QuickPatchSign in

Legal

Data Processing Addendum (DPA)

Effective date: June 7, 2026 · For customers who require a DPA under GDPR/UK GDPR and similar laws.

This DPA forms part of the agreement between Softever (“Processor”) and the customer (“Controller”) for use of the Service (the “Agreement”), and applies to the extent Softever processes Personal Data on the Controller’s behalf. Capitalized terms not defined here have the meaning given in the Code Push Terms of Service. In case of conflict on data-protection matters, this DPA controls.

1. Definitions

“Personal Data,” “processing,” “controller,” “processor,” “data subject,” and “personal-data breach” have the meanings given in applicable data-protection law, including the EU General Data Protection Regulation (GDPR) and the UK GDPR (“Data Protection Law”).

2. Roles and instructions

The Controller determines the purposes and means of processing; the Processor processes Personal Data only on the Controller’s documented instructions, including those set out in the Agreement, this DPA, and the Controller’s use of the Service’s features, unless required to act otherwise by law (in which case the Processor will inform the Controller unless legally prohibited). The Processor will inform the Controller if, in its opinion, an instruction infringes Data Protection Law.

3. Details of processing

  • Subject matter and duration - provision of the over-the-air code-push Service for the term of the Agreement and any wind-down period.
  • Nature and purpose - hosting, storing, transmitting, signing, caching, and delivering the Controller’s Releases and Patches, and related telemetry, to operate and secure the Service.
  • Categories of data subjects - the Controller’s authorized users and, where applicable, End Users of the Controller’s Applications.
  • Categories of Personal Data - account identifiers; application and Release identifiers; technical and log data (including IP address); and update-delivery telemetry, as described in the Privacy Policy. The Controller will not upload special-category data or use the Service to process it.

4. Processor obligations

  • Process Personal Data only on the Controller’s documented instructions;
  • Ensure persons authorized to process Personal Data are bound by confidentiality;
  • Implement and maintain appropriate technical and organizational security measures (Section 6);
  • Assist the Controller, taking into account the nature of processing and the information available, with data-subject requests and with the Controller’s obligations regarding security, breach notification, and data-protection impact assessments;
  • Make available information necessary to demonstrate compliance with this DPA.

5. Confidentiality

The Processor will keep Personal Data confidential and limit access to personnel who need it to provide the Service and who are subject to confidentiality obligations.

6. Security measures

The Processor implements measures appropriate to the risk, which may include: encryption of data in transit; access controls and least-privilege administration; cryptographic signing and on-device verification of patch artifacts; network and application security controls; logging and monitoring; and regular review of its security program. A summary is available on request; details may be provided under confidentiality.

7. Sub-processors

The Controller authorizes the Processor to engage the sub-processors identified in the Privacy Policy (currently Vercel, Railway, Cloudflare R2, Google, and Razorpay) to process Personal Data. The Processor will impose data-protection obligations on each sub-processor that are no less protective than this DPA and remains responsible for their performance. The Processor will give the Controller notice of intended additions or changes to sub-processors so the Controller may object on reasonable grounds.

8. Data-subject requests

Taking into account the nature of the processing, the Processor will assist the Controller by appropriate measures, insofar as possible, to respond to requests from data subjects exercising their rights under Data Protection Law. If the Processor receives such a request directly, it will, unless legally prohibited, promptly forward it to the Controller and not respond except on the Controller’s instruction.

9. Personal-data breach

The Processor will notify the Controller without undue delay after becoming aware of a personal-data breach affecting the Controller’s Personal Data, and will provide information reasonably available to assist the Controller in meeting its breach-notification obligations.

10. International transfers

Where the Processor transfers Personal Data out of the EEA, UK, or Switzerland to a country without an adequacy decision, the parties incorporate by reference the EU Standard Contractual Clauses (and the UK Addendum and Swiss amendments as applicable), with the Processor (or its relevant entity) as data importer, completed with the details of this DPA and the Agreement.

11. Deletion and return

On termination of the Agreement, the Processor will, at the Controller’s choice, delete or return the Personal Data and delete existing copies within 90 days, except to the extent retention is required by law. Personal Data in routine backups is deleted in accordance with the Processor’s backup-rotation schedule.

12. Audits

The Processor will make available information necessary to demonstrate compliance with this DPA and allow for and contribute to audits, including inspections, conducted by the Controller or an auditor it mandates, subject to reasonable notice, frequency, confidentiality, and security-protective terms.

13. Liability and execution

Each party’s liability under this DPA is subject to the limitations and exclusions of liability in the Agreement. To request a countersigned copy of this DPA, contact support@quickpatch.dev.