This Data Processing Agreement ("DPA") forms part of the TriageFlow Terms of Service between the customer (the "Controller") and Universal Global Services Ltd (Company No. 17423506, the "Processor").
This DPA applies to personal data processed by TriageFlow on behalf of the Controller, including account data, repository metadata and issue content used for triage. To the extent the Controller is a business customer, the Processor acts as a data processor; where the Controller is an individual consumer, the Privacy Policy applies instead.
The Processor processes personal data only on documented instructions from the Controller, unless required otherwise by law. The subject matter is the provision of AI-assisted issue triage, prioritisation and automation for the Controller repositories.
The Processor uses sub-processors including GitHub (sign-in and repository integration), Stripe (payments and tax), and hosting, networking and LLM/AI infrastructure providers. The Processor remains responsible for its sub-processors and will inform the Controller of material changes through the Service.
The Processor implements appropriate technical and organisational measures including encryption in transit, access controls, secret scanning, backups and monitoring.
The Processor will assist the Controller in responding to data subject requests and in complying with obligations under applicable data protection law.
The Processor will notify the Controller without undue delay after becoming aware of a personal data breach affecting Controller data.
To the extent personal data is transferred outside the UK or EEA, transfers are protected by UK or EU Standard Contractual Clauses or an equivalent lawful transfer mechanism. Where the Controller requires the standard contractual clauses to be executed, the Processor will provide them on request.
On termination of the Service, the Processor will delete or return personal data at the choice of the Controller, subject to retention obligations under applicable law.
The Processor will make available information reasonably necessary to demonstrate compliance with this DPA and will allow for audits as required by applicable data protection law, subject to confidentiality.
Last updated: 13 September 2026.