Deployment Playbook — Data Processing Agreement

Version: 29 October 2026 — effective 29 October 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service between the Customer ("Controller") and Generation Y B.V., KvK 83458034, Planciusplein 13A, 4812 SE Breda, the Netherlands ("Processor"), and implements Article 28 GDPR.

1. Subject, nature and purpose

1.1 Processor processes personal data on behalf of Controller solely to provide Deployment Playbook (hosting workspaces, playbooks, deployments, approvals, audit logs, API access) and related support. 1.2 Duration: the term of the Terms of Service plus the deletion period in clause 10.

2. Categories of data and data subjects

• Data subjects: Controller's users (employees, contractors) and persons mentioned in workspace content.
• Data: names, email addresses, roles, authentication data (bcrypt password hashes, hashed API and session tokens, social sign-in and SSO identifiers and attributes such as provider, subject ID, email and display name), workspace content, approval and audit log entries (actor, action, timestamp; audit log entries do not contain IP addresses), technical/server logs (which may contain IP addresses).
• No special categories of data are intended; Controller shall not enter them.

3. Instructions

Processor processes personal data only on documented instructions of Controller (these Terms, this DPA and use of the Service settings), including regarding transfers, unless required by EU or Member State law; in that case Processor informs Controller beforehand unless legally prohibited. Processor informs Controller if an instruction infringes the GDPR.

4. Confidentiality

Persons authorised by Processor to process the data are bound by confidentiality.

5. Security (Art. 32 GDPR)

Processor implements at least the following measures:

• TLS (HTTPS) encryption for all data in transit;
• Production database (Amazon Aurora PostgreSQL, eu-central-1) encrypted at rest (storage encryption enabled, verified 2026-10-27);
• Passwords stored only as bcrypt hashes; minimum password length of 12 characters;
• API tokens and session tokens stored only as SHA-256 hashes; API tokens are shown once and can be revoked;
• Social sign-in and SSO with state, PKCE and signature verification; company SSO limited to DNS-verified email domains, with optional enforcement;
• third-party secrets (SSO client secrets, outgoing webhook signing secrets and incoming CI/CD provider webhook secrets) are additionally encrypted with application-level AES-256-GCM encryption, with the key held outside the database and supporting key rotation; SSO client secrets are never shown again after saving and webhook secrets are shown only to workspace Admins;
• Role-based access control within workspaces, with isolation between workspaces;
• Four-eyes (dual) approval workflows for deployments, with audit logging;
• Outgoing/incoming webhooks signed with HMAC; payment webhooks verified with Stripe signatures;
• Secrets kept in hosting provider environment configuration, not in source code;
• Administrative access to infrastructure limited to Processor's authorised personnel, via named IAM users, with multi-factor authentication on all administrative accounts;
• Automated Amazon Aurora backups (point-in-time recovery), which expire automatically within 35 days;
• Server/security logs kept at most 90 days. Processor may update measures provided the overall level of security is not reduced.

6. Subprocessors

6.1 Controller grants general authorisation to engage subprocessors. Current subprocessors:

Only when a user chooses social sign-in, Google, GitHub or Microsoft receive the sign-in request and return the user's identity; they act as independent controllers for their own login services. A company identity provider used for SSO is engaged by Controller. No email delivery, error monitoring or analytics provider is used.

6.2 Processor informs Controller at least 30 days in advance of new or replaced subprocessors; Controller may object on reasonable grounds, and if unresolved may terminate the affected Service. 6.3 Processor imposes data protection obligations on subprocessors equivalent to this DPA and remains liable for them.

7. International transfers

Transfers outside the EEA take place only with an adequate safeguard (adequacy decision incl. EU–US Data Privacy Framework, or Standard Contractual Clauses).

8. Assistance

Processor assists Controller, taking into account the nature of the processing, with responding to data subject requests (Art. 12–23), and with obligations under Art. 32–36 (security, breach notification, DPIA, prior consultation). Processor forwards data subject requests it receives directly to Controller. Assistance beyond normal Service functionality may be charged at reasonable rates.

9. Personal data breaches

Processor notifies Controller without undue delay and in any case within 48 hours after becoming aware of a personal data breach affecting Controller's data, with the information available (nature, categories and approximate numbers, likely consequences, measures taken or proposed), supplementing it as it becomes available.

10. Return and deletion

At the end of the Service, Controller may export its data within 30 days (JSON or CSV, on request to info@genydev.nl until an in-app export exists). Processor then deletes the personal data, including copies, within a further 30 days, unless EU or Member State law requires storage; backups expire automatically within 35 days.

11. Audits

Processor makes available all information necessary to demonstrate compliance and allows audits by Controller or an independent auditor bound by confidentiality, at most once per year (unless after a breach), with 30 days' notice, at Controller's cost. Processor may first offer documentation or third-party certifications (e.g. of its subprocessors).

12. Liability and precedence

The liability limitation of the Terms of Service applies to this DPA, insofar as permitted by law. In case of conflict regarding personal data, this DPA prevails. Dutch law applies; the District Court of Zeeland-West-Brabant (location Breda) is competent.