Data Processing Agreement
Last updated:
When Branthiq ApS processes personal data on behalf of a client, a Data Processing Agreement is signed under GDPR article 28. This page describes the general terms - a specific agreement is tailored and signed separately at engagement start.
Parties
- Data controller: The client (the company Branthiq delivers to).
- Data processor: Branthiq ApS, CVR no. 45786943.
Subject matter and duration
The processing concerns the personal data necessary to deliver the agreed services (development, hosting, support, marketing, etc.). The agreement is in force for as long as services involving personal data are delivered.
Processor obligations
Branthiq:
- Only processes personal data on documented instructions from the controller.
- Ensures confidentiality - only employees with a need have access.
- Implements appropriate technical and organisational measures (per art. 32).
- Assists the controller in fulfilling data subject rights.
- Notifies the controller without undue delay of any personal data breach.
- Deletes or returns personal data upon termination.
- Makes all necessary information available for audits.
Sub-processors
Branthiq uses the following sub-processors. The client accepts these on engagement, and changes are notified with 30 days notice.
| Provider | Purpose | Location / transfer basis |
|---|---|---|
| Netlify, Inc. | Hosting, CDN, deploys | USA - EU-US Data Privacy Framework |
| Supabase Inc. | Database, auth, storage | EU (Frankfurt) |
| Google LLC | Analytics, Tag Manager (consent only) | USA - EU-US Data Privacy Framework |
| Google LLC | Email and documents (Google Workspace) | USA - EU-US Data Privacy Framework |
| Resend Inc. | Transactional emails from solutions we run for the client | USA - EU Standard Contractual Clauses |
| GitHub, Inc. | Source code, deploy pipeline (no client personal data) | USA - EU-US Data Privacy Framework |
Security (art. 32)
The technical and organisational measures rest on the sub-processors named in this agreement and on what we do ourselves in the solutions we build.
- Transport: the website and our solutions hosted on Netlify are served over HTTPS with at least TLS 1.2, and a request over http is redirected to https. The website also tells browsers to use only HTTPS for one year after each visit (HSTS, set in our own configuration at Netlify). (Netlify: Security)
- Encryption at Supabase: data at Supabase is encrypted at rest with AES-256 and in transit with TLS. (Supabase: Security)
- Passwords: in solutions that use Supabase Auth, passwords are stored only as a hash (bcrypt), never in plain text. (Supabase: Password security)
- Backups: the databases at Supabase are backed up daily and can be restored up to 14 days back. (Supabase: Backups)
- Separation of data: in the solutions we build on Supabase, we use Row Level Security, so a user can only see the rows the rules give access to. In our own database, it is enabled on the table with IP addresses from the contact form. (Supabase: Row Level Security)
- Code: the code for the website and our solutions is kept in git on GitHub, where every change records who is listed as its author and when, and the website is deployed from there.
Personal data breach
In the event of a data breach, we notify the controller without undue delay and within 24 hours of detection at the latest. The notification contains all relevant information per GDPR art. 33.
Audit
The controller may, once a year, request an audit. The audit may be conducted by the controller or an independent third party with prior agreement. Branthiq bears its own costs; the auditor bears their own.
Deletion and return
Upon termination, Branthiq deletes or returns all personal data within 30 days, unless legislation requires continued retention (e.g. accounting for 5 years).
Governing law
The agreement is governed by Danish law. Disputes are decided by the District Court of Frederiksberg, Denmark.
Signing a specific DPA
Email admin@branthiq.com to receive our specific DPA template for signature.