Data Processing Agreement
Version: 1.0 Effective date: 23 August 2026
This Data Processing Agreement ("DPA") forms part of, and is incorporated by reference into, the Terms of Service (the "Agreement") between the customer entity that has subscribed to the Dependra platform ("Customer") and Wadman Information Technologies AB, a company registered in Sweden, operating the Dependra platform ("Dependra").
This DPA reflects the parties' agreement on the processing of Personal Data in connection with the Service, as required by Article 28 of Regulation (EU) 2016/679 (the "GDPR"). It is modelled on the standard contractual clauses for controller-to-processor relationships adopted by the European Commission in Implementing Decision (EU) 2021/915.
By accepting the Agreement, or by using the Service, Customer accepts this DPA. No signature is required. Customers who require a countersigned copy may request one at privacy@dependra.com.
1. Definitions
Terms defined in the GDPR — including "Personal Data", "Processing", "Controller", "Processor", "Sub-processor", "Data Subject", "Personal Data Breach" and "Supervisory Authority" — have the same meaning in this DPA.
In addition:
- "Customer Personal Data" means Personal Data contained within Customer Data that Dependra Processes on Customer's behalf in providing the Service.
- "Customer Data" means all data that Customer or its authorised users submit to, or that the Service generates on Customer's instruction within, Customer's tenant — including the landscape model, integration configuration, and data retrieved from systems Customer connects.
- "Service" means the Dependra platform as described in the Agreement, including the Dependra apps for Atlassian Jira and Confluence.
- "Sub-processor" means any third party engaged by Dependra to Process Customer Personal Data.
2. Scope and order of precedence
This DPA applies to all Processing of Customer Personal Data by Dependra in the course of providing the Service.
In the event of a conflict, the order of precedence is: (1) this DPA, (2) the Terms of Service, (3) any other document forming part of the Agreement. The Privacy Policy describes Dependra's own Processing as a Controller and does not limit or vary this DPA.
3. Roles of the parties
Customer is the Controller and Dependra is the Processor in respect of Customer Personal Data. Customer determines the purposes and means of that Processing; Dependra Processes it only on Customer's behalf.
Dependra is an independent Controller in respect of a limited set of data it determines the purposes for itself, namely: account registration data, authentication credentials, billing data, service operation and security telemetry, and the identifiers required to operate an integration Customer has enabled. That Processing is governed by the Privacy Policy, not by this DPA.
Where Customer is itself acting as a Processor on behalf of a third-party Controller, Customer warrants that it has the authority of that Controller to enter into this DPA and to issue the instructions it gives to Dependra.
4. Details of Processing
The subject matter, duration, nature and purpose of the Processing, the types of Personal Data, and the categories of Data Subjects are set out in Annex I.
5. Customer's instructions
Dependra shall Process Customer Personal Data only on documented instructions from Customer, including with regard to transfers to a third country, unless required to do so by Union or Member State law to which Dependra is subject. In that case Dependra shall inform Customer of that legal requirement before Processing, unless the law prohibits it on important grounds of public interest.
Customer's instructions comprise: the Agreement, this DPA, Customer's configuration of the Service, and any further written instruction agreed by the parties. Configuring an integration, selecting a publishing target, or authoring a query within the Service constitutes an instruction.
Dependra shall inform Customer if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions. Dependra may suspend performance of the affected instruction until Customer confirms or withdraws it.
Dependra does not sell Customer Personal Data, use it for advertising, use it to train machine-learning models, or Process it for any purpose other than providing and securing the Service.
6. Confidentiality
Dependra shall ensure that persons authorised to Process Customer Personal Data are bound by an appropriate statutory or contractual obligation of confidentiality, and that access is limited to those personnel who require it in order to provide, secure or support the Service.
7. Security of Processing
Dependra shall implement and maintain the technical and organisational measures set out in Annex II to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of Processing.
Dependra may update those measures over time provided that the level of protection is not reduced. The current measures are always those published in Annex II of the then-current version of this DPA.
Customer is responsible for the security measures within its own control, including the management of its users, roles, stewardship grants, API keys, and single sign-on configuration.
8. Sub-processors
Customer grants Dependra general authorisation to engage Sub-processors, subject to this clause.
The Sub-processors engaged as at the date of this DPA are listed in Annex III.
Dependra shall:
- impose on each Sub-processor, by written contract, data protection obligations no less protective than those in this DPA;
- remain fully liable to Customer for the performance of each Sub-processor's obligations;
- give Customer at least 30 days' prior notice of the addition or replacement of a Sub-processor, by updating Annex III and notifying the email address associated with Customer's account.
Customer may object to a new Sub-processor on reasonable, documented data protection grounds within the notice period. The parties shall discuss the objection in good faith. If it cannot be resolved, Customer may terminate the affected part of the Service, or the Agreement, without penalty, and receive a pro-rata refund of prepaid fees for the unused remainder of the term.
9. Assistance with Data Subject rights
Taking into account the nature of the Processing, Dependra shall assist Customer by appropriate technical and organisational measures, insofar as this is possible, in fulfilling Customer's obligation to respond to requests to exercise Data Subject rights under Chapter III of the GDPR.
In practice, the Service provides Customer with self-service means to access, correct, export and delete Customer Personal Data, including a full export of Customer's authored landscape in a structured, machine-readable format. Customer should use those facilities in the first instance.
If Dependra receives a request directly from a Data Subject relating to Customer Personal Data, Dependra shall not respond to it substantively, but shall promptly forward it to Customer and inform the Data Subject that it has done so.
10. Personal Data Breach
Dependra shall notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data.
The notification shall, to the extent known at the time and supplemented as further information becomes available, describe: the nature of the breach including the categories and approximate number of Data Subjects and records concerned; the likely consequences; the measures taken or proposed to address it; and a contact point for further information.
Dependra shall document all Personal Data Breaches affecting Customer Personal Data and shall assist Customer in meeting its own obligations under Articles 33 and 34 of the GDPR.
Notification of a breach is not, of itself, an acknowledgement of fault or liability.
Security contact: security@dependra.com.
11. Data protection impact assessments
Dependra shall provide reasonable assistance to Customer with any data protection impact assessment and any prior consultation with a Supervisory Authority under Articles 35 and 36 of the GDPR, insofar as this relates to the Processing carried out by Dependra and taking into account the information available to Dependra.
12. International transfers
Dependra Processes Customer Personal Data within the European Union. All Sub-processors listed in Annex III are established in, and Process within, the EU.
Dependra shall not transfer Customer Personal Data outside the EU/EEA without either Customer's prior written authorisation or an appropriate transfer mechanism under Chapter V of the GDPR, such as the European Commission's standard contractual clauses.
Integrations Customer enables are excluded from this clause. Where Customer instructs the Service to send data to an external system that Customer controls — for example, publishing documentation into Customer's own Confluence site — the hosting location of that system, and any resulting transfer, is determined by Customer's own agreement with that provider and is outside Dependra's control. Customer is responsible for assessing the lawfulness of such transfers.
13. Audits
Dependra shall make available to Customer all information reasonably necessary to demonstrate compliance with Article 28 of the GDPR, and shall allow for and contribute to audits, including inspections, conducted by Customer or an auditor mandated by Customer.
The parties agree the following procedure:
- Customer shall first request Dependra's then-current security documentation, including this Annex II and any completed security questionnaires or third-party attestations Dependra holds. Dependra shall respond within 30 days.
- If that documentation is insufficient to demonstrate compliance, Customer may request a written questionnaire, which Dependra shall complete within 30 days.
- If a matter remains unresolved, Customer may conduct an on-site or remote audit, subject to: at least 30 days' prior written notice; no more than once in any 12-month period, except following a Personal Data Breach or where required by a Supervisory Authority; conduct during normal business hours in a manner that does not disrupt the Service; and an auditor bound by confidentiality who is not a competitor of Dependra.
- Customer bears its own costs and Dependra's reasonable costs of an on-site audit, unless the audit reveals a material breach by Dependra of this DPA.
Dependra shall never grant an auditor access to data belonging to another customer.
14. Deletion and return of data
Customer may export its authored landscape at any time during the term using the Service's export function.
On termination or expiry of the Agreement, Dependra shall delete Customer Personal Data in accordance with the retention periods set out in Annex I, save to the extent that Union or Member State law requires continued storage — in particular, billing records retained for seven years under the Swedish Bookkeeping Act (Bokföringslagen). Data retained on that basis shall be Processed only for the purpose that requires its retention, and shall remain subject to this DPA.
Backup copies are deleted in the ordinary course of the backup rotation cycle.
On written request made within the retention window, Dependra shall confirm deletion in writing.
15. Liability
Each party's liability under this DPA is subject to the limitations and exclusions of liability set out in the Agreement.
16. Term
This DPA takes effect when Customer accepts the Agreement and continues until Dependra has ceased all Processing of Customer Personal Data in accordance with clause 14.
17. Governing law and jurisdiction
This DPA is governed by the laws of Sweden. The courts of Sweden have exclusive jurisdiction, without prejudice to any Data Subject's rights under Articles 79 and 82 of the GDPR.
18. Changes to this DPA
Dependra may update this DPA to reflect changes in law, in the Service, or in its Sub-processors. Material changes will be notified to the email address associated with Customer's account at least 30 days before taking effect. Changes that merely add detail, or that increase the level of protection, may take effect on publication.
19. Contact
- Data protection: privacy@dependra.com
- Security and breach reporting: security@dependra.com
- Entity: Wadman Information Technologies AB (Dependra), Sweden
- Supervisory Authority: Integritetsskyddsmyndigheten (IMY), Sweden — https://www.imy.se
Annex I — Description of the Processing
Subject matter
Provision of the Dependra platform: an enterprise architecture and impact intelligence service that allows Customer to model its IT landscape, map dependencies, compute blast radius, track objectives and key results, and publish documentation into systems Customer connects.
Duration
The term of the Agreement, plus the retention periods set out below.
Nature and purpose of the Processing
Storage, structuring, retrieval, computation, display, transmission and erasure of Customer Personal Data, for the sole purpose of providing, securing and supporting the Service on Customer's instruction.
Categories of Data Subjects
- Customer's employees, contractors and other personnel who use the Service
- Individuals named within Customer's landscape model — for example application owners, stewards, support contacts and process owners
- Individuals identified within data retrieved from systems Customer connects — for example the Atlassian account of an administrator who connects an integration, or accounts referenced in a Customer-authored query
Types of Personal Data
| Category | Examples |
|---|---|
| User account data | Name, email address, authentication credentials, role and grant assignments, two-factor enrolment |
| Landscape contact data | Names, email addresses and telephone numbers recorded against applications, components, capabilities and business processes — for example an owner, steward or support contact |
| Usage and security telemetry | IP address, browser type, pages visited, timestamps |
| Audit trail | A short actor signature and the action performed, retained so the record survives deletion of the actor |
| Integration identifiers | Site, installation and tenant identifiers for a connected system; the account identifier of the administrator who performs the connection |
| Integration content | Data retrieved from a connected system on Customer's instruction — for example issue identifiers and numeric field values matching a Customer-authored query |
| AI usage metrics | Token counts and cost aggregates per tenant, where Customer uses the Dependra-managed Copilot. Prompts and responses are Processed in transit and are not stored by Dependra |
Dependra does not require, and the Service is not designed to hold, special categories of Personal Data under Article 9 of the GDPR, or Personal Data relating to criminal convictions and offences under Article 10. Customer should not submit such data.
Frequency of Processing
Continuous, for the duration of the Agreement.
Retention
| Data | Retention |
|---|---|
| Customer Data and landscape contact data | Term of the Agreement, then 30 days |
| User account data | Active account period, then 30 days |
| Audit log | Term of the Agreement, then 30 days |
| Application and security logs | 90 days |
| Integration credentials and installation identifiers | Until Customer disconnects the integration, or the integration is uninstalled, whichever is earlier |
| Billing records | 7 years, as required by the Swedish Bookkeeping Act |
Annex II — Technical and organisational measures
Dependra maintains the following measures. They may be updated over time provided the level of protection is not reduced.
Pseudonymisation and data minimisation
- The audit log stores only a short actor signature rather than a full identity, so the trail is minimised and survives deletion of the actor.
- Identifiers received from connected systems solely to verify the authenticity of a request are used transiently and are not retained.
- Where the Dependra-managed Copilot is used, only token counts and cost aggregates are retained; prompt and response content is not stored.
Encryption
- In transit: TLS for all traffic between the browser, the Service, and any connected system.
- At rest: all tenant data is encrypted at rest by the hosting platform.
- Application-layer sealing: sensitive secrets — single sign-on client secrets, OAuth state, and integration access tokens — are additionally encrypted with AES-256-GCM before storage, with key material held outside the database. Secrets are never returned to the client and never placed in a URL.
- Credentials: user passwords are hashed and salted with bcrypt and are never stored in plaintext.
Confidentiality — access control
- Tenant isolation: every record is scoped to a single tenant and that scope is enforced at the data-access layer, so a query cannot span tenants.
- Role-based access control: per-team roles (Viewer, Editor, Admin) govern artifact visibility.
- Least-privilege stewardship grants: landscape editing is delegated through three separate grants (Portfolio, Business Model, Infrastructure), with a distinct revenue-visibility axis so financial figures can be withheld from users who do not need them.
- Two-factor authentication: per-user TOTP enrolment.
- Single sign-on: per-tenant OIDC against Customer's own identity provider, with signature validation via the provider's JWKS, issuer, audience, lifetime and nonce checks, and group-based claims mapping re-evaluated on every login.
- API access: API keys are scope-governed and tenant-bound.
Integrity
- Append-only audit log recording administrative and data-changing actions, queryable by date, action, entity and user, backed by a durable ingestion pipeline designed not to lose records.
- Multi-step database operations are transactional, so a failure does not leave partial state.
Availability and resilience
- Managed, redundant hosting within the EU.
- Bounded computation: traversals and bulk operations enforce depth and rate limits so that one tenant's load cannot starve another.
- Graceful degradation: failure of an optional or external component does not take down core functionality.
Verification and governance
- Changes are reviewed against a documented security and resilience checklist before release, covering injection, tenant isolation, authorisation, input validation, error handling and data exposure.
- Automated test suites gate every release, including tests that specifically assert tenant isolation and authorisation on API endpoints.
- A published security contact and vulnerability disclosure route: security@dependra.com and
/.well-known/security.txt.
Data location
All Processing takes place within the European Union. See Annex III.
Annex III — Sub-processors
| Sub-processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Clever Cloud SAS | Application hosting and managed database | All Customer Data and account data | France (EU) |
| Mollie B.V. | Payment processing | Billing data, email address | Netherlands (EU) |
| Lettermint | Transactional and notification email delivery | Name, email address, and the content of notifications Customer has enabled | Netherlands (EU) |
| Mistral AI SAS | AI model inference for the optional Dependra-managed Copilot | Prompt and response content, Processed in transit and not stored | France (EU) — EU data partition only |
Mistral AI Processes data only for tenants that have opted into the Dependra-managed Copilot. Tenants using their own model provider ("bring your own LLM") instead instruct Dependra to send prompts to a provider of their choosing; that provider is Customer's own Sub-processor, not Dependra's.
Systems that Customer connects to Dependra — such as Customer's own Atlassian, Slack or source-control accounts — are not Dependra Sub-processors. Customer holds the relationship with those providers, Dependra acts only on Customer's instruction, and Customer may disconnect at any time.
To be notified of changes to this list, contact privacy@dependra.com.