Data processing addendum

Scope and roles

This addendum applies when BufferSol Technologies processes personal data contained in your repositories on your behalf, for example author names and email addresses in commit history and code, while running an upgrade. You are the controller and we are the processor. It forms part of the terms of service.

Details of processing

• Subject matter: reading repository contents in an isolated sandbox to apply and verify upgrade changes, and opening pull requests on your repository. Customer code is not retained after a run.
• Duration: while your account is open, plus the deletion period in the privacy policy.
• Data subjects: people whose personal data appears in your repositories, such as developers and, if present in code or test fixtures, your users.
• Data types: whatever your repositories contain. A free inspection reads only composer.json and composer.lock. Run logs are kept for 30 days with secrets redacted.

Our obligations

• We process personal data only on your documented instructions, which are these terms and your use of the service.
• Everyone with access is bound by confidentiality.
• We apply the security measures described on the security page.
• We help you answer data subject requests and meet your security and breach duties, taking into account the nature of processing.
• We notify you without undue delay, and within 72 hours where we can, after becoming aware of a personal data breach.
• On termination we delete or return the data as described in the privacy policy, unless the law requires us to keep it.
• We give you the information you reasonably need to show compliance and allow audits through a written questionnaire once a year.

Subprocessors

You authorize the subprocessors on our subprocessors page. We will give you at least 14 days notice before adding or replacing one, and you may object on reasonable grounds.

International transfers

Where personal data moves from the EEA, UK or Switzerland to a country without an adequacy decision, the Standard Contractual Clauses (module two, controller to processor) and the UK addendum apply and are incorporated here.

Contact and signed copy

To request a countersigned copy, email legal@buffersoltech.com. Our address is {{registered address}}.