Data Processing Agreement

1. Definitions

"Personal Data", "Processing", "Controller", "Processor", "Data Subject", "Personal Data Breach" and "Supervisory Authority" have the meanings given in the GDPR. "Customer Data" means Personal Data that you or your website visitors submit to the service, including feedback reports, screenshots, session replays, console logs and reporter contact details. "Sub-processor" means a third party engaged by Bugfyx to process Customer Data.

2. Scope and Roles

You are the Controller of Customer Data and Bugfyx is the Processor. Bugfyx acts as an independent Controller only for account, billing and usage data needed to run its business, as described in the Privacy Policy. You are responsible for having a lawful basis for collecting Customer Data through the widget and for providing any notices to your website visitors that the law requires.

3. Details of Processing

Subject matter

Providing the Bugfyx visual feedback and bug reporting service under the Agreement.

Duration

For the term of the Agreement, plus the deletion period in section 12.

Nature and purpose

Collecting, storing, displaying and delivering feedback reports; notifying your chosen channels and integrations; generating report titles; providing access through the API and MCP when you enable them; support and security.

Categories of Data Subjects

Visitors to your websites who submit feedback, and your team members and clients who use the service.

Categories of Personal Data

Name and email of reporters (if provided), feedback text and comments, screenshots and annotations, page URL, element selector, browser, operating system, screen and viewport size, page timings, console logs, session replays with form inputs masked, and IP addresses used transiently for rate limiting. Screenshots and replays may incidentally contain other personal data shown on the page.

Special categories

None intended. You should not configure the widget to collect special categories of data, and reporters can hide sensitive areas of a screenshot before sending.

4. Processing on Instructions

We process Customer Data only on your documented instructions, which are the Agreement, this DPA and your use and configuration of the service, unless EU or Member State law requires otherwise. In that case we will tell you before processing, unless the law prohibits it. We will inform you if we believe an instruction infringes the GDPR.

5. Confidentiality

We ensure that everyone authorised to process Customer Data is bound by confidentiality obligations and accesses Customer Data only as needed to provide, secure and support the service.

6. Security

We implement appropriate technical and organisational measures under Article 32 GDPR, taking into account the state of the art, costs and the risks to Data Subjects. These include encryption of data in transit (TLS), encryption of integration secrets, access-checked and time-limited links to stored files, masking of form inputs in session replays, role-based access within workspaces, authentication controls and regular backups. We may update these measures as long as the overall level of protection is not reduced.

7. Sub-processors

You give general authorisation for Bugfyx to engage Sub-processors. The current list is published in our Privacy Policy (bugfyx.com/privacy). We will notify you by email or in the service at least 14 days before adding or replacing a Sub-processor. You may object on reasonable data protection grounds within that period; if we cannot reasonably address the objection, you may terminate the affected service. We impose data protection obligations on each Sub-processor that are no less protective than this DPA and remain responsible for their performance.

8. Data Subject Requests

Taking into account the nature of the processing, we assist you by appropriate technical and organisational measures in responding to requests from Data Subjects to exercise their rights. The service lets you find, export and delete Customer Data. If we receive a request directly, we will forward it to you without undue delay and will not respond ourselves except to direct the requester to you.

9. Assistance with Compliance

We provide reasonable assistance with your obligations under Articles 32 to 36 GDPR, including data protection impact assessments and prior consultations with Supervisory Authorities, taking into account the nature of the processing and the information available to us.

10. Personal Data Breaches

We will notify you without undue delay, and in any case within 48 hours, after becoming aware of a Personal Data Breach affecting Customer Data. The notice will describe, as far as known, the nature of the breach, the categories and approximate number of Data Subjects and records concerned, its likely consequences and the measures taken or proposed. We will take reasonable steps to contain and remedy the breach.

11. International Transfers

Where Customer Data is transferred outside the European Economic Area or the UK, including to Sub-processors, we ensure that the transfer is covered by an adequacy decision (such as the EU-US Data Privacy Framework) or by appropriate safeguards such as the European Commission's Standard Contractual Clauses, together with any supplementary measures required.

12. Deletion and Return

You can export Customer Data while your account is active. When you delete a project or your account, or when the Agreement ends, we delete the related Customer Data within 30 days, and from backups within their normal rotation, unless EU or Member State law requires us to keep it.

13. Audits and Information

We make available the information reasonably necessary to demonstrate compliance with Article 28 GDPR and this DPA. We allow for and contribute to audits, including inspections, by you or an auditor you mandate, on at least 30 days' written notice, during business hours, no more than once a year unless required by a Supervisory Authority or following a Personal Data Breach, and subject to confidentiality. We may first respond with written information, documentation or third-party reports where these reasonably answer the request.

14. Liability, Term and Precedence

Each party's liability under this DPA is subject to the limitations in the Agreement, except where the law does not allow it. This DPA stays in force for as long as we process Customer Data on your behalf. If this DPA conflicts with the Agreement, this DPA prevails for the processing of Customer Data. This DPA is governed by the same law as the Agreement.