LEGACY: Data Processing Addendum and Standard Contractual Clauses
LEGACY: Data Processing Addendum and Standard Contractual Clauses (Effective Dates May 20, 2024 - April 30, 2026)
GitLab Data Processing Addendum
The terms of this Data Processing Addendum (“DPA”) supplement the Subscription Agreement where Customer is entering into the Subscription Agreement on behalf of an Enterprise. Customer’s acceptance of the Subscription Agreement shall be treated as its execution of this DPA and, where applicable, the Standard Contractual Clauses.
The parties agree that this DPA sets forth both parties’ obligation with respect to the processing and security of Personal Data, to the extent GitLab processes such Personal Data. The parties hereby enter into this DPA in order to comply with the obligations under Applicable Data Protection Laws (as defined below).
1. Definitions
The capitalized terms will have the meanings set forth below:
a. “Applicable Data Protection Laws” means any applicable laws, statutes or regulations as may be amended, extended, re-enacted from time to time, or any successor laws which relate to Personal Data including:
(a) the GDPR and any European Economic Area (the “EEA”) Member State laws implementing the GDPR;
(b) the California Consumer Privacy Act of 2018 (the “CCPA”), including as modified by the California Privacy Rights Act of 2020 (the “CPRA”), and the California Attorney General Regulations thereof;
(c) the United Kingdom (the “UK”) Data Protection Act 2018, as amended, and the GDPR, as incorporated into UK law (the “UK GDPR”); and
(d) the Swiss Federal Act on Data Protection of 19 June 1992 and the revised version of 25 September 2020 and its corresponding ordinances (the “Swiss FADP”.
b. “Data Breach” means a confirmed unauthorized access by a third party or confirmed accidental or unlawful destruction, loss or alteration of Personal Data.
c. “Customer Product Usage Information” means aggregated or pseudonymized metrics derived from Customer’s use of the Software and which shall not include Customer Content.
d. “GDPR” means the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the Processing of Personal Data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
e. “Personal Data” means all information defined in the definition of “personal data” under GDPR, which is used in the Service.
f. “Process”, “Processing”, “Processor”, and “Controller” shall have the meaning as defined under GDPR.
g. “Restricted Transfer(s)” means a transfer of Personal Data from the EEA, the UK or Switzerland to a country that has not received an adequacy decision from the European Commission or the UK or Swiss authorities.
h. “Service(s)” means the software and services licensed under the Subscription Agreement.
i. “Standard Contractual Clauses” means:
(i) where the GDPR applies, the contractual clauses annexed to the European Commission’s Implementing Decision 2021/914 of 4 June 2021 available at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj (the “EU SCCs”);
(ii) where the UK GDPR applies, the International Data Transfer Addendum issued by the United Kingdom’s Information Commissioner’s Office to the EU Commission’s Standard Contractual Clauses available at https://ico.org.uk/media2/migrated/4019538/international-data-transfer-agreement.pdf (the “UK SCCs”); and