Data Processing Agreement
- Your app’s users’ data stays yours. We process it only to deliver the job you paid for.
- Work happens in the EU, in disposable environments, with a backup taken first.
- AI models see code, schema and synthetic samples, never real records from your database.
- When the job closes we delete the working copies and revoke our access.
- We tell you without undue delay if a breach affects your data.
1. Parties and scope
This agreement is between you, the customer, as controller, and Variant Work Consulting Agency S.L., Via Laietana, 39, Planta 2, 08003 Barcelona, Spain (“we”), as processor. It forms part of our Terms of Service and applies to every paid job (App Rescue, App Independence, Production Ready and paid assessments) in which we handle personal data contained in your app, its code or its database. It meets the requirements of Article 28 of the General Data Protection Regulation (GDPR).
The personal data you give us about yourself as a customer (your account, billing and contact details) is not covered here: we are its controller, as described in our Privacy Policy.
2. Details of the processing
- Subject matter and purpose: diagnosing, fixing, migrating and hardening your app as set out in the scope you accepted, including backups, tests and verification.
- Duration: from payment until the job closes, plus the deletion period in section 9.
- Nature: storing, copying, reading, restructuring and deleting, in the course of cloning code, taking and restoring backups, running the app in a sandbox and changing it.
- Types of personal data: whatever your app holds, typically names, email addresses, account and usage records, and any other data your users entered.
- Data subjects: your app’s users, customers and staff, and anyone else whose data your app holds.
- Special categories: you must tell us before checkout if your app holds health, biometric or other special-category data, or data about children. We may decline the job.
3. Your instructions
We process personal data only on your documented instructions, which are the accepted scope, these terms and anything you confirm in writing in the portal. If we think an instruction breaks data protection law, we tell you and pause that part of the work. If the law requires us to process data in another way, we tell you first unless the law forbids it.
4. Confidentiality
Everyone who can access your data for us, including the engineers who review your job, is bound by a written confidentiality obligation and sees only what the job needs.
5. Security
We protect your data as Article 32 GDPR requires. In particular:
- Work runs in disposable sandboxes in the EU (Frankfurt) that are destroyed after use, with network access limited to what the job needs.
- A backup of code and database is taken, and its restore tested, before any change.
- AI models receive source code, database schema and synthetic sample data, never real records from your production database.
- Access is least-privilege and per job: read-only until you approve work, write access only to a separate branch, credentials kept in a vault and destroyed at close.
- Encryption in transit and at rest; every change reviewed by a human engineer before it applies.
6. Sub-processors
You give us general authorisation to use the sub-processors below. Each is bound by data protection terms at least as protective as this agreement, and we remain responsible for them.
- Vercel: hosting, sandboxes and storage of uploaded code (Frankfurt, EU)
- DigitalOcean: databases (EU region)
- Anthropic: AI models, under terms that do not allow training on your inputs
- GitHub: repository access through our GitHub App
- Stripe: payments and invoicing (customer billing data only)
- Google (Google Workspace): email between us and you about your job
We will tell you at least 14 days before adding or replacing a sub-processor that handles data from your app. You may object on reasonable data protection grounds; if we can’t resolve it, you may cancel the affected job and we refund the undelivered part.
7. Transfers outside the EEA
Your app’s data is processed in the EU. Where a sub-processor processes it outside the European Economic Area, we rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission’s Standard Contractual Clauses.
8. Helping you
- Data subject requests: if one of your users contacts us, we pass the request to you and help you answer it.
- Breaches: we notify you without undue delay, and in any case within 48 hours of becoming aware of a personal data breach affecting your data, with what we know and what we are doing about it, so you can meet your own 72-hour duty.
- Assessments: we give you the information you reasonably need for a data protection impact assessment or a consultation with a supervisory authority.
9. When the job ends
When a job closes we destroy sandboxes, repository clones and job credentials, and revoke our access. Backups taken for the job are deleted once the rollback period in the scope has passed, and at the latest 30 days after close, unless you ask us to return them first or the law requires us to keep them.
10. Audits
We make available the information needed to show we comply with this agreement. You may audit us, or have an independent auditor bound by confidentiality do so, once a year on 30 days’ notice, at your cost, without access to other customers’ data.
11. Liability and precedence
Liability under this agreement follows the limits in our Terms of Service, except where the law does not allow them. If this agreement and the Terms conflict on personal data, this agreement wins. Spanish law applies, as in the Terms.
12. Contact
Questions about this agreement: admin@variantwork.com.