Data Processing Addendum

For customer personal data, the customer is the controller and business, and TypeSafe is the processor and service provider. It forms part of the agreement and was last updated 24 April 2026.

Capitalized terms that the DPA does not define come from the main agreement, per the caveat.

Reasonable advance notice before a new subprocessor gets access to customer personal data. A customer may object within 15 days of that notice on reasonable privacy or security grounds, and the parties then work in good faith to address the objection.

It will notify the customer without undue delay and in any case within 72 hours after becoming aware of any accidental or unauthorized access to, or disclosure or use of, customer personal data.

No. It says TypeSafe will not sell or share customer personal data under the CCPA, will not retain or use it beyond the documented instructions, and will not combine it with third-party personal data except as permitted by law.

The DPA controls to the extent of any inconsistency or conflict with the other terms of the agreement, stated in its conflicts in interpretation section.

Schedule I sets out the subject matter, nature and purpose of the processing, the types of customer personal data, and the categories of applicable data subjects.