Data Processing Agreement

Last updated: October 30, 2026

1. Parties and background

This Data Processing Agreement ("DPA") is between:

• Octopus Foundry LLC, a limited liability company with its registered address at 221 53rd Avenue N., Nashville, TN 37209, which operates the Merge Freeze app ("Merge Freeze", "Processor", "we"); and
• The customer that has agreed to the Merge Freeze Terms of Service ("Customer", "Controller").

1.1 Customer uses the Merge Freeze app under the Merge Freeze Terms of Service, or another written agreement between the parties (the "Agreement").

1.2 In providing the app, Merge Freeze processes personal data on Customer's behalf. This DPA sets out the terms of that processing, as required by Article 28 of the GDPR and the UK GDPR.

1.3 This DPA forms part of the Agreement and takes effect when Customer agrees to the Terms of Service or first uses the app, whichever comes first (the "Effective Date").

1.4 No signature is needed. Customer may ask for a signed copy by emailing hello@mergefreeze.com.

2. Definitions

In this DPA:

• "Data Protection Laws" means the GDPR, the UK GDPR, the UK Data Protection Act 2018, the Swiss Federal Act on Data Protection, and any other data protection law that applies to the processing of Customer Personal Data.
• "GDPR" means Regulation (EU) 2016/679.
• "UK GDPR" means the GDPR as it forms part of UK law.
• "Customer Personal Data" means personal data that Merge Freeze processes on Customer's behalf in providing the app, as described in Annex I.
• "Subprocessor" means a third party engaged by Merge Freeze that processes Customer Personal Data.
• "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
• "SCCs" means the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914.
• "UK Addendum" means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner.

"Controller", "processor", "data subject", "personal data", "processing" and "supervisory authority" have the meanings given in the GDPR.

"Writing" and "written" include email.

3. Roles and scope

3.1 Customer is the controller of Customer Personal Data, and Merge Freeze is its processor. Annex I describes the subject matter, nature, purpose and duration of the processing, and the types of personal data and data subjects.

3.2 Merge Freeze will process Customer Personal Data only on Customer's documented instructions. The Agreement, this DPA, and Customer's configuration and use of the app are Customer's complete instructions at the Effective Date. Further instructions must be in writing and consistent with the Agreement.

3.3 Merge Freeze will tell Customer immediately if it believes an instruction breaks Data Protection Laws, and may suspend that processing until Customer confirms or changes the instruction.

3.4 Merge Freeze may process Customer Personal Data where required by law. In that case it will tell Customer first, unless the law forbids it.

3.5 Customer is responsible for having a lawful basis for the processing, and for the accuracy of Customer Personal Data and the way Customer acquired it.

3.6 This DPA does not cover personal data that Merge Freeze processes as an independent controller, such as account and billing information it needs to run its business, or visits to the Merge Freeze website. The Merge Freeze Privacy Notice covers that processing.

4. Merge Freeze's obligations

4.1 Merge Freeze will:

1. process Customer Personal Data only as Section 3 allows;
2. make sure everyone it authorizes to process Customer Personal Data is bound by a duty of confidentiality, and has access only as far as their role needs;
3. keep the security measures in Section 6 and Annex II in place;
4. engage Subprocessors only as Section 5 allows;
5. help Customer respond to data subject requests and meet its other obligations, as Section 8 describes;
6. notify Customer of Personal Data Breaches as Section 7 describes;
7. delete or return Customer Personal Data at the end of the Agreement as Section 11 describes; and
8. make available the information Customer needs to show compliance with Article 28 of the GDPR, as Section 10 describes.

4.2 Merge Freeze will not sell Customer Personal Data, or use it for its own purposes, except as needed to provide, secure and support the app.

5. Subprocessors

5.1 Customer gives Merge Freeze general authorization to engage Subprocessors. The Subprocessors listed in Annex III are approved as of the Effective Date.

5.2 Merge Freeze will update Annex III at least 30 days before adding or replacing a Subprocessor, and will email Customers who have asked to be told about changes.

5.3 Customer may object to a new Subprocessor on reasonable data protection grounds by writing to hello@mergefreeze.com within that notice period. The parties will discuss the concern in good faith. If they cannot resolve it, Customer may end the affected part of the Agreement and receive a pro rata refund of any prepaid fees for the remaining term.

5.4 Merge Freeze will put a written contract in place with each Subprocessor that gives Customer Personal Data at least the protection this DPA requires. Merge Freeze remains responsible to Customer for its Subprocessors' performance of those obligations.

6. Security

6.1 Merge Freeze will keep in place technical and organizational measures that protect Customer Personal Data to the standard Article 32 of the GDPR requires, taking into account the state of the art, the cost of implementation, and the nature and risks of the processing. Annex II lists the measures in place at the Effective Date.

6.2 Merge Freeze may update these measures over time, provided the overall level of protection does not go down.

7. Personal Data Breaches

7.1 Merge Freeze will notify Customer without undue delay, and in any case within 48 hours, after becoming aware of a Personal Data Breach.

7.2 The notice will describe, as far as Merge Freeze then knows: what happened; the categories and approximate number of data subjects and records affected; the likely consequences; and the steps taken or proposed to address the breach and reduce its effects. Merge Freeze will send further information as it becomes available.

7.3 Merge Freeze will take reasonable steps to contain and investigate the breach, and will cooperate with Customer in any notice Customer must give to supervisory authorities or data subjects.

7.4 Notifying or responding to a Personal Data Breach is not an admission of fault or liability by Merge Freeze.

7.5 Merge Freeze will not make any public statement about a Personal Data Breach affecting Customer Personal Data without Customer's approval, unless the law requires it.

8. Assistance and data subject requests

8.1 If Merge Freeze receives a request from a data subject about Customer Personal Data, it will pass the request to Customer without undue delay and will not answer it directly, except to point the data subject to Customer.

8.2 Taking into account the nature of the processing, Merge Freeze will give Customer reasonable help to respond to data subject requests. Much of this is self-serve: deleting a user in the app's user settings removes their email address, GitHub username and avatar, and uninstalling the GitHub app removes account, repository and branch names.

8.3 Merge Freeze will give Customer reasonable help with data protection impact assessments and prior consultations with supervisory authorities, where they relate to Customer's use of the app and the information is not otherwise available to Customer.

8.4 Unless the law forbids it, Merge Freeze will tell Customer promptly about any legally binding request from a public authority for Customer Personal Data, and about any regulator investigation that relates to it. Merge Freeze will disclose only what the request legally requires.

9. International transfers

9.1 Merge Freeze is based in the United States, and Customer Personal Data is processed in the United States and the other countries where Subprocessors operate (Annex III).

9.2 Where Customer Personal Data is transferred from the European Economic Area to a country without an adequacy decision, the SCCs are incorporated into this DPA as follows:

• Module Two (controller to processor) applies where Customer is a controller; Module Three (processor to processor) applies where Customer is itself a processor.
• Clause 7 (docking clause) applies.
• Clause 9: Option 2 (general written authorization) applies, with the notice period in Section 5.2.
• Clause 11: the optional independent dispute resolution wording does not apply.
• Clause 13: the competent supervisory authority is the one identified under Clause 13 according to Customer's establishment or representative.
• Clauses 17 and 18: the SCCs are governed by the law of Ireland, and disputes go to the courts of Ireland.
• Annexes I, II and III of this DPA complete Annexes I, II and III of the SCCs.

9.3 For transfers from the United Kingdom, the UK Addendum applies, completed with the information in this DPA. Either party may end the UK Addendum as its Section 19 allows.

9.4 For transfers from Switzerland, the SCCs apply with these changes: references to the GDPR mean the Swiss Federal Act on Data Protection; the competent authority is the Swiss Federal Data Protection and Information Commissioner; and "member state" includes Switzerland so Swiss data subjects can enforce their rights there.

9.5 Where Merge Freeze or a Subprocessor is certified under the EU-U.S. Data Privacy Framework (including its UK and Swiss extensions), Merge Freeze may rely on that certification instead of the SCCs for the transfers it covers.

9.6 If the SCCs and this DPA conflict, the SCCs prevail.

10. Audits

10.1 Merge Freeze will make available the information Customer reasonably needs to show compliance with Article 28 of the GDPR, including answering a written security questionnaire once a year.

10.2 If that information is not enough, or a supervisory authority requires it, or after a Personal Data Breach, Customer or an independent auditor bound by confidentiality may audit Merge Freeze. Customer will give 30 days' written notice, and audits will be no more than once a year except after a breach or when a regulator requires it. Audits will take place during normal business hours, must not unreasonably disrupt Merge Freeze's business or the app, and must not give access to other customers' data. Customer and its auditor will keep everything they learn during an audit confidential.

10.3 Customer pays its own audit costs. This Section is how the parties meet the audit terms of the SCCs.

11. Return and deletion

11.1 Within 30 days after the Agreement ends, Merge Freeze will delete Customer Personal Data. If Customer asks in writing before then, Merge Freeze will return a copy first.

11.2 Merge Freeze keeps an encrypted copy of log files and records of changes for up to 15 days, and database backups are kept for up to 7 days before they expire. It may also keep data where the law requires. This DPA continues to protect anything kept.

11.3 On request, Merge Freeze will confirm the deletion in writing.

12. Liability, term and general terms

12.1 Each party's liability under this DPA is subject to the limits in the Agreement, as far as the law allows. This does not limit either party's liability to data subjects under the SCCs.

12.2 This DPA lasts for as long as Merge Freeze processes Customer Personal Data.

12.3 If documents conflict, they apply in this order: the SCCs, then this DPA, then the Agreement.

12.4 This DPA replaces any earlier data processing agreement between Customer and Merge Freeze.

12.5 This DPA is governed by the same law as the Agreement, except where Section 9 says otherwise.

Annex I: Description of processing

Annex II: Security measures

• Application servers and the Postgres database run on AWS, which follows ISO 27001 controls, publishes SOC 2 reports and runs regular penetration testing.
• Servers and the database talk over an internal network managed by AWS. External database connections require SSL.
• All data is encrypted at rest with AES 256 block level storage encryption.
• Log files are stored encrypted and kept for up to 15 days. Records of changes made in the app are deleted after 15 days.
• Subprocessors are bound by written data protection terms (Section 5.4).
• Access to production systems is limited to the owners of Octopus Foundry LLC. Multi-factor authentication is required for AWS, GitHub, Better Stack, Cloudflare, Mailjet, Insight Hub and Stripe. Login rights are revoked promptly when no longer needed.

Annex III: Subprocessors