This Data Processing Agreement ("DPA") forms part of the agreement between Inspect DevTools LLC ("Processor", "Inspect") and the customer accepting this DPA ("Controller") and applies to the processing of Personal Data under Regulation (EU) 2016/679 ("GDPR").
Effective Date: Mar 27, 2024
The entity identified as customer in the applicable agreement governing use of the Services.
Inspect DevTools LLC
Delaware, United States
Inspect DevTools LLC is a company established in the United States and primarily offers its Services to customers located outside the European Union.
Inspect does not maintain an establishment in the European Union and does not specifically target individuals in the European Union within the meaning of Article 3(2) GDPR. However, Inspect may occasionally provide Services to customers established in the EU, in which case Inspect acts as a data processor and processes Personal Data on behalf of such customers in accordance with this DPA, the GDPR, and applicable international data transfer safeguards.
Capitalized terms not defined in this DPA have the meanings set forth in the GDPR.
Processor processes Personal Data on behalf of Controller to provide Inspect's SaaS products and related services.
Processor does not intentionally process special categories of personal data.
Inspect is established in the United States, and Personal Data processed under this DPA is stored and processed primarily in the United States, including when Services are provided to customers established in the European Union.
Personal Data may be accessed and processed by Inspect and its authorized Sub-processors from locations within the United States and, where applicable, from other jurisdictions solely for the purpose of providing the Services.
Inspect does not offer EU-only or country-specific data residency. Controller acknowledges that use of the Services involves the transfer of Personal Data to the United States.
Processing shall continue for the duration of the applicable service agreement unless otherwise instructed by Controller.
Processor shall:
Processor maintains security measures appropriate to the risk, including:
Controller grants Processor general authorization to engage Sub-processors for service delivery.
| Sub-processor | Purpose | Processing Location |
|---|---|---|
| Vercel Inc. | Cloud infrastructure, application hosting, edge compute | United States |
| Clerk, Inc. | Authentication and identity management | United States |
| Stripe, Inc. | Billing and payments | United States |
| PostHog, Inc. | Product analytics | United States |
| Intercom, Inc. | Customer support communications | United States |
Processor shall ensure Sub-processors are bound by written obligations no less protective than this DPA.
Processor remains fully liable for the performance of its Sub-processors.
Processor shall, taking into account the nature of processing, assist Controller in fulfilling requests from Data Subjects under Chapter III GDPR.
Processor shall promptly notify Controller if it receives a Data Subject request directly.
Processor shall notify Controller without undue delay after becoming aware of a Personal Data Breach and provide information reasonably required for compliance with Articles 33 and 34 GDPR.
Processor shall make available information reasonably necessary to demonstrate compliance with this DPA and allow audits by Controller or an independent auditor, subject to reasonable notice and confidentiality obligations.
Where Controller is established in the European Union, Controller acknowledges that use of the Services involves the transfer of Personal Data to Inspect DevTools LLC in the United States, where Inspect is established and where Personal Data is primarily processed and stored.
Such transfers are governed by the Standard Contractual Clauses (EU Commission Decision 2021/914), incorporated by reference and completed as follows:
Upon termination of the Services, Processor shall, at Controller's choice, delete or return all Personal Data unless retention is required by law.
Liability under this DPA is subject to the limitations of liability in the applicable service agreement, except where prohibited by law.
In the event of conflict, this DPA shall prevail over the service agreement with respect to data protection obligations.
This DPA shall be governed by the law specified in the service agreement, unless GDPR mandates otherwise.
Data Subjects
Employees, contractors, and end users of Controller
Categories of Personal Data
Identifiers, technical data, usage data, customer-submitted content
Frequency
Continuous
Purpose
Provision and operation of the Services
Primary Storage Location
United States
Retention
For the duration of the service agreement unless otherwise instructed