Data Processing Agreement
This Data Processing Agreement (“DPA”) is entered into between ServGrid AS (“Processor”) and the organisation registering for the Service (“Controller”). It supplements the Terms of Service and governs the processing of personal data under GDPR (EU 2016/679) Article 28.
1. Subject Matter and Duration
The Processor provides a software-as-a-service platform for service catalog management. This DPA applies for the duration of the Controller account and terminates when the account is deleted or the Terms of Service expire.
2. Nature and Purpose of Processing
The Processor processes personal data on behalf of the Controller solely to provide the agreed service functions: user authentication, service catalog storage, notifications, and reporting. Processing is limited to what is necessary for these purposes.
3. Categories of Data and Data Subjects
Data subjects: staff members and customer representatives of the Controller. Categories: names, email addresses, role information, and usage metadata entered by the Controller into the platform.
The Controller must not upload special category personal data (GDPR Art. 9) to the platform on the Community or Trial tier.
4. Processor Obligations
- Process personal data only on documented instructions from the Controller
- Ensure persons authorised to process data are bound by confidentiality
- Implement appropriate technical and organisational measures (see our Privacy Policy)
- Assist the Controller with data subject rights requests within 30 days
- Delete or return all personal data upon termination of the service
- Make available all information necessary to demonstrate compliance
5. Sub-processors
The Processor uses the following sub-processors:
- Google Cloud Platform (Cloud infrastructure (compute, DB, storage)) — United States, Google Cloud EMEA Limited (Ireland) / Google LLC. DPA
- Sentry (Functional Software, Inc.) (Error monitoring) — United States, Functional Software, Inc. (USA). DPA
- Google Vertex AI (Gemini) (AI inference) — United States, Google Cloud EMEA Limited (Ireland) / Google LLC. DPA
- Stripe (Payment processing) — United States, Stripe Payments Europe, Ltd. (Ireland). DPA
- Transactional email (SMTP) (Transactional email delivery) — Global (provider-managed), [pending: transactional-email provider selection].
- Customer-selected CRM (CRM sync (customer-initiated)) — Customer-controlled region, Any of six supported providers: HubSpot / Salesforce / Microsoft (Dynamics 365) / Oracle (NetSuite) / Zoho / Pipedrive.
The Controller accepts these sub-processors by accepting this DPA. The Processor will notify the Controller of any changes to sub-processors at least 14 days in advance via email.
6. Data Transfers
The platform’s primary data plane — database, object storage, backups and AI inference — is the United States. Personal data at rest is stored there.
The sub-processors below process outside that plane, each under the safeguards recorded in their register entry. This list is generated from the Processor’s sub-processor register, so it cannot fall out of step with the data-residency declaration:
- Transactional email (SMTP) — Global (provider-managed). Email addresses, names (To: headers), email body content.
- Customer-selected CRM — Customer-controlled region. Company names, contact emails/names, subscription events, contract metadata.
No transfers beyond those listed occur unless explicitly agreed in writing.
7. Security Measures
The Processor has implemented: TLS 1.2+ in transit, GCP-managed encryption at rest, access controls, brute-force lockout, session management, audit logging, and field-level encryption for sensitive credentials.
8. Audit Rights
On the Community and Trial tier, audit rights are satisfied by the Processor providing this documentation and responding to written queries at privacy@servgrid.net. On-site audits are available on the Enterprise tier.
9. Acceptance
This DPA is accepted electronically when the Controller accepts it during account registration. The acceptance is recorded with a timestamp. For Enterprise tier DPAs with custom terms, contact privacy@servgrid.net.
10. Contact
Data Protection queries: privacy@servgrid.net