Logfire Data Processing Addendum¶

Last update: 2024-02-17

This Data Processing Addendum (including its Exhibits) ("Addendum") is incorporated into and forms part of and is subject to the terms and conditions of the Logfire Terms of Service (the "Logfire Terms") between Customer (as defined below) and Pydantic Services Inc. ("PSI"). This Addendum will become legally binding upon the effective date of the Logfire Terms. This Addendum reflects the parties' commitment to abide by Data Protection Laws (as defined below) concerning the Processing of Customer Personal Data. If and to the extent language in this Addendum or any of its Exhibits conflicts with the Logfire Terms, this Addendum shall control.

1. Definition¶

For the purposes of this Addendum, the following terms and those defined within the body of this Addendum apply. All capitalized terms that are not expressly defined in this Addendum will have the meanings given to them in the Cloud Terms.

"Customer", "you", "your" means the individual or organization, including its affiliates, that agrees to the Logfire Terms.
"Customer Personal Data" means all Personal Data that is uploaded by Customer to the Services and Processed by PSI on behalf of Customer.
"Data Protection Laws" means all applicable data privacy, data protection, and cybersecurity laws, rules and regulations to which the Customer Personal Data are subject. "Data Protection Laws" may include, but is not limited to, the California Consumer Privacy Act of 2018 ("CCPA"); the EU General Data Protection Regulation 2016/679 ("GDPR") and its respective national implementing legislations; the Swiss Federal Act on Data Protection; the United Kingdom General Data Protection Regulation; and the United Kingdom Data Protection Act 2018 (in each case, as amended, adopted, or superseded from time to time).
"Personal Data" has the meaning assigned to the term "personal data" or "personal information" under applicable Data Protection Laws.
"Process" or "Processing" means any operation or set of operations which is performed on Personal Data or sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment or combination, restriction, erasure, or destruction.
"Security Incident(s)" means the breach of security leading to the unauthorized or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data attributable to PSI.
"Subprocessor(s)" means PSI's authorized vendors and third-party service providers that Process Customer Personal Data.
"Logfire Services" means the services that PSI performs under the Logfire Terms.

2. Processing Terms for Customer Personal Data¶

Documented Instructions. PSI shall Process Customer Personal Data to provide the Logfire Services in accordance with the Logfire Terms, this Addendum, and any instructions mutually agreed upon by authorized employees of the parties in writing. PSI will, unless legally prohibited from doing so, inform Customer in writing if it reasonably believes that there is a conflict between Customer's instructions and applicable law or otherwise seeks to Process Customer Personal Data in a manner that is inconsistent with Customer's instructions.
Authorization to Use Subprocessors. To the extent necessary to fulfill PSI's contractual obligations under the Logfire Terms, Customer hereby authorizes PSI to engage Subprocessors. We maintain a list of our Subprocessors which we will update at least 7 days before the addition of or replacement of any Subprocessor.
PSI and Subprocessor Compliance. PSI agrees to (i) enter into a written agreement with Subprocessors regarding such Subprocessors' Processing of Customer Personal Data that imposes on such Subprocessors data protection requirements for Customer Personal Data that are consistent with this Addendum; and (ii) remain responsible to Customer for PSI's Subprocessors' failure to perform their obligations with respect to the Processing of Customer Personal Data.
Confidentiality. Any person authorized to Process Customer Personal Data must contractually agree to maintain the confidentiality of such information or be under an appropriate statutory obligation of confidentiality.
Personal Data Inquiries and Requests. Where required by Data Protection Laws, PSI agrees to provide reasonable assistance and comply with reasonable instructions from Customer related to any requests from individuals exercising their rights in Customer Personal Data granted to them under Data Protection Laws.
Sale of Customer Personal Data Prohibited. PSI shall not sell Customer Personal Data as the term "sell" is defined by the CCPA.
Data Protection Impact Assessment and Prior Consultation. Where required by Data Protection Laws, PSI agrees to provide reasonable assistance at Customer's expense to Customer where, in Customer's reasonable judgement, the type of Processing performed by PSI requires a data protection impact assessment and/or prior consultation with the relevant data protection authorities.
Demonstrable Compliance. PSI agrees to provide information reasonably necessary to demonstrate compliance with this Addendum upon Customer's reasonable request.
Aggregation and De-Identification. PSI may: (i) compile aggregated and/or de-identified information in connection with providing the Logfire Services provided that such information cannot reasonably be used to identify Customer or any data subject to whom Customer Personal Data relates ("Aggregated and/or De-Identified Data"); and (ii) use Aggregated and/or De-Identified Data for its lawful business purposes.

3. Information Security Program¶

Security Measures. PSI shall use commercially reasonable efforts to implement and maintain reasonable administrative, technical, and physical safeguards designed to protect Customer Personal Data.

4. Security Incidents¶

Notice. Upon becoming aware of a Security Incident, PSI agrees to provide you with written notice without undue-delay and within the time frame required under Data Protection Laws.

5. Cross-Border Transfers of Customer Personal Data¶

Cross-Border Transfers of Personal Data. Customer authorizes PSI and its Subprocessors to transfer Customer's Personal Data, across international borders, including from the European Economic Area, Switzerland, and/or the United Kingdom to the United States.
EEA, Swiss, and UK Standard Contractual Clauses. If Customer Personal Data originating in the European Economic Area ("EEA"), Switzerland, and/or the United Kingdom is transferred by Customer to PSI in a country that has not been found to provide an adequate level of protection under applicable Data Protection Laws, the parties agree that the transfer shall be governed by the UK Standard Contractual Clauses or the Current EU Standard Contractual Clauses, as applicable. For purposes of this Addendum, the "UK Standard Contractual Clauses" mean the Standard Contractual Clauses for data controller to data processor transfers approved by the European Commission in decision 2010/87/EU, and the "Current EU Standard Contractual Clauses" mean the Standard Contractual Clauses approved by the European Commission in decision 2021/914. For transfers of Customer Personal Data outside of the UK, the UK Standard Contractual Clauses will apply. For transfers of Customer Personal Data outside of the EEA or Switzerland, the Current EU Standard Contractual Clauses will apply. When Customer is acting as a controller under the Current EU Standard Contractual Clauses, the Controller-to-Processor Clauses will apply to a data transfer. When Customer is acting as a processor under the Current EU Standard Contractual Clauses, the Processor-to-Processor Clauses will apply to a Data Transfer. The UK Standard Contractual Clauses and the Current EU Standard Contractual Clauses will form an integral part of this Addendum.

6. Audits¶

Where Data Protection Laws afford Customer an audit right, Customer (or its appointed representative) may, at Customer's expense, carry out an audit of PSI's policies, procedures, and records relevant to the Processing of Customer Personal Data. Any audit must be:

conducted during PSI's regular business hours;
with reasonable advance notice to PSI;
carried out in a manner that prevents unnecessary disruption to PSI's operations; and
subject to reasonable confidentiality procedures. In addition, any audit shall be limited to once per year, unless an audit is carried out at the direction of a government authority having proper jurisdiction.

7. Customer Personal Data Deletion¶

At the expiration or termination of the Logfire Terms, PSI will, at Customer's option and at PSI's then-current rate, delete or return all Customer Personal Data (excluding any back-up or archival copies which shall be deleted in accordance with PSI's data retention schedule), except where PSI is required to retain copies under applicable laws, in which case PSI will isolate and protect that Customer Personal Data from any further Processing except to the extent required by applicable laws.

8. Customer's Obligations¶

Customer represents and warrants that it has (i) it has complied and will comply with Data Protection Laws; (ii) it has provided data subjects whose Customer Personal Data will be Processed in connection with the Agreement with a privacy notice or similar document that clearly and accurately describes Customer's practices with respect to the Processing of Customer Personal Data; (iii) it has obtained and will obtain and continue to have, during the term, all necessary rights, lawful bases, authorizations, consents, and licenses for the Processing of Customer Personal Data as contemplated by this Addendum and the Logfire Terms; and (iv) PSI's Processing of Customer Personal Data in accordance with this Addendum and the Agreement will not violate Data Protection Laws or cause a breach of any agreement or obligations between Customer and any third party.

9. Processing Details¶

Subject Matter. The subject matter of the Processing is the Logfire Services pursuant to the Cloud Terms.
Duration. The Processing will continue until the expiration or termination of the Logfire Terms.
Categories of Data Subjects. Data subjects whose Customer Personal Data will be Processed pursuant to the Logfire Terms.
Nature and Purpose of the Processing. The purpose of the Processing of Customer Personal Data by PSI is the performance of the Logfire Services.
Types of Customer Personal Data. Customer Personal Data that is Processed pursuant to the Logfire Terms.