Data processing agreement
This is a translation for convenience. The binding version of this agreement is the Spanish one: Contrato de encargo del tratamiento. In case of discrepancy, the Spanish text prevails.
<h2>When it applies</h2>
<p>
Only when MicroLab <strong>stores data on the Customer's behalf</strong>: the Team plan
with the <strong>hosted catalogue option</strong>.
</p>
<p><strong>It does not apply</strong> —and nothing needs signing— if:</p>
<ul>
<li>You use the Free or Pro plan. Everything runs on the user's machine.</li>
<li>
You use the Team plan with the <strong>catalogue in your own git repository</strong>:
scenarios live in the Customer's infrastructure and MicroLab never touches them.
</li>
</ul>
<p>
That second option exists, among other reasons, so that a customer who does not want to
sign a processing agreement <strong>does not have to</strong> and still gets the whole
product.
</p>
<h2>1. Parties</h2>
<ul>
<li><strong>Controller:</strong> the Customer (the organisation subscribing to the plan).</li>
<li><strong>Processor:</strong> Juan García Valero (“MicroLab”), [email protected].</li>
</ul>
<h2>2. Subject matter, duration, nature and purpose</h2>
<div class="legal-table-wrap">
<table>
<tbody>
<tr><th>Subject matter</th><td>Hosting the Customer's catalogue of development scenarios</td></tr>
<tr><th>Duration</th><td>That of the subscription contract</td></tr>
<tr><th>Nature</th><td>Storage and retrieval. <strong>No access to the content</strong> (see §4)</td></tr>
<tr><th>Purpose</th><td>Letting the Customer's team share local development environment configuration</td></tr>
</tbody>
</table>
</div>
<h2>3. Categories of data and data subjects</h2>
<p>
<strong>Data subjects:</strong> the Customer's employees or collaborators with access to
MicroLab.
</p>
<div class="legal-table-wrap">
<table>
<thead><tr><th>Category</th><th>Status</th></tr></thead>
<tbody>
<tr><td>Scenario content (hosts, service names, repository paths)</td><td><strong>End-to-end encrypted.</strong> MicroLab cannot read it</td></tr>
<tr><td>Scenario name and description</td><td>In the clear</td></tr>
<tr><td>Customer's organisation code</td><td>In the clear</td></tr>
<tr><td>Identifier of whoever published it</td><td>In the clear</td></tr>
<tr><td>Publication date and size</td><td>In the clear</td></tr>
</tbody>
</table>
</div>
<p>
<strong>No special categories</strong> of data (art. 9) are processed. The Customer
undertakes not to introduce any: a catalogue of development scenarios is no place for them.
</p>
<h2>4. End-to-end encryption: what it means here</h2>
<p>
The content of each scenario is encrypted <strong>on the Customer's machine</strong>
(AES-256-GCM) with a key the Customer generates and keeps. MicroLab stores the result and
<strong>does not hold the key</strong>. The consequences, stated for clarity and not as a
disclaimer:
</p>
<ol>
<li>
MicroLab <strong>cannot</strong> access the content, neither on its own account nor at
a third party's request. Faced with a legal request it can only hand over ciphertext.
</li>
<li>
MicroLab <strong>cannot</strong> alter a scenario undetected: the encryption is
authenticated and tampering is discovered on opening.
</li>
<li>
<strong>If the Customer loses the key, the content is unrecoverable.</strong> MicroLab
cannot help. That impossibility <em>is</em> the safeguard, and the Customer expressly
accepts it.
</li>
</ol>
<h2>5. Processor's obligations (art. 28(3))</h2>
<ul>
<li><strong>a)</strong> Process the data only on documented instructions from the Customer, including as regards international transfers. This agreement and the product's configuration constitute those instructions.</li>
<li><strong>b)</strong> Ensure the confidentiality of anyone accessing the data.</li>
<li><strong>c)</strong> Apply the measures of art. 32 (see §7).</li>
<li><strong>d)</strong> Not engage sub-processors without authorisation (see §6).</li>
<li><strong>e)</strong> Assist the Customer in responding to data subjects' rights. The product includes deletion on request with no manual intervention.</li>
<li><strong>f)</strong> Assist in complying with arts. 32 to 36.</li>
<li><strong>g)</strong> At the Customer's choice, <strong>delete or return</strong> all data at the end, and delete copies unless legally required to keep them.</li>
<li><strong>h)</strong> Make available to the Customer the information needed to demonstrate compliance and allow audits.</li>
</ul>
<p>
<strong>MicroLab does not use this data for any purpose of its own</strong>: it does not
analyse it, train models on it or derive statistics from it. Given §4, as far as the
content is concerned it could not anyway.
</p>
<h2>6. Sub-processors</h2>
<p>
The Customer <strong>authorises</strong> the
<a href="/en/subprocessors">listed sub-processors</a>. MicroLab will give
<strong>30 days'</strong> notice of any addition or change, and the Customer may object
and terminate without penalty if the objection is reasonable and cannot be resolved.
</p>
<p>
Current sub-processor for this processing: <strong>Cloudflare, Inc.</strong> (storage
under EU jurisdiction and database in Western Europe).
</p>
<h2>7. Security measures (art. 32)</h2>
<div class="legal-table-wrap">
<table>
<thead><tr><th>Measure</th><th>How</th></tr></thead>
<tbody>
<tr><td>Encryption at rest</td><td>End-to-end, Customer's key (AES-256-GCM)</td></tr>
<tr><td>Encryption in transit</td><td>TLS 1.3</td></tr>
<tr><td>Authenticity</td><td>Authenticated encryption: tampering is detected on decryption</td></tr>
<tr><td>Access control</td><td>Per organisation, derived from a token <strong>signed</strong> by the identity provider. Never from a request parameter</td></tr>
<tr><td>Isolation</td><td>Each organisation in its own storage prefix</td></tr>
<tr><td>No intermediate caching</td><td>All responses with <code>no-store</code> and <code>Vary: Authorization</code></td></tr>
<tr><td>Minimisation</td><td>Only what is needed to list and retrieve is stored</td></tr>
<tr><td>Resilience</td><td>Cloudflare's distributed infrastructure</td></tr>
</tbody>
</table>
</div>
<h2>8. Location and transfers</h2>
<p>
Data is stored in the <strong>European Union</strong>. Cloudflare, Inc. is a US company:
access by its staff may constitute an international transfer, covered by
<strong>Standard Contractual Clauses</strong> and the <strong>EU-US Data Privacy
Framework</strong>.
</p>
<h2>9. Personal data breaches</h2>
<p>
MicroLab will notify the Customer <strong>without undue delay and within 48 hours at
the latest</strong> of becoming aware of a breach affecting their data, with the
information of art. 33(3) available at that time. Those 48 hours leave the Customer room
within the 72 it has towards the authority.
</p>
<h2>10. Audit</h2>
<p>
The Customer may request, once a year and with 30 days' notice, the information needed to
verify compliance. It will be met with documentation and reports; an on-site inspection
will require prior agreement on scope and cost.
</p>
<h2>11. End of the contract</h2>
<p>
At the Customer's choice, communicated within the following 30 days:
<strong>return</strong> of the data (encrypted, as it is: only the Customer can decrypt
it) or <strong>deletion</strong>. Absent instructions, it is deleted after 60 days.
</p>
<h2>12. Liability and governing law</h2>
<p>
Governed by what is agreed in the <a href="/en/terms">Terms of use</a>. Spanish law and
the GDPR; jurisdiction of the courts of the Processor's domicile, save mandatory rules to
the contrary.
</p>
<p>
<strong>Acceptance.</strong> By subscribing to the Team plan with hosted catalogue, the
Customer accepts this agreement. If you need a signature on your own template, write to
[email protected].
</p>