01 Purpose
This Data Processing Agreement ("DPA") supplements the Terms of Service between you ("Customer", acting as Controller under GDPR) and NetTechnologys s.r.o. ("Code Indexer", acting as Processor) and governs any personal data we process on your behalf. It is read alongside our Privacy Policy.
02 Architectural note
Code Indexer is self-hosted software. Your source code, indexed content, embeddings, and AI queries run inside your infrastructure and never reach our servers. The personal data we process on your behalf is therefore limited and listed below.
03 Scope of processing
Personal data we process as Processor: (a) account identifiers — name, work email, organizational role of license administrators and named developers; (b) billing identifiers — VAT ID, billing address, payment metadata (cards processed by our payment provider, never stored by us); (c) support correspondence content. Duration: for as long as the underlying subscription is active, plus retention periods required by law.
04 Sub-processors
We use a small set of vetted sub-processors listed at Sub-processors. We will give 30 days notice before adding a new sub-processor, during which you may object. Each sub-processor is bound by contract to data-protection terms no less protective than this DPA.
05 Technical & organizational measures
Encryption in transit (TLS 1.3+) and at rest. Least-privilege access controls with MFA on all production systems. Audit logs of administrative actions. Signed binary releases (Apple Developer ID on macOS, Authenticode on Windows, minisign Ed25519 on Linux). Detailed posture: Security.
06 Data subject requests
If you receive an access, rectification, erasure, or portability request that requires action on the limited data we process: email [email protected]. We will assist within 14 days, free of charge for reasonable requests.
07 Personal data breach notification
We will notify you of a confirmed personal data breach affecting your data without undue delay and in any case within 72 hours of becoming aware. The notification will describe the nature of the breach, categories and approximate number of records affected, likely consequences, and measures taken.
08 Audit rights
Once per twelve-month period, with 30 days written notice, you may audit our compliance with this DPA at your cost — either through documentation review or, where reasonably necessary, an on-site audit conducted by a mutually agreed independent auditor under confidentiality.
09 International transfers
We are established in the EU. Transfers to sub-processors outside the EEA, UK, or Switzerland are covered by Standard Contractual Clauses (Module 2 or 3, as applicable) and the UK International Data Transfer Addendum where required.
10 Return or deletion
On termination of the subscription, account and support data will be deleted within 90 days, except where retention is required by law (e.g., invoicing records — 7 years under Czech accounting law).
11 Order of precedence
In case of conflict between this DPA and the Terms of Service, the DPA prevails for matters related to processing of personal data.
12 Signing & contact
Enterprise customers requiring a counter-signed DPA: [email protected]. General questions: [email protected]. NetTechnologys s.r.o., Czech Republic.