Data processing agreement (GDPR Art. 28) — hosted edition

Status: Template — to be reviewed by the controller's DPO / counsel. Draft of 2026-10-13; not reviewed yet.

This template applies to the hosted (Enterprise) edition of CodeLotse, where Quavon UG (haftungsbeschränkt) processes personal data on behalf of the customer. It does not apply to the self-hosted edition: there, Quavon UG (haftungsbeschränkt) has no access to the customer's personal data and is not a processor.

In the hosted edition, customers conclude the click-through version of this agreement, which is part of the hosted edition's documentation (not part of this repository), when they claim their organisation; keep both texts in line. The clause numbers in brackets refer to the GDPR. Text in angle brackets (<…>) is filled in when the agreement is concluded. Instead of this template, the parties may use the European Commission's standard contractual clauses between controllers and processors (Implementing Decision (EU) 2021/915); counsel decides.

1. Parties and subject matter

1.1 Controller: <customer legal name> ("Customer"). 1.2 Processor: Quavon UG (haftungsbeschränkt) ("Processor"). 1.3 The Processor processes personal data for the Customer to provide the CodeLotse hosted service under the main agreement <reference>. This agreement takes precedence over the main agreement for everything concerning personal data. 1.4 Duration: as long as the main agreement, plus the deletion period in clause 10.

2. Nature, purpose, data and data subjects (Art. 28(3), first sentence)

Item	Content
Nature of processing	Receiving events from the Customer's Git host, storing them, analysing them with the model route the Customer selected, publishing results back to the Customer's repositories, showing them in the dashboard, deleting them under the retention settings
Purposes	Code review, issue triage and replies, chat commands, draft fixes, acceptance checks, and — only if the Customer enables them — reviewer and assignee suggestions and team analytics
Categories of personal data	Account identifiers and logins at the Git host or identity provider; names as shown at the Git host; IdP group names; text written by people in pull requests, issues, comments and code; review and assignment records; opt-in availability intervals (from/to only); audit entries with IP addresses
Special categories (Art. 9)	Not intended. Free text in issues or code may contain them incidentally; the Customer should not use the service to process them
Data subjects	The Customer's employees and contractors using the service or working in connected repositories; external contributors to connected repositories

The full list per table is the data inventory; the processing activities are in the RoPA, Part A.

3. Instructions (Art. 28(3)(a), 29)

3.1 The Processor processes personal data only on documented instructions from the Customer, including for transfers to third countries, unless EU or Member State law requires otherwise; in that case the Processor informs the Customer before processing unless that law prohibits it. 3.2 The Customer's instructions are this agreement, the main agreement and the settings the Customer makes in the service (enabled features, repositories, model routes and regions, retention, approval modes). Changing a setting is an instruction. Every change of a setting is recorded in the audit log. 3.3 The Processor informs the Customer without delay if, in its opinion, an instruction infringes the GDPR or other data protection law (Art. 28(3), last subparagraph). 3.4 The Processor does not use Customer data for its own purposes. In particular, it does not train or fine-tune models with Customer data, and learning features adjust only per-repository parameters inside the Customer's tenant. 3.5 To operate, secure and plan the capacity of the service, the Processor may compute anonymous statistics on request: instance-wide counts of signed-in and active users (shown only from 5 users upward and never per Customer or per person), and instance-wide counts and durations of review, triage and model runs. These statistics are not stored, contain no identifiers of persons, repositories or content, are not combined with other data to single out a person, and every view is audit-logged. The Processor's own billing and contract data about the Customer (plan, subscription state, seats, monthly usage counts) is not Customer data within the meaning of this clause.

4. Confidentiality (Art. 28(3)(b))

The Processor ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. Access to production data is limited to named operations staff, through the audited break-glass procedure, and only with the Customer's approval except in an emergency affecting the security of the service, which is reported to the Customer afterwards.

5. Security of processing (Art. 28(3)(c), 32)

The Processor takes the measures described in the technical and organisational measures. The Processor may update them if the level of protection does not decrease; material changes are notified to the Customer.

6. Sub-processors (Art. 28(2), 28(3)(d), 28(4))

6.1 The Customer gives general written authorisation for the sub-processors listed in subprocessors.md at the time of signature. 6.2 Model providers are engaged only for the routes the Customer configures. A model route the Customer does not configure receives no data. 6.3 The Processor informs the Customer at least <30> days in advance of any intended addition or replacement of a sub-processor. The Customer may object on reasonable data protection grounds within that period. If the parties cannot agree, the Customer may terminate the affected service. 6.4 The Processor imposes the same data protection obligations as in this agreement on each sub-processor by contract, in particular sufficient guarantees for appropriate technical and organisational measures. The Processor remains fully liable to the Customer for the performance of its sub-processors' obligations.

7. Assistance with data subject rights (Art. 28(3)(e))

7.1 The Processor assists the Customer by appropriate technical and organisational measures in responding to requests under Chapter III GDPR. The service provides an export and a deletion function per person (quavon dsar export|delete), an individual opt-out from assignment suggestions and a personal opt-in for the analytics self view. The procedure is described in data-subject-rights.md. 7.2 If a data subject contacts the Processor directly, the Processor forwards the request to the Customer without delay and does not answer it itself unless instructed.

8. Assistance with Articles 32 to 36 (Art. 28(3)(f))

8.1 Security (Art. 32): see clause 5. 8.2 Personal data breaches (Art. 33, 34): the Processor notifies the Customer without undue delay and at the latest within <24> hours after becoming aware of a personal data breach affecting Customer data, with the information available under Art. 33(3), and supplements it as it becomes available. 8.3 DPIA and prior consultation (Art. 35, 36): the Processor provides the information it holds, in particular the DPIA templates for assignment and analytics, the threat model and the measures.

9. Information and audits (Art. 28(3)(h))

9.1 The Processor makes available all information necessary to demonstrate compliance with Art. 28, including this agreement's annexes, the list of sub-processors, the measures and, once available, audit reports or certificates. 9.2 The Processor allows for and contributes to audits, including inspections, by the Customer or an auditor mandated by the Customer, with <30> days' notice, during business hours, without disrupting operations and subject to confidentiality. Audits are limited to <once per year> unless there is a personal data breach or a supervisory authority requires otherwise.

10. Deletion or return at the end of the service (Art. 28(3)(g))

10.1 At the end of the service, at the Customer's choice, the Processor deletes or returns all personal data and deletes existing copies, unless EU or Member State law requires storage. 10.2 Return: an export of the tenant's data in a machine-readable format, requested within <30> days after the end of the service. 10.3 Deletion: the tenant and all tenant tables are deleted within <30> days after the end of the service or after the return; backups expire within <backup retention>. The Processor confirms the deletion in writing. 10.4 Audit log entries are kept as long as legally required for accountability; their retention and pseudonymisation are open points for counsel (see review checklist).

11. Transfers to third countries (Chapter V)

The Processor hosts the service in the EU. Transfers outside the EEA happen only through a model route the Customer configures for a provider or region outside the EEA, on the safeguard listed for that route in subprocessors.md. The Customer can restrict model routes to EU processing (EU-only routing option).

12. Liability and final provisions

<Liability, governing law and place of jurisdiction follow the main agreement unless counsel decides otherwise.>

Signatures

Party	Name, role	Date	Signature
Customer
Quavon UG (haftungsbeschränkt)

Open points for the DPO / counsel

1. Use this template or the Commission's standard contractual clauses (2021/915).
2. Notification period for breaches (clause 8.2), objection period for sub-processors (6.3), audit frequency (9.2), deletion period (10.3).
3. Backups do not exist yet; the deletion clause must name the backup retention once they do.
4. Emergency access without prior approval (clause 4): scope and reporting.