protection Laws. In the event of a transfer of personal data outside the EU/EEA initiated by the Processor, the Processor shall upon the Controller’s request demonstrate that such valid legal ground applies to the transfer. Where the Controller has enabled EU-only processing in the settings of the Service, or where agreed in an applicable Order Form, the Processor shall process personal data, including through its Sub-Processors, only within the EU/EEA.

5.2 Transfer mechanism. Where personal data will be transferred outside of the EU/EEA or an Adequate Country, the applicable transfer mechanism for such transfer shall be specified herein.

5.3 Additional measures. If the specified transfer mechanism is deemed insufficient to safeguard the transferred personal data, the Processor shall promptly implement supplementary measures to ensure personal data is protected to the same standard as required under Data Protection Laws.

6. Miscellaneous

6.1 Term. This DPA shall, notwithstanding the term of the Agreement, enter into effect when the Processor commences to process personal data on behalf of the Controller and shall terminate when the Processor has erased the personal data in accordance with Section 3.3 above.

6.2 Survival. Any provision of this DPA which, due to its nature, is intended to survive the termination of the Agreement shall remain in full force.

6.3 Order of precedence. In the event of a conflict between this DPA and other documents forming part of the Agreement, the following order of precedence shall apply:

The applicable transfer mechanism (as specified in this DPA);
This DPA;
The applicable Order Form; and
The Terms.

6.4 No third-parties. This DPA does not confer any rights or remedies upon any person or entity other than the Parties and their respective affiliates.

6.5 Entire agreement. This DPA supersedes all prior discussions and agreements and constitutes the entire agreement between the Parties with respect to its subject matter and neither Party has relied on any statement or representation of any person in entering into this DPA.

6.6 Amendments and notices. The Processor may update this DPA from time to time by providing the Controller with no less than 30 days’ prior written notice. If the Controller does not agree to such updates, the Controller may terminate the Agreement (including this DPA) before the updates take effect. Formal notices under this DPA shall be made in accordance with the Terms, or as otherwise stated in the Agreement.

6.7 Assignment. Neither Party may assign this DPA to anyone else without the other Party’s written consent.

6.8 No waiver. Delay by either Party to exercise a right or remedy under this DPA shall not affect such Party’s right to enforce such right or remedy at a later time. A waiver by any Party of a breach of any provision under this DPA shall not be construed to be a waiver by such Party in relation to subsequent breaches of such or other provisions in this DPA.

6.9 Governing law and jurisdiction. This DPA shall be governed by and construed in accordance with the governing law specified in the Agreement. Any dispute, controversy or claim arising out of or in connection with this DPA, or the breach, termination or invalidity thereof, shall be resolved in accordance with the dispute resolution mechanism set out in the Agreement.

Annex 1 – Security measures

Technical and Organisational Measures

Technical measures:

All data is encrypted in transit using TLS 1.2 or higher.
Abstraction Workspace access managed by Controller.
All access to Workspace data enforced by RBAC in API.
Source code is analysed in isolated environments without access to the database, and each analysis is stored separately under the customer’s organisation. Other data (for example accounts, chat history and pull request metadata) is stored in a shared database, separated per organisation and Workspace by access control in our API.
Any use of external language models is done with “zero data retention” enabled and no training allowed on data.
We have point-in-time restore capability and database deletion protection.
The Service is designed to process the minimum personal data necessary.

Organizational measures:

MFA enforced on all Processor’s staff accounts.
Measures such as MFA on Controller’s User accounts are managed by the User in their GitHub or Google settings (depending on sign-on method).
Production database requires internal VPN access.
Automated and manual review of code.
A documented incident response plan, including notification to the Controller within the Breach Notification Period.

Annex 2 – Instructions

Subject-matter

The Controller has requested the Processor to provide the Service to Controller, which includes the processing of personal data, which includes the Controller’s (i) use of Abstraction’s system, i.e. a cloud-based software as a service solution used by Controller for the main purposes of analysing the Controller’s source code repositories to provide automated pull request reviews, architectural checks, codebase documentation, and an AI assistant answering questions about the codebase, and (ii) receipt of associated support/maintenance services, including problem report handling services.

Nature and Purpose of the Processing

Personal data will be processed in accordance with the services outlined in the Agreement (including this DPA) and as further instructed by Controller from time to time during the performance of said services.

Such processing includes:

Reading the repositories, branches and paths that the Controller selects via the integrations with source code hosting platforms that the Controller connects (for example GitHub, GitHub Enterprise or GitLab) and the Service’s settings, including source code, commit history and authorship information (git blame), and pull/merge request data. The Controller decides which parts of the codebase are indexed and, separately, which parts may be sent to AI model providers.
Analysing the code in an isolated processing environment per customer, and storing the results in encrypted storage in the EU (Google Cloud) for as long as the repository is connected.
Sending code, diffs and descriptions derived from code, within the scope permitted by the Controller, to AI model providers listed as Sub-Processors under “zero data retention” terms, to generate reviews, checks, documentation and answers. This may include contributor names, usernames, email addresses and any other personal data contained in the source code.
Posting review comments and check results on the Controller’s pull/merge requests in the connected platform.
Showing authorship of code (git authors and contributors) alongside functions and review findings.
Processing chat conversations in the Service and, where the Controller has enabled the Slack integration (opt-in), Slack messages in channels and threads where the Service is invoked.
Sending service emails (e.g. invitations) to the Controller’s Users.
Logging and monitoring the operation of the Service, where operational logs may incidentally contain personal data, including temporary storage of AI interaction records (prompts and responses) for up to 30 days for troubleshooting, ensuring the Service functions as intended, and providing support at the Controller’s request.

Duration of the Processing

Data will be processed by the Processor for the longer of (i) the duration of this DPA or (ii) the duration as required under Data Protection Laws or other applicable legislation.

Categories of Personal Data

The types of information and personal data processed which may be processed for the Services are:

For login and access to the Service:
- Name and email address
- User ID and username from the identity provider used for sign-in (for example GitHub or Google)
Processed by application:
- Git commit author names and email addresses
- User IDs and usernames on the connected source code hosting platforms
- Slack user IDs and message content (only where the Slack integration is enabled)
- Any personal data contained in source code within the scope selected by the Controller
- Any other personal data entered into the Service by users via chat or document generation

Categories of Data Subjects

The Controller’s employees and contractors who use the Service or contribute to the Controller’s codebase
The Controller’s private customers and business partners, to the extent their personal data appears in source code or user’s input