Por ahora, esta página solo está disponible en inglés.
Data Processing Agreement
Last updated: 7 October 2026
1. Parties and scope
This Data Processing Agreement (“DPA”) is between the customer who owns a PullPress workspace (“Controller”) and DIGT CONSULTING BV, Muidepoort 46, 9000 Gent, Belgium, Company no. BE0783.477.116, VAT BE0783.477.116 (“Processor”). It forms part of the terms of service and applies automatically to every workspace; no separate signature is needed.
It covers personal data the Processor processes on the Controller's behalf when providing PullPress, as required by Article 28 of the GDPR. Where the terms and this DPA conflict on data protection, this DPA prevails.
2. Subject matter, duration, nature and purpose
Subject matter: hosting and operating the PullPress editor, review workflow, notifications and optional AI helpers for the Controller's websites.
Duration: for as long as the workspace exists, plus the deletion periods in section 9.
Nature and purpose: storing, organising, displaying, transmitting and deleting data so that the Controller's team can write, review and publish content to the Controller's Git repository — and nothing else.
3. Types of data and data subjects
Data subjects: the Controller's workspace members and invited editors, reviewers and viewers, and any people mentioned in content or comments.
- Identity and contact data: names and email addresses of members.
- Roles, permissions and membership history.
- Workflow data: change-request titles and metadata, review notes, comments and mentions, content ideas.
- Content passed through the service on its way to the Controller's repository, entry titles and search embeddings, and inputs to AI features the Controller's users invoke.
- Technical data: session records (IP address, user-agent), device push tokens, hashed API/OAuth tokens.
The service is not designed for special categories of personal data (Art. 9 GDPR); the Controller should not place such data in workflow fields.
4. Processor obligations
- Process personal data only on the Controller's documented instructions — these terms, this DPA and the Controller's use of the product settings — unless EU or member-state law requires otherwise (in which case we inform the Controller first unless prohibited).
- Ensure that everyone authorised to process the data is bound by confidentiality.
- Implement the technical and organisational measures in section 6.
- Inform the Controller without undue delay, and where feasible within 48 hours, after becoming aware of a personal data breach affecting its data, with the information needed for the Controller's own notifications.
- Tell the Controller if, in our opinion, an instruction infringes data protection law.
5. Sub-processors
The Controller gives general authorisation for the sub-processors listed on the sub-processors page. We impose data protection obligations on each of them that are no less protective than this DPA and remain responsible for their performance.
We give at least 30 days' notice before adding or replacing a sub-processor, by updating that page and emailing workspace owners. The Controller may object on reasonable data-protection grounds within that period; if we can't address the objection, the Controller may terminate the affected service without penalty.
Transfers outside the EEA rely on the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses, as listed per sub-processor.
6. Security measures
- Encryption of all traffic in transit (HTTPS/TLS); managed database with encryption at rest.
- Passwordless sign-in with single-use, short-lived magic links; API and OAuth tokens stored only as hashes; workspace AI keys encrypted.
- Strict workspace isolation enforced in one server-side access layer; role-based access per workspace, site and collection.
- Least-privilege GitHub App permissions and short-lived installation tokens; secrets kept server-side only.
- Rate limiting on sign-in and write operations; monitoring and error alerting.
- Automatic database backups with a retention window of at most 30 days.
More detail is on the security page.
7. Assistance
Taking into account the nature of the processing, we assist the Controller with data subject requests (members can export and delete their own accounts in-product; owners manage memberships), with security, breach notification, data protection impact assessments and prior consultation, to the extent the Controller can't reasonably do so itself.
8. Audits
We make available the information necessary to demonstrate compliance with Article 28 — including this DPA, the security page and answers to reasonable security questionnaires — on request at privacy@pullpress.app. Where that isn't sufficient, the Controller may audit (itself or through an independent auditor bound by confidentiality) once per year with 30 days' notice, during business hours and at its own cost, without access to other customers' data.
9. Deletion and return
The Controller's content lives in its own Git repository and remains under its control at all times. On deleting a workspace, its personal data is deleted from the live database immediately and rolls out of backups within at most 30 days, unless law requires us to keep it (e.g. billing records). Members can export their account data from their profile beforehand; the Controller can request a further export at the address below before deleting.
10. Contact
Questions about this DPA: privacy@pullpress.app.