Data processing agreement

1. Parties and scope

This agreement is between the organisation that accepts it (the Customer, controller) and WebbingApps OÜ. It applies to personal data MeteorGPL processes on the Customer's behalf while providing the Composer repository and portal under the terms, and forms part of them.

2. Subject matter, nature, purpose and duration

• Subject matter and purpose: providing accounts, organisation membership, Composer tokens and package downloads to the Customer's team.
• Nature: storage, retrieval, use for authentication, billing and abuse prevention, and deletion.
• Duration: as long as the Customer's organisation exists, plus the retention periods in section 9.

3. Personal data and data subjects

• Data subjects: the Customer's members, invitees and billing contacts.
• Data: name, e-mail address, optional profile fields, sign-in records (IP address, browser), Composer token metadata, download records (package, version, time, IP address), organisation audit log.
• No special categories of personal data are processed.

4. Instructions and confidentiality

MeteorGPL processes the personal data only on the Customer's documented instructions — this agreement, the terms and the Customer's use of the service — unless the law requires otherwise, in which case it tells the Customer first where allowed. Everyone with access to the data is bound to confidentiality.

5. Security

MeteorGPL keeps appropriate technical and organisational measures: encryption in transit (TLS), hashed passwords and tokens, encrypted two-factor secrets, optional passkeys and two-factor authentication, least-privilege staff access with an audit log, regular backups, and IP addresses removed from logs after 90 days.

6. Sub-processors

The Customer authorises these sub-processors; MeteorGPL announces changes 30 days ahead on this page, and the Customer may object by ending the subscription:

• Stripe Payments Europe, Ltd. (Ireland) — payments and invoices.
• The hosting provider of the application and Cloudflare, Inc. (file delivery, bot protection) — infrastructure.
• The transactional e-mail provider (Postmark / Amazon SES) — account e-mails.

Each is bound by data protection obligations equivalent to these.

7. Assistance

MeteorGPL helps the Customer answer data subjects' requests (access, correction, deletion, portability) — members can export and delete their own data in their settings — and with impact assessments where relevant.

8. Personal data breaches

MeteorGPL notifies the Customer without undue delay and within 48 hours of becoming aware of a breach affecting the Customer's data, with what is known and the measures taken.

9. Deletion and return

When the organisation is deleted, its membership data, tokens and audit log are deleted at once; download records lose their link to people; backups roll over within 30 days. Invoices are kept by Stripe as tax law requires.

10. Audits and transfers

MeteorGPL makes available the information needed to demonstrate compliance and answers reasonable written questions; on-site audits are possible once a year with 30 days' notice, at the Customer's cost. Transfers outside the EEA rely on adequacy decisions or the European Commission's standard contractual clauses.

11. Liability and precedence

Liability follows the terms. If this agreement and the terms conflict on data protection, this agreement prevails.