Data Processing Agreement (DPA)

When using Pierrr, the customer may pass and host personal data about its own end users. For this data the customer is the controller and Pierrr acts as processor, processing it only to provide the service (build, deployment, managed database hosting, backups, monitoring).

If you manage a server you own with the Pierrr agent, your applications and data stay on your server: Pierrr then only receives the operating information needed (container state and usage, scan summaries) and does not host the content of your databases.

The categories of data and data subjects depend on the application the customer deploys and remain under its control. They may include, for example, the customer's end users' accounts and content, stored in the managed database and the deployed code. Pierrr does not access the content of this data in the normal course of the service. The customer agrees not to entrust special categories of data (health, biometric data, criminal convictions) without checking that the measures described below suit its case.

Processing by Pierrr lasts as long as the matching project is active on the platform. It ends when the project is decommissioned or the account is closed, subject to the return and deletion steps described below.

Pierrr processes the customer's data only on the customer's documented instructions, given through use of the platform and this agreement. Pierrr does not use this data for its own purposes and does not process it outside the scope of the service. If a legal obligation requires additional processing, Pierrr tells the customer unless the law forbids it. If an instruction seems to Pierrr to breach the law, Pierrr tells the customer.

Access to customer data is limited to Pierrr staff who strictly need it to run and maintain the service. This staff is bound by a duty of confidentiality.

Pierrr applies appropriate technical and organisational measures: encryption of communications (HTTPS), encryption at rest for secrets and backups, isolation between each customer's spaces, access control and logging. These measures are reviewed regularly. They also include encrypted backups copied off site, two-factor authentication available to all accounts, access tokens stored as a hash and regular security testing of the platform.

The customer gives Pierrr general authorisation to use sub-processors, each bound by data protection obligations equivalent to those of this agreement. The up-to-date list is on the sub-processors page (/legal/subprocessors). Pierrr tells the customer of any addition or replacement at least 30 days in advance, by updating that page and, on request, by email, and gives the customer the chance to object on legitimate data protection grounds. Pierrr remains responsible for its sub-processors' performance of their obligations.

Pierrr is established in the United Kingdom and hosts its infrastructure in the European Union. Where a transfer to a country without an adequacy decision is necessary, it is covered by the European Commission's standard contractual clauses and, for data subject to the UK GDPR, the matching UK addendum, or by any other recognised mechanism. The parties agree that these clauses are incorporated into this agreement where needed.

If a personal data breach affects the customer's data, Pierrr tells the customer without undue delay after becoming aware of it, with the information the customer needs to meet its own notification duties (in particular the 72-hour deadline to the supervisory authority).

Pierrr reasonably assists the customer in answering data subject requests (access, rectification, erasure, portability), with security of processing, with impact assessments and with any prior consultation of the supervisory authority. If a data subject contacts Pierrr directly about the customer's data, Pierrr refers them to the customer.

At the end of the service, on the customer's request, Pierrr returns the customer's data in a usable format and then deletes it. Unless the law requires retention, project data is deleted when the project is decommissioned and the matching encrypted backups are purged within 30 days. You can export your data yourself at any time from the dashboard (project export, downloadable backups) or through the API.

Pierrr makes available to the customer the information needed to show compliance with this agreement and allows audits under reasonable, confidential conditions, including by a third party the customer appoints, with reasonable notice, without disrupting the service or compromising the security of other customers.

Each party's liability under this agreement is subject to the limits set out in the Terms of Service, unless the law requires otherwise. This agreement is governed by English law, subject to the mandatory data protection rules that apply. For any question or request about this agreement: team@pierrr.com, with "DPA" in the subject line.