Last updated 2026-10-30
This data processing agreement (DPA) is part of the agreement between EWB, Jydeholmen 29, 2. th., 2720 Vanløse, Denmark, CVR 46856538 ("we"), and the business that uses TweakThis under the terms ("the customer"). It takes effect when the customer accepts the terms.
For the personal data in the customer's workspaces ("customer data"), the customer is the controller, or a processor acting for its own client, and we are its processor. Terms have their GDPR meaning. For accounts, billing and support we are the controller, as described in the privacy policy.
We store and make customer data available to the customer, the people it invites and the coding agents it connects, for as long as the customer uses TweakThis and until the data is deleted under Deletion and return. Annex 1 lists the people and the data concerned.
We process customer data only on the customer's documented instructions: the terms, this DPA and the customer's use of the service, including for transfers outside the EU. If EU or Danish law requires other processing, we tell the customer first unless the law forbids it. We tell the customer if we believe an instruction breaks data protection law. Coding agents the customer connects, and their providers, act for the customer and are not our sub-processors.
Everyone we authorise to process customer data is bound to confidentiality. We do not access customer data except to provide the service, where the law requires it, or to review content reported under the terms.
We take the measures in Annex 2 (GDPR Art. 32), and may change them only without lowering the overall level of protection.
The customer authorises the sub-processors listed below. Each is bound by contract to data protection obligations at least as protective as this DPA, and we remain responsible for them. We email workspace owners at least 14 days before adding or replacing one. The customer may object on reasonable grounds within that period by writing to support@tweakthis.io; if we cannot resolve the objection, it may end the affected subscriptions.
We help the customer, taking into account the nature of the processing, to answer data subject requests, and with its obligations under GDPR Art. 32–36. Requests we receive about customer data are passed on to the customer without undue delay.
We notify the owners of the affected workspaces by email without undue delay after becoming aware of a personal data breach involving customer data, including, as far as known, the nature of the breach, the data and people concerned, the likely consequences and the measures taken.
The customer can export its data at any time. When the owner's account is deleted, or the customer asks us to delete a workspace, we delete its customer data, except for copies in backups and logs that are overwritten in the normal course. After a switch under the terms, the data is deleted when the retrieval period ends. We keep no customer data after that unless EU or Danish law requires it.
We make available the information needed to demonstrate compliance with this DPA and allow audits by the customer or an auditor it mandates who is bound to confidentiality, with 30 days' written notice, at the customer's cost and at most once a year unless a breach or a supervisory authority requires more.
Customer data is stored in the EU, except support email and the emails the service sends, as listed below. Where a sub-processor processes it outside the EU, the transfer relies on an adequacy decision (including the EU-US Data Privacy Framework) or the EU Standard Contractual Clauses.
Liability under this DPA is subject to the limits in the terms, where the law allows. If this DPA and the terms conflict on personal data, this DPA prevails. We may update it and email workspace owners about material changes before they take effect. It is governed by the laws of Denmark, whose courts have jurisdiction.