Data processing addendum

This data processing addendum (the “Addendum”) forms part of the terms of use between Continuumship (“we”, the “Processor”) and the Customer (“you”, the “Controller”). It applies whenever we process personal data in Customer Content on your behalf (“Customer Personal Data”), and it fulfils Article 28 of the GDPR and, for processing subject to the KVKK, Article 12 of the KVKK. On data protection, this Addendum prevails over the rest of the Terms.

Terms defined in the GDPR — such as controller, processor, personal data breach and data subject — have the same meaning here. Under the KVKK, the Controller is the veri sorumlusu and the Processor the veri işleyen.

We process Customer Personal Data only on your documented instructions — the Terms, this Addendum, and your use and configuration of the Service — including on transfers, unless the law requires otherwise, in which case we tell you first where the law allows. We tell you at once if we believe an instruction breaches data protection law.

Only people who need access to provide the Service can reach Customer Personal Data, under a duty of confidentiality, with access granted per person, recorded, and removed when no longer needed.

We implement the following technical and organisational measures, under Article 32 of the GDPR and Article 12 of the KVKK, and keep them up to date with the state of the art:

• Isolation — every workspace is separated by row-level security in the database, and the isolation is proved by tests on every change.
• Encryption — TLS for all traffic; data at rest encrypted by our hosting providers; secrets such as two-factor authentication keys encrypted in the application.
• Network — the database has no public address and is reached only over a private network with encrypted connections; remote administration goes through an identity-aware proxy, with no shared keys.
• Access control — least-privilege database roles; personal, recorded administrative access; single sign-on, SCIM, passkeys and two-factor authentication for Users.
• Credentials — API tokens stored only as hashes and scoped to one workspace; short-lived run credentials; credentials never written to logs, audit events or exports.
• Accountability — an append-only, hash-chained audit log; every table and column classified, and the classification checked against the database schema on every change.
• Files — private object storage reached only through links that expire; uploaded builds scanned before they are unpacked and served from a separate origin.
• Resilience — regular backups and a tested restore; monitoring of availability and errors.
• Development — code review, automated tests and static analysis before every release; dependencies kept up to date.
• Incidents — a documented response procedure, and the notification commitment below.

You give us general authorisation to engage sub-processors. The current list is below and on the sub-processors page:

We tell the owners of paid workspaces at least 30 days before a new sub-processor starts processing Customer Personal Data. You may object on reasonable data protection grounds within that time; we will then try to find a solution, and if none is found you may end the affected part of the Service and receive a refund of fees prepaid for it. We bind every sub-processor to obligations no less protective than this Addendum, and remain responsible for its performance.

Taking into account the nature of the processing, we help you to answer requests from data subjects — most of which the Service lets your administrators handle directly — and to meet your obligations on security, breach notification, data protection impact assessments and prior consultation. We forward to you any request we receive directly about Customer Personal Data, without answering it ourselves unless you ask us to.

We notify you of a personal data breach affecting Customer Personal Data without undue delay, and in any case within 48 hours of becoming aware of it, so that you can meet the 72-hour deadlines of Article 33 of the GDPR and of the KVKK Board’s decision on breach notification. The notice describes, as far as known, what happened, the categories and approximate number of data subjects and records concerned, the likely consequences, and what we have done and propose to do. We add information as it becomes available.

We store Customer Personal Data in the European Union. Where a sub-processor processes it in a country without an adequacy decision, the transfer is covered by the European Commission’s Standard Contractual Clauses (Module Three, processor to processor) or, for a certified provider in the United States, by the EU–US Data Privacy Framework.

Where you transfer Customer Personal Data to us from outside the EEA, the Standard Contractual Clauses (Module Two, controller to processor) are incorporated by reference, with you as data exporter and us as data importer, the optional clauses excluded, and the supervisory authority and courts of your establishment applying. For transfers from Türkiye, the parties use the standard contract published by the Personal Data Protection Board for controller-to-processor transfers, and the party the regulation designates notifies the Board within the period the law sets.

We make available the information needed to show compliance with this Addendum, including the security review packet. If that information is not enough, or a supervisory authority requires it, you may audit our compliance once a year, with at least 30 days’ notice, during business hours, through an auditor bound by confidentiality, and at your cost unless the audit reveals a material breach on our side.

During the term your administrators can export Customer Content at any time. When the Terms end, you have 30 days to export it; we then delete Customer Personal Data within 30 days, unless the law requires us to keep it, in which case we keep it confidential and process it only for that purpose. Deleted data leaves our backups as they expire on their regular cycle. On request, we confirm the deletion in writing.

Each party’s liability under this Addendum is subject to the limitations in the Terms, except where data protection law does not allow them.

Write to hello@continuumship.com for anything about this Addendum. If your procurement process needs a countersigned copy, write to hello@continuumship.com.