Data processing agreement

1. Introduction and framework

This data processing agreement (the DPA) forms part of the Terms and any related order, statement of work, or main agreement between the customer and Heedvane (together, the Agreement). It governs the processing of personal data that Heedvane carries out on the customer's behalf when the customer uses the Heedvane service.

Heedvane provides a platform that performs automated review of source code in pull requests before a human reviewer looks at the change. In delivering that service, Heedvane may process personal data that is contained in, or associated with, the customer's accounts, repositories, and code.

This DPA applies only to the processing of personal data on the customer's behalf. To the extent of any conflict on the subject of data protection, this DPA prevails over the other terms of the Agreement. On all other matters, the other terms of the Agreement continue to apply.

In this DPA, Heedvane means FlowConAI UG (haftungsbeschränkt), registered in the Commercial Register of Amtsgericht Cologne under HRB 124435, with its registered office at Aachener Str. 392, 50933 Cologne, Germany. The customer is the entity that has entered into the Agreement.

2. Definitions

Terms used in this DPA have the meanings given to them below. Where a term is defined in the GDPR but not here, it has the meaning given in the GDPR.

• Applicable data protection law means all laws and regulations that apply to the processing of personal data under this DPA, including Regulation (EU) 2016/679 (the GDPR) and any applicable successor or supplementary national law.
• Controller means the party that, alone or jointly with others, determines the purposes and means of the processing of personal data.
• Processor means the party that processes personal data on behalf of the controller.
• Sub-processor means any third party engaged by Heedvane to process personal data on the customer's behalf in connection with the service.
• Personal data means any information relating to an identified or identifiable natural person that is processed under this DPA.
• Processing means any operation performed on personal data, whether or not by automated means, such as collection, storage, use, disclosure, or erasure.
• Data subject means the identified or identifiable natural person to whom personal data relates.
• Personal data breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data.
• Standard Contractual Clauses means the standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission under Decision (EU) 2021/914, as updated or replaced from time to time.

3. Roles and scope

For the processing under this DPA, the customer acts as the controller and Heedvane acts as the processor. Where the customer is itself a processor acting on behalf of its own customers, Heedvane acts as a sub-processor, and references in this DPA to the customer's instructions are to instructions that the customer is authorized to give on behalf of the relevant controller.

The customer is responsible for the lawfulness of the personal data it provides to Heedvane and for having a valid legal basis for the processing. Heedvane processes personal data only on the customer's documented instructions, including with regard to transfers, unless required to act by applicable law, in which case Heedvane will inform the customer of that legal requirement before processing, unless the law prohibits such notice on important grounds of public interest.

The customer's documented instructions are set out in this DPA, in the Agreement, and in the configuration choices the customer makes through the service, including the customer's retention setting.

4. Subject matter, duration, nature and purpose

The subject matter, duration, nature, and purpose of the processing, the categories of data subjects, and the categories of personal data are described in Annex 1. The processing concerns the provision of the Heedvane service to the customer.

This DPA takes effect on the date the Agreement takes effect and remains in force for as long as Heedvane processes personal data on the customer's behalf under the Agreement. The provisions of this DPA that are intended to survive termination, including those on deletion, confidentiality, and liability, continue to apply after termination.

5. Controller instructions

Heedvane processes personal data only on the customer's documented instructions as described in this DPA. If Heedvane is unable to comply with an instruction, it will inform the customer without undue delay.

Heedvane will inform the customer if, in its opinion, an instruction infringes applicable data protection law. In that case Heedvane may suspend the affected processing until the customer confirms, amends, or withdraws the instruction, without this giving rise to liability for Heedvane.

6. No training on customer data

Heedvane does not use customer source code, prompts, findings, or any personal data processed under this DPA to train, fine-tune, or otherwise develop machine learning or artificial intelligence models, whether Heedvane's own models or those of any third party. This is a firm contractual commitment and applies to all processing under this DPA.

Source code is processed to produce review findings and is not retained as a lasting copy. During active analysis a transient working copy may be cached for a limited period to operate the service efficiently and is cleared after a short period of inactivity, and Heedvane does not retain a full copy of the customer's source code. Subject to the customer's retention setting, Heedvane retains only findings, structural metadata, minimal bounded evidence snippets, embeddings, and pointers, in each case solely to provide and support the service and not for any training purpose.

7. Confidentiality

Heedvane treats all personal data processed under this DPA as confidential. Heedvane ensures that any person authorized to process the personal data, including its personnel and any sub-processors' personnel, is bound by an appropriate duty of confidentiality, whether by contract or by a statutory obligation, and processes the personal data only on instructions and on a need-to-know basis.

8. Security measures

Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of the processing, as well as the risks to data subjects, Heedvane implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 of the GDPR. A summary of these measures is set out in Annex 2.

These measures include transient processing of source code, so that no lasting copy of source code is retained, encryption of personal data in transit and at rest, access controls based on least privilege, and ongoing review of the effectiveness of the measures. Heedvane may update the measures over time, provided that the updated measures do not materially reduce the overall level of protection.

9. Sub-processors

The customer gives Heedvane general written authorization to engage sub-processors to assist in providing the service. The current sub-processors, their roles, and their locations are published at the trust center.

Heedvane will give the customer prior notice of any intended addition or replacement of a sub-processor, by updating the list at the trust center or by another reasonable means, so that the customer has the opportunity to object on reasonable data protection grounds before the new sub-processor begins processing. If the customer objects, the parties will work together in good faith to find a resolution. If no resolution can be found, the customer may terminate the affected part of the service.

Heedvane imposes on each sub-processor, by a written contract, data protection obligations that are equivalent in substance to those set out in this DPA. Heedvane remains fully liable to the customer for the performance of each sub-processor's obligations.

10. International transfers

Personal data is processed within the European Economic Area (EEA) by default. Heedvane will not transfer personal data to a country outside the EEA unless it has taken steps to ensure that the transfer is lawful.

Where personal data is transferred to a country outside the EEA that is not the subject of an adequacy decision, Heedvane relies on the Standard Contractual Clauses, together with any supplementary technical, organizational, and contractual measures needed to ensure an essentially equivalent level of protection. Where the Standard Contractual Clauses apply, they are incorporated into this DPA by reference and prevail over any conflicting term of this DPA in respect of the relevant transfer.

11. Data subject requests

Taking into account the nature of the processing, Heedvane assists the customer by appropriate technical and organizational measures, insofar as this is possible, to respond to requests from data subjects exercising their rights under applicable data protection law, including rights of access, rectification, erasure, restriction, portability, and objection.

If Heedvane receives a request directly from a data subject in relation to personal data processed on the customer's behalf, Heedvane will not respond to the request itself, except to confirm that the request should be directed to the customer, and will forward the request to the customer without undue delay.

12. Personal data breaches

Heedvane notifies the customer without undue delay after becoming aware of a personal data breach affecting personal data processed under this DPA. The notification will include, to the extent available, a description of the nature of the breach, the likely consequences, and the measures taken or proposed to address it.

Heedvane assists the customer in meeting the customer's own obligations to notify supervisory authorities and affected data subjects, taking into account the nature of the processing and the information available to Heedvane.

13. Assistance with impact assessments

Taking into account the nature of the processing and the information available to Heedvane, Heedvane provides the customer with reasonable assistance with data protection impact assessments under Article 35 of the GDPR and with prior consultation of the supervisory authority under Article 36 of the GDPR, where these relate to the processing carried out under this DPA.

14. Deletion and return of data

On termination or expiry of the Agreement, and at the customer's choice, Heedvane deletes or returns the personal data processed on the customer's behalf and deletes existing copies, unless applicable law requires Heedvane to retain the personal data, in which case Heedvane will retain it only for as long as required and will continue to protect it under this DPA.

Consistent with Heedvane's retention model, no lasting copy of source code is retained, and the limited findings, structural metadata, evidence snippets, embeddings, and pointers that Heedvane retains are subject to the customer's retention setting. On offboarding, Heedvane carries out a full purge of the personal data it holds on the customer's behalf, subject to any legal retention requirement described above.

15. Audits

Heedvane makes available to the customer the information reasonably necessary to demonstrate compliance with Article 28 of the GDPR and this DPA, and allows for and contributes to audits, including inspections, conducted by the customer or another auditor mandated by the customer.

The customer may satisfy its audit rights by accepting relevant third-party audit reports, certifications, or other documentation that Heedvane makes available. Any audit is subject to reasonable prior notice, takes place during normal business hours, must not unreasonably disrupt Heedvane's operations, and is subject to appropriate confidentiality obligations.

16. Liability

Each party's liability under or in connection with this DPA is subject to the exclusions and limitations of liability set out in the main agreement and the Terms. Nothing in this DPA limits any liability that cannot be limited or excluded under applicable data protection law.

17. Order of precedence and governing law

In the event of any conflict between this DPA and the other terms of the Agreement on the subject of data protection, this DPA prevails. Where the Standard Contractual Clauses apply, they prevail over this DPA in respect of the relevant transfer.

Governing law and jurisdiction follow the applicable signed order form or agreement and any mandatory German law and jurisdiction rules.

Annex 1: Details of processing

Subject matter. The provision of the Heedvane service, namely automated review of source code in pull requests before a human reviewer looks at the change.

Duration. For the term of the Agreement and any period during which Heedvane continues to process personal data on the customer's behalf, as described in this DPA.

Nature and purpose. Processing source code in order to produce review findings, and retaining, subject to the customer's retention setting, findings, structural metadata, minimal bounded evidence snippets, embeddings, and pointers, in each case to provide and support the service. No lasting copy of the customer's source code is retained; any working copy held during active analysis is transient and cleared after a short period of inactivity.

Categories of data subjects. For example, the customer's developers, engineers, and other personnel and authorized users of the service, and any individuals whose personal data is incidentally present in code or commit metadata. The customer may document any further categories in the Agreement.

Categories of personal data. For example, names, work email addresses, and account identifiers of authorized users, and any personal data incidentally present in source code, commit metadata, or pull request content, such as author names and email addresses. The customer may document any further categories in the Agreement.

Special categories of personal data. The service is not intended to process special categories of personal data. The customer must document any expected special categories in the Agreement before using the service to process them.

Annex 2: Technical and organizational measures

Heedvane implements at least the following technical and organizational measures, as described in section 8.

• Transient processing of source code during analysis, with no lasting copy of source code retained.
• No retention of a full copy of customer source code.
• Encryption of personal data in transit and at rest.
• Access controls based on least privilege, with authentication for access to systems and data.
• Logical separation of customer data.
• Confidentiality obligations for personnel and sub-processors with access to personal data.
• Logging and monitoring of access to relevant systems.
• Processes for detecting, reporting, and responding to personal data breaches.
• Regular review and testing of the effectiveness of the security measures.

Annex 3: Approved sub-processors

The current list of approved sub-processors, including their roles and locations, is published and kept up to date at the trust center. That published list forms part of this Annex 3.