This DPA describes the data-processing terms that will apply between Errly and Customer when the Errly service launches. It is published ahead of launch so procurement teams can review the shape and substance in advance. This document is not yet legally binding; it will be given an effective date when the service launches.
This Data Processing Agreement ("DPA") forms part of the Terms of Service between AES Tech AB, Org. nr. 559507-2157, with registered office in Stockholm, Sweden ("Errly", the "Processor") and the customer entity that has agreed to those Terms (the "Controller"). It reflects the parties' agreement on the processing of personal data in connection with the Errly service.
01Definitions
Capitalized terms not defined herein have the meaning given in the GDPR (Regulation (EU) 2016/679). "Personal Data", "Processing", "Data Subject", "Controller", and "Processor" shall be interpreted accordingly.
- "Service Data" means the events, stack traces, breadcrumbs, request/user context, and other metadata transmitted to Errly by Controller's applications via the Errly ingestion endpoint.
- "Sub-processor" means a third party engaged by Errly to Process Service Data on Errly's behalf.
- "EEA" means the European Economic Area.
02Roles & responsibilities
Controller determines the purposes and means of Processing of Service Data. Errly Processes Service Data only on documented instructions from Controller, including with regard to transfers of Personal Data to a third country, unless required to do so by Union or Member-State law to which Errly is subject.
Errly will ensure that persons authorized to Process Service Data have committed themselves to confidentiality.
03Subject-matter & duration
Errly Processes Service Data for the purpose of providing the Errly error tracking service to Controller, including ingestion, storage, deduplication, grouping, alerting, and presentation in the Errly web application. Processing continues for the term of the underlying Terms of Service plus any retention period chosen by Controller in their plan settings.
04Sub-processors
Controller authorizes Errly to engage the Sub-processors maintained on the canonical list at errly.eu/legal/subprocessors for the purposes of providing the Service. Errly will give Controller at least thirty (30) days' notice of any addition or replacement of a Sub-processor; Controller may object on reasonable grounds, in which case the parties will cooperate in good faith to resolve the objection.
05International transfers
All Processing of Service Data takes place within the European Economic Area. Service Data infrastructure is operated by Hetzner Online GmbH (Germany) and Aiven Oy (Finland), both EU-incorporated entities, in EU regions. Errly does not transfer Service Data outside the EEA, and will not engage a Service Data sub-processor outside the EEA. Should this ever change, Controller will be notified at least thirty (30) days in advance and will have the right to object.
The single sub-processor on the canonical list with a non-EEA processing flow is Stripe: billing data provided by Controller to Errly is Processed by Stripe Payments Europe Ltd. (Ireland), with some processing operations performed by Stripe, Inc. (United States) for fraud detection. That transfer is governed by:
- the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795 of 10 July 2023); Stripe, Inc. is DPF-certified; and
- the Standard Contractual Clauses for the transfer of personal data to third countries (Commission Implementing Decision (EU) 2021/914 of 4 June 2021).
Stripe never receives Service Data; only billing contact details provided by Controller (name, billing address, tax identifier, payment method) are involved.
06Security measures
Errly implements technical and organizational measures appropriate to the risk of the Processing, including encryption in transit (TLS 1.2+) and at rest, role-based access control, magic-link authentication for all human access, audit logging, and regular backup and restore testing. Detailed measures are described on the Security page.
07Personal data breach
Errly will notify Controller without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Personal Data breach affecting Controller's Service Data, with sufficient information to enable Controller to meet its own obligations under Article 33 GDPR.
08Audits
Errly will make available to Controller all information necessary to demonstrate compliance with this DPA and will permit and contribute to audits, including inspections, conducted by Controller or another auditor mandated by Controller, on reasonable advance notice and during normal business hours, subject to confidentiality undertakings.
09Termination
On termination of the underlying Terms of Service, Errly will, at the election of Controller, return or delete all Service Data within thirty (30) days, except where storage is required by Union or Member-State law.