Data Processing Agreement
Last Updated: October 2026
This Data Processing Agreement ("DPA") forms part of the agreement between Brimble Inc. ("Brimble") and the customer ("Customer") for the use of the Brimble platform (the "Agreement"). It applies whenever Brimble processes Personal Data on the Customer's behalf while providing the services.
1. Definitions
- Data Protection Laws: all laws that apply to the processing of Personal Data under the Agreement, including, where applicable, the Nigeria Data Protection Act 2023 ("NDPA"), the EU General Data Protection Regulation ("GDPR"), and the UK GDPR.
- Personal Data: any information relating to an identified or identifiable natural person that Brimble processes on the Customer's behalf.
- Customer Data: all data the Customer or its end users store in, or transmit through, the services, including application data, databases, files, logs, and backups.
- Sub-processor: a third party engaged by Brimble that processes Personal Data on the Customer's behalf.
- Security Incident: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data.
Terms such as "controller", "processor", "data subject", and "processing" have the meanings given in the applicable Data Protection Laws.
2. Roles of the Parties
The Customer is the controller of the Personal Data in Customer Data, or a processor acting for its own customers. Brimble is a processor, or a sub-processor where the Customer is itself a processor.
Brimble is a controller only for the data it collects to run its own business, such as account, billing, and usage information. That data is covered by the Brimble Privacy Policy, not by this DPA.
3. Processing Instructions
Brimble processes Personal Data only on the Customer's documented instructions. The Agreement, this DPA, and the Customer's use and configuration of the services are the Customer's complete instructions. Additional instructions must be agreed in writing.
Brimble will tell the Customer promptly if it believes an instruction breaches Data Protection Laws. Brimble may process Personal Data otherwise only where required by applicable law, in which case it will tell the Customer before processing unless the law prohibits it.
Brimble does not sell Customer Data, use it to train models, or access its contents except as needed to provide and support the services, to prevent abuse, or to comply with the law.
4. Confidentiality
Brimble ensures that everyone it authorises to process Personal Data is bound by an appropriate duty of confidentiality and has access only to what they need for their role.
5. Security
Brimble implements and maintains appropriate technical and organisational measures to protect Personal Data, taking into account the state of the art, the cost of implementation, and the nature, scope, context, and purposes of processing. These measures are described in Annex 2 and may be updated over time, provided the overall level of protection is not reduced.
The Customer is responsible for the security of what it controls, including its application code, account credentials, access management for its team, database credentials, and whether it enables features such as backups, TLS, and high availability.
6. Sub-processors
The Customer authorises Brimble to engage Sub-processors. The current list is published on the Sub-processors page.
Brimble will:
- impose data protection obligations on each Sub-processor that are no less protective than those in this DPA;
- remain responsible to the Customer for the performance of each Sub-processor's obligations; and
- give at least 30 days' notice before a new Sub-processor begins processing Personal Data, by updating the Sub-processors page and notifying subscribed customers.
The Customer may object to a new Sub-processor on reasonable data protection grounds within that notice period by writing to legal@brimble.app. The parties will work in good faith to resolve the objection. If they cannot, the Customer may terminate the affected services without penalty and receive a pro-rata refund of prepaid fees for those services.
7. Data Subject Requests
The Customer can access, export, correct, and delete Customer Data through the services. If Brimble receives a request directly from a data subject relating to Customer Data, it will refer the data subject to the Customer and will not respond itself unless legally required.
Taking into account the nature of the processing, Brimble will provide reasonable assistance to help the Customer respond to data subject requests that it cannot fulfil using the services.
8. Security Incidents
Brimble will notify the Customer without undue delay, and in any event within 72 hours of becoming aware of a Security Incident affecting the Customer's Personal Data.
The notification will describe, as far as is then known, the nature of the incident, the categories and approximate volume of data affected, the likely consequences, and the measures taken or proposed. Brimble will provide further information as it becomes available and take reasonable steps to contain and remediate the incident.
Notification is not an admission of fault. The Customer remains responsible for notifying regulators and data subjects where its role requires it, and Brimble will reasonably assist.
9. Assistance with Impact Assessments and Regulators
Brimble will provide reasonable information and assistance for the Customer's data protection impact assessments and prior consultations with supervisory authorities, to the extent they relate to Brimble's processing.
10. Deletion and Return of Data
During the term, the Customer can export Customer Data using the services' export, download, and backup features.
When the Agreement ends, or when the Customer deletes a project, database, or account, Brimble will delete the related Customer Data from live systems within 30 days. Copies in backups are deleted as those backups expire under their retention schedule, which does not exceed 90 days. Brimble may keep data longer only where the law requires it, in which case it keeps the data protected and processes it only for that purpose.
11. Audits
Brimble will make available the information reasonably necessary to demonstrate compliance with this DPA, including written responses to security questionnaires and, where available, summaries of independent assessments.
If that information is not sufficient, or a regulator requires it, the Customer may conduct an audit no more than once per year, with at least 30 days' written notice, during business hours, at its own cost, and subject to confidentiality obligations. Audits must not compromise the security of other customers' data.
12. International Transfers
Brimble hosts Customer Data in the regions the Customer selects for its workloads. Some Sub-processors and support operations may process Personal Data in other countries, as shown on the Sub-processors page.
Where Personal Data is transferred outside the country or region where it was collected, Brimble ensures the transfer is protected by an appropriate safeguard under Data Protection Laws. These include the Standard Contractual Clauses approved by the European Commission, the UK International Data Transfer Addendum, and the mechanisms recognised under the NDPA.
13. Liability
Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Agreement.
14. Order of Precedence and Term
If this DPA conflicts with the Agreement, this DPA controls with respect to the processing of Personal Data. This DPA remains in effect for as long as Brimble processes Personal Data on the Customer's behalf.
15. Contact
Questions about this DPA, objections to Sub-processors, and audit requests: legal@brimble.app. Security reports: security@brimble.app.
Annex 1: Details of Processing
| Item | Details |
|---|---|
| Subject matter | Providing the Brimble cloud platform: hosting applications, managed databases, storage, builds, and related services |
| Duration | The term of the Agreement, plus the deletion periods in Section 10 |
| Nature of processing | Hosting, storing, transmitting, backing up, restoring, and deleting Customer Data, and processing it as the services require |
| Purpose | To provide, secure, support, and maintain the services for the Customer |
| Categories of data subjects | Determined by the Customer. Typically the Customer's end users, customers, employees, and contacts |
| Categories of Personal Data | Determined by the Customer. May include identification and contact details, account and authentication data, transaction and financial records, usage and log data, and any other data the Customer stores in the services |
| Special categories | Only if the Customer chooses to store them. The Customer is responsible for having a lawful basis and for configuring appropriate safeguards |
| Frequency | Continuous, for as long as the services are used |
Annex 2: Security Measures
- Encryption in transit: TLS for traffic to the platform edge, and TLS available for connections to managed databases.
- Isolation: Customer workloads run in isolated containers with separate networks per tenant, and access between services on the private network is controlled.
- Encryption of secrets at rest: Environment variables, database credentials, and connection strings are stored in HashiCorp Vault, which encrypts them with AES-256. Other stored credentials are encrypted with AES using a key held in Vault.
- Access control: Access to production systems is limited to authorised Brimble personnel who need it for their role, using individual credentials.
- Monitoring: Infrastructure, workloads, and access are monitored and logged, and alerts are investigated.
- Backups: Managed databases that support backups are backed up automatically, with retention set by plan. Backups are stored separately from the database they protect, and Brimble's backup storage encrypts them at rest.
- Vulnerability management: Systems are patched and updated on a regular basis, and security issues reported through responsible disclosure are investigated.
- Incident response: Security Incidents are handled under the process in Section 8.
- Personnel: Personnel with access to Customer Data are bound by confidentiality obligations.