Data Processing Agreement (DPA)

pursuant to Art. 28 GDPR

Last updated: 2026-10-01

Parties and applicability

This agreement is concluded between the customer of myvibecode.app (the "Controller" or "Customer") and OrgOps GmbH, Kleestraße 21–23, 90461 Nürnberg, Germany, managing director Rebar Hassan, Amtsgericht Nürnberg HRB 46511 (the "Processor" or "OrgOps").

This DPA forms part of the Terms of Service. It applies as soon as the Customer processes personal data with myvibecode.app and is agreed by accepting the Terms (creating an account or using the service); no separate signature is required. Customers who need a signed copy (e.g. universities, public bodies, companies) can request one at mail@orgops.io.

1. Subject matter and duration

(1) The subject matter is the provision of the myvibecode.app platform by OrgOps: storing the source code submitted by the Customer, building and operating (hosting) the Customer's web applications ("Apps"), providing and operating one PostgreSQL database per App, backups, export functions and — where the Customer uses them — technical assistance through the "Platform Brain" and support requests.

(2) The duration of processing corresponds to the term of the service relationship. The provisions on deletion and return (section 11) survive termination.

2. Nature, purpose, types of data and categories of data subjects

(1) Nature and purpose: storing, hosting, backing up, restoring, transmitting and deleting data, solely to operate the Customer's Apps. Which personal data an App processes, and for what purpose, is determined by the Customer alone.

(2) Types of data: any data the Customer or the users of its Apps put into the Apps, their databases, their configuration (secrets) or their source code — typically master data (e.g. names), contact data (e.g. email addresses), content and usage data of the App, and technical connection data (e.g. IP addresses) that necessarily arises when the Apps are accessed.

(3) Categories of data subjects: users of the Customer's Apps and any other persons whose data the Customer processes in its Apps (e.g. employees, students, customers or prospects of the Customer).

(4) The platform is not specifically designed for special categories of personal data (Art. 9, 10 GDPR). If the Customer intends to process such data, it assesses beforehand, on its own responsibility, whether the measures described in the TOMs are adequate.

(5) Out of scope of this DPA is the processing of the Customer's account data (e.g. the email address of the account holder and of invited team members) for providing and billing the service; OrgOps is the controller for that processing (see the Privacy Policy). Payments are handled by Polar as Merchant of Record under its own responsibility.

3. Instructions

(1) OrgOps processes personal data only on documented instructions from the Customer, including with regard to transfers to third countries, unless required to do so by Union or Member State law; in such a case OrgOps informs the Customer of that legal requirement before processing, unless that law prohibits such information.

(2) The instructions are given conclusively by the Terms, this DPA and the actions the Customer triggers via the dashboard, the command line (mvc) or the platform interfaces (e.g. deploy, export, deletion). Further instructions are given in text form to mail@orgops.io.

(3) If OrgOps considers that an instruction infringes data protection law, it informs the Customer without undue delay (Art. 28(3), second subparagraph GDPR).

4. Confidentiality

OrgOps ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. Access to customer data is limited to persons who need it for operation, troubleshooting or support.

5. Technical and organisational measures

(1) OrgOps takes the measures required by Art. 32 GDPR. The measures in place when this agreement is concluded are described in the annex "Technical and Organisational Measures (TOMs)", which forms part of this agreement.

(2) The measures are subject to technical progress. OrgOps may replace them with equivalent or better measures, provided the level of protection is not reduced. Material changes are documented on the TOMs page.

6. Sub-processors

(1) The Customer gives OrgOps general authorisation to engage other processors. The sub-processors engaged when this agreement is concluded are listed in the annex "Sub-processors" and are deemed approved.

(2) OrgOps informs the Customer of any intended addition or replacement of a sub-processor that processes data of hosted Apps at least 30 days in advance, by email to the account holder's address and by updating the annex. Within that period the Customer may object in text form on reasonable data protection grounds. If the parties cannot find a solution, the Customer may terminate the affected services with effect from the date the change takes effect.

(3) OrgOps imposes on each sub-processor, by contract, the same data protection obligations as set out in this agreement (Art. 28(4) GDPR). OrgOps remains liable to the Customer for the sub-processors' compliance with those obligations.

(4) Services OrgOps uses as purely ancillary services without access to App data (e.g. telecommunications and transit networks) are not sub-processing.

7. Location of processing and third-country transfers

(1) Source code, databases, backups and the runtime environment of the Apps are processed in data centres within the European Union (currently Germany and Finland, see Sub-processors).

(2) Transfers to third countries take place only where the conditions of Art. 44 et seq. GDPR are met (e.g. an adequacy decision including the EU-US Data Privacy Framework, or Standard Contractual Clauses).

(3) Apps can open outbound connections to the internet. If the Customer integrates third-party services into its App (e.g. external APIs, email or payment services), the resulting data transfers are initiated by and the responsibility of the Customer; such third parties are not sub-processors of OrgOps.

8. Assistance with data subject rights

(1) OrgOps assists the Customer by appropriate technical and organisational measures in fulfilling data subject rights (Chapter III GDPR). As a rule the Customer can handle access, rectification, erasure and portability itself through its App and the database export that is available at any time (dashboard or mvc backup).

(2) If a data subject contacts OrgOps directly, OrgOps forwards the request to the Customer without undue delay and does not answer it itself unless instructed otherwise.

9. Other assistance

Taking into account the nature of processing and the information available to it, OrgOps assists the Customer in ensuring compliance with Art. 32 to 36 GDPR (security of processing, breach notification, data protection impact assessment, prior consultation).

10. Personal data breaches

OrgOps notifies the Customer of a personal data breach affecting data of its Apps without undue delay after becoming aware of it, by email to the account holder's address. The notification contains, as far as known, the information listed in Art. 33(3) GDPR; missing information is provided as soon as it is available. OrgOps takes the necessary measures to contain and remedy the breach without undue delay.

11. Deletion and return

(1) The Customer can export its database in full and download the source code of its Apps at any time. Return of the data is therefore possible at any time, including before the end of the agreement.

(2) When the Customer deletes an App, OrgOps removes its source code, database, container images and running containers from the live systems without undue delay. Copies in backups are erased automatically once the 7-day retention window has passed. If a backup is ever restored, the deletion is re-applied.

(3) After termination, or upon a deletion request from the account holder (to mail@orgops.io), OrgOps deletes all of the Customer's data within 30 days unless a statutory retention obligation applies. On request, OrgOps confirms the deletion in text form.

12. Information and audits

(1) OrgOps makes available to the Customer all information necessary to demonstrate compliance with Art. 28 GDPR, in particular these documents, the TOMs and the list of sub-processors. OrgOps currently holds no ISO 27001 or comparable certification.

(2) OrgOps allows for and contributes to audits, including inspections, conducted by the Customer or an auditor mandated by it who is bound to confidentiality. Audits must be announced with reasonable notice, take place during normal business hours and must not impair operations or the confidentiality of other customers' data. Physical audits of data centres are subject to the audit options granted by the respective sub-processor.

13. Liability

Liability towards data subjects is governed by Art. 82 GDPR. Otherwise the liability provisions of the Terms of Service apply to the extent permitted by law.

14. Final provisions

(1) In case of conflict between this DPA and the Terms, this DPA prevails in matters of data protection.

(2) Amendments require text form. OrgOps may amend this DPA where necessary for legal or technical reasons, provided the level of protection is not reduced; the Customer is informed of changes in text form.

(3) Should any provision be invalid, the validity of the remaining provisions is not affected.

(4) German law applies. Place of jurisdiction for merchants, legal entities under public law and special funds under public law is Nürnberg.

Annexes

Annex 1: Technical and Organisational Measures (TOMs)
Annex 2: Sub-processors

Contact

OrgOps GmbH, Kleestraße 21–23, 90461 Nürnberg, Germany
Data protection enquiries and requests for a signed copy: mail@orgops.io