Legal

DARTASTIC DATA PROCESSING ADDENDUM

Effective: 20 May 2026

Processor: Dartastic.io ("Dartastic", "Processor"). Customer: the entity that has agreed to the Terms of Service ("Customer", "Controller").

This Data Processing Addendum ("DPA") forms part of the Terms of Service and applies where Dartastic processes Personal Data on behalf of Customer in providing the Service. If a conflict exists between this DPA and the Terms regarding personal-data processing, this DPA controls.

  1. DEFINITIONS

"Personal Data", "Processing", "Controller", "Processor", "Data Subject", and "Supervisory Authority" have the meanings in applicable data-protection law (including the GDPR/UK GDPR and, as applicable, U.S. state privacy laws). "Customer Personal Data" means Personal Data contained in Customer Telemetry or otherwise processed by Dartastic on Customer's behalf.

  1. ROLES AND SCOPE

Customer is the Controller (or a processor acting for another controller) and Dartastic is the Processor of Customer Personal Data. Dartastic processes Customer Personal Data only to provide and support the Service and on Customer's documented instructions (including as set out in the Terms and through Customer's configuration of the Service). The subject matter, duration, nature, purpose, types of Personal Data, and categories of Data Subjects are described in Annex I.

  1. DARTASTIC OBLIGATIONS

Dartastic will: (a) process Customer Personal Data only on documented instructions; (b) ensure persons authorized to process are bound by confidentiality; (c) implement appropriate technical and organizational security measures (Annex II); (d) assist Customer, taking into account the nature of processing, with data-subject requests and with security, breach-notification, and impact-assessment obligations; (e) notify Customer without undue delay after becoming aware of a Personal Data breach; and (f) at Customer's choice, delete or return Customer Personal Data at the end of the Service, subject to legal retention.

  1. CUSTOMER OBLIGATIONS

Customer is responsible for the lawfulness of Customer Personal Data and of its instructions, for having a legal basis to send the data, and for configuring the Service appropriately. Customer acknowledges that PII-scrubbing capabilities are tier- and configuration-dependent and not guaranteed (see the Privacy Policy), and that Customer remains responsible for not transmitting data it is not permitted to process.

  1. SUB-PROCESSORS

Customer provides general authorization for Dartastic to engage sub-processors to provide the Service. The current list is in SUBPROCESSORS.md. Dartastic imposes data-protection obligations on sub-processors no less protective than this DPA and remains liable for their performance. Dartastic will provide a mechanism to notify Customer of changes and a reasonable period to object on legitimate data-protection grounds.

  1. INTERNATIONAL TRANSFERS

Where Customer Personal Data is transferred from the EEA, UK, or Switzerland to a country without an adequacy decision, the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two (Controller-to-Processor), are incorporated by reference and apply to the transfer, with Customer as data exporter and Dartastic as data importer. For transfers subject to UK law, the UK International Data Transfer Addendum to the EU SCCs applies; for transfers subject to Swiss law, the SCCs apply with the adjustments required by the Swiss FADP. Details are set out in Annex III.

  1. AUDIT

Dartastic will make available information reasonably necessary to demonstrate compliance and allow for audits, subject to reasonable confidentiality, scope, frequency, and notice limits, and reliance on third-party reports where available.

  1. LIABILITY

Each party's liability under this DPA is subject to the limitation-of-liability provisions of the Terms of Service.

ANNEX I — Description of Processing

  • Subject matter: provision of the Dartastic observability Service.
  • Nature/purpose: ingest, store, transmit, and process telemetry (traces, metrics, logs, crash data) and symbol files to provide observability and crash-deobfuscation features.
  • Data types: as determined by Customer's application output and configuration; may include identifiers and contact data if Customer's application emits them.
  • Data subjects: Customer's end users and personnel.
  • Duration: the subscription term plus any export/retention window.

ANNEX II — Security Measures

  • Encryption in transit; single-tenant isolation for Hosted clusters.
  • Access controls, authentication, and least-privilege for Dartastic personnel.
  • Logging and monitoring; vendor due diligence; incident-response process (security@dartastic.io).

ANNEX III — Transfer Mechanism

  • Clauses: EU SCCs (Decision (EU) 2021/914), Module Two (Controller-to-Processor); UK IDTA Addendum for UK transfers; Swiss adjustments for Swiss transfers.
  • Data exporter: Customer. Data importer: Mindful Software, LLC d/b/a Dartastic.io.
  • Competent supervisory authority: that of the Customer's place of establishment in the EEA (or, for UK/Swiss transfers, the ICO or the Swiss FDPIC, respectively).

Other documents