Data Processing Agreement, Ithura template
A fill-in Data Processing Agreement (DPA) between an Ithura customer (as controller) and an Ithura instance operator (as processor).
Not legal advice. These clauses describe what Ithura's architecture supports and reflect common EU processor-side commitments. Have your counsel review before signing.
Which scenario applies to you
| Scenario | You are the... | Counterparty is the... |
|---|---|---|
| You host Ithura for your end-users | processor | customer (controller) |
| A hosting partner runs Ithura for your team | controller | hosting partner (processor) |
| Anorph runs Ithura Cloud for you | controller | Anorph (processor) |
Placeholders used below
Fill these in throughout the document. They render as code chips wherever they appear so nothing is missed on a review pass.
{{controller}}: the customer (data controller){{processor}}: the Ithura instance operator (Anorph, hosting partner, or your internal IT function){{effective_date}}: the date this DPA takes effect{{governing_law}}: chosen governing law jurisdiction{{jurisdiction}}: chosen forum for disputes
1. Definitions
Terms not defined here have the meaning given in Regulation (EU) 2016/679 ("GDPR").
| Term | Meaning |
|---|---|
| Personal Data | Any information relating to an identified or identifiable natural person processed on behalf of the Controller. |
| Processing | Any operation performed on Personal Data as defined in Article 4(2) GDPR. |
| Sub-processor | Any third party engaged by the Processor to process Personal Data on behalf of the Controller. |
| Instance | The Ithura deployment operated by the Processor for the Controller's benefit. |
2. Subject matter and duration
The Processor processes Personal Data on behalf of the Controller in connection with the Instance for the duration of the underlying service agreement.
3. Nature and purpose of processing
Storage, retrieval, transmission, consultation, and organisation of project-management data for the Controller and its authorised users:
- Issues, projects, sprints, goals
- Wiki pages, boards, documents
- Audio and video huddle metadata
- Comments and notifications
4. Types of Personal Data
| Category | Fields |
|---|---|
| User identity | Name, email address, avatar image |
| Authentication | Password hash (bcrypt cost 12), TOTP secret (AES-256-GCM at rest), OAuth linkage identifiers |
| Session data | IP address, User-Agent string, session tokens |
| Content authored by users | Issue titles and descriptions, comments, wiki page content, board content, uploaded attachments |
| Membership graph | Which users belong to which workspaces, projects, and groups; assigned roles |
| Audit metadata | Actor, action, target, IP, User-Agent, timestamp, free-form metadata JSON |
5. Categories of data subjects
- Employees, contractors, and contingent workers granted Instance access by the Controller.
- Any additional users granted access.
- Users who submit requests through Asks intake (Slack, email, or the public web form) as non-account submitters, where enabled.
6. Obligations of the Processor
The Processor undertakes to:
- 6.1 Process Personal Data only on documented instructions from the Controller, including transfers to a third country.
- 6.2 Ensure that persons authorised to process Personal Data have committed themselves to confidentiality.
- 6.3 Take all measures required pursuant to Article 32 GDPR (see the GDPR page).
- 6.4 Respect the conditions in Article 28(2) and (4) GDPR for engaging another Sub-processor.
- 6.5 Assist the Controller in fulfilling its obligations to respond to requests from data subjects under Chapter III GDPR.
- 6.6 Assist the Controller in ensuring compliance with Articles 32 through 36 GDPR.
- 6.7 At the choice of the Controller, delete or return all Personal Data at the end of the provision of services and delete existing copies, unless applicable law requires storage.
- 6.8 Make available to the Controller all information necessary to demonstrate compliance with Article 28 GDPR and allow for and contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller.
7. Sub-processors
The Processor uses the Sub-processors listed at the GDPR sub-processor list at the effective date.
Change notice. The Processor will provide the Controller with prior written notice of any intended addition or replacement of a Sub-processor at least 30 days in advance, giving the Controller the opportunity to object on reasonable grounds. If the Controller objects and the parties cannot agree on a resolution within a reasonable period, the Controller may terminate the underlying service agreement without penalty for the unused portion of any prepaid term.
8. International transfers
The Processor will not transfer Personal Data to a country outside the European Economic Area unless an adequate transfer mechanism under Chapter V GDPR is in place.
As of
{{effective_date}}, all Sub-processors are located in the European Union and no transfer mechanism outside the EU is required.
9. Security of processing
The Processor implements the technical and organisational measures described in the GDPR page and the NIS2 page.
Notable measures
- TLS 1.2+ for data in transit
- Full-disk encryption on all persistent volumes
- AES-256-GCM column-level encryption of secret fields (API tokens, webhook secrets, SMTP credentials, 2FA seeds)
- Role-based access control with per-workspace admin, member, and guest roles; per-project role override; custom roles
- Multi-factor authentication supported and enforceable at workspace level
- Audit logging of workspace-scoped admin actions
- Rate-limiting on authentication endpoints
- No outbound traffic to Processor-controlled analytics or telemetry endpoints
10. Personal-data breach notification
The Processor will notify the Controller without undue delay and in any event within 72 hours of becoming aware of a Personal-Data breach affecting the Controller's data, and will provide the information required by Article 33(3) GDPR as soon as it is available.
11. Data-subject requests
The Processor will notify the Controller of any request received directly from a data subject and will not respond to the request itself except on documented instructions from the Controller.
Where the request can be actioned via a standard Instance function (profile export, account deletion), the Processor will inform the Controller and await instruction before acting.
12. Records of processing
The Processor maintains a record of processing activities in accordance with Article 30(2) GDPR, available to the Controller on request.
13. Audit
Once per calendar year, the Controller (or an independent auditor mandated by the Controller and bound by appropriate confidentiality obligations) may audit the Processor's compliance with this DPA.
The Processor will make available all information reasonably required for the audit and will cooperate in good faith. Audit costs are borne by the Controller.
14. Return or deletion at end of service
On termination of the underlying service agreement, the Processor will, at the Controller's choice:
- A. Provide the Controller with a full export of the Personal Data in a structured, commonly used, machine-readable format, and thereafter delete all copies.
- B. Delete all Personal Data immediately.
Backups. Backup copies are purged within 90 days.
15. Liability
The parties' liability under this DPA is subject to the limitations of liability set out in the underlying service agreement.
16. Governing law and jurisdiction
This DPA is governed by the laws of {{governing_law}}. The parties
submit to the exclusive jurisdiction of the courts of {{jurisdiction}}.
Signatures
Controller ({{controller}}) | Processor ({{processor}}) | |
|---|---|---|
| Signed by | ||
| Name and title | ||
| Date | {{effective_date}} | {{effective_date}} |
End of Data Processing Agreement template. For the underlying architecture facts this DPA relies on, see data residency, GDPR, and NIS2.