This agreement is part of the terms of service. It applies when Journey Lanes, run by the operator of this installation (the processor), processes personal data on behalf of an organization that uses it (the controller), as Article 28 of the GDPR requires.
1. Subject, purpose and duration
The processor processes personal data only to provide Journey Lanes as described in the terms and the product pages, on the controller’s documented instructions, which are given by using and configuring the service. It lasts as long as the controller uses Journey Lanes.
2. Data and people concerned
- Kinds of data: whatever the controller’s systems return during runs, audits and load tests (which may include names, email addresses, identifiers and other data of the controller’s users), credentials of test accounts, repository contents read during scans, and data the controller enters in flows and mock data.
- People: the controller’s users, employees and test accounts whose data appears in those systems.
- The controller doesn’t point Journey Lanes at special categories of data (health, beliefs and the like) unless that is lawful and necessary for its tests.
3. Processor’s obligations
- Processes the data only on the controller’s instructions, and tells the controller if an instruction seems to break data protection law.
- Ensures that everyone with access is bound to confidentiality. Platform administrators get no access to project data.
- Takes appropriate technical and organizational measures (Article 32), including: encryption of credentials and secrets at rest (AES-GCM); encryption in transit (HTTPS); masking of replies from live environments in run history; deletion of live runs after the environment’s retention; access control per organization and project with roles; network rules that keep the database private; the measures on the security page.
- Helps the controller answer requests from people exercising their rights, and with security, breach notification and impact assessments, as far as reasonable.
- Makes available the information needed to show compliance with this agreement, and allows audits by the controller or an auditor it appoints, announced reasonably in advance and at the controller’s cost.
4. Sub-processors
The controller agrees to the sub-processors below. The processor informs owners at least 30 days before adding or replacing one; the controller may object, and may end the service if the objection isn’t resolved. Each sub-processor is bound by the same data protection obligations.
| Sub-processor | What for |
|---|---|
| The hosting provider of this installation | Servers and database |
| The email provider of this installation | Emails such as alerts, which can contain flow and step names |
Services the controller connects or points Journey Lanes at, such as its own environments, GitHub, Slack, Microsoft Teams, webhooks and test inboxes, are not sub-processors: data goes there on the controller’s instruction and under the controller’s own agreements with them.
5. Personal data breaches
The processor informs the controller without undue delay, and within 48 hours of becoming aware of a breach affecting the controller’s data, with what is known: what happened, which data and people are concerned, the likely consequences and the measures taken. It keeps the controller informed as more becomes known.
6. Transfers
Data is stored in the European Economic Area. Transfers outside it happen only through the sub-processors listed above, with the safeguards mentioned there.
7. End
When a project or organization is deleted, its flows, runs, audits, environments and mock data are deleted with it. The processor doesn’t delete data on its own when a subscription ends: the controller deletes it in the app, or asks at info@developerlab.nl, and the processor then deletes it within 30 days, except where the law requires keeping it, such as invoices. Backups that contain it expire within 30 days after that.
8. Contact
Questions and notices about this agreement go to info@developerlab.nl.