This Data Processing Addendum (“DPA”) is between the customer identified on the Valgrind account (“Controller”) and Archstone Labs Ltd (company number 17041943) (“Processor”). Registered office: 20 Wenlock Road, London, N1 7GU, United Kingdom. It is effective from 12 October 2026 and forms part of the Terms of Service.
If the parties sign a separate DPA, that signed DPA prevails to the extent of conflict.
1. Roles
Controller determines the purposes and means of processing Customer Content. Processor processes Customer Content only on documented instructions from Controller, including this DPA, product settings, and the Terms, unless Union or UK law requires otherwise.
2. Details of processing
| Item | Description |
|---|---|
| Subject matter | Hosting and processing workspace records so Controller can use Valgrind |
| Duration | The term of the Valgrind subscription, plus deletion or return as below |
| Nature and purpose | Storage, retrieval, display, sharing, audit logging, backup, support, AI agents acting on Controller’s instruction, and Verify checks via an identity-verification provider |
| Types of personal data | As submitted by Controller: identity and contact data, email and calendar, files, voice notes, call recordings, share-link data, legal-hold records, and Verify identity data (documents, selfies, liveness, screening results) |
| Data subjects | Controller’s staff, contacts, company representatives, people Controller verifies, and other people Controller chooses to store |
3. Processor obligations
- Process only on Controller’s instructions.
- Ensure persons authorised to process Customer Content are bound by confidentiality.
- Implement appropriate technical and organisational measures (Art. 32), including encryption in transit, encrypted storage, access control, authentication, audit logging, and controls so Processor staff cannot assume a Controller identity in the ordinary course.
- Not engage a subprocessor except as section 4.
- Assist Controller with data-subject requests, DPIAs, and consultations with supervisory authorities, considering the nature of processing.
- Notify Controller without undue delay after becoming aware of a personal-data breach affecting Customer Content.
- Delete or return Customer Content at the end of the service, at Controller’s choice, and delete existing copies unless law requires storage.
- Make available information reasonably necessary to demonstrate compliance and allow audits as section 7.
4. Subprocessors
Controller authorises Processor to use the subprocessors listed on the Subprocessors page. Processor will impose data-protection terms no less protective than this DPA. Processor remains responsible for subprocessors.
Processor will post a change before appointing a new subprocessor. Controller may object on reasonable data-protection grounds within 14 days. If the parties cannot resolve the objection, Controller may terminate the affected service.
5. International transfers
The default service uses subprocessors in the United States and the EEA. Where Processor or a subprocessor transfers Customer Content outside the UK or EEA, Processor will ensure a valid transfer mechanism, including the UK International Data Transfer Addendum and EU Standard Contractual Clauses. A custom EU-residency arrangement, if offered, is a separate enterprise contract.
6. Controller obligations
Controller warrants it has a lawful basis for Customer Content, will not instruct Processor to process unlawfully, and will configure the product (including legal hold, sharing, and retention) in line with its own policies.
7. Audits
Processor will provide reasonably requested information about security measures. On 30 days’ notice, not more than once per year unless a confirmed breach, Controller may audit Processor’s relevant controls, or accept a current independent report if Processor offers one. Audits must not unreasonably disrupt operations or expose other customers’ data.
8. Liability
Liability under this DPA is subject to the limitations in the Terms of Service, except that those limitations do not apply to a party’s liability to data subjects where the law does not allow that cap.
9. Verify
Where Controller uses Valgrind Verify, Controller remains controller of the people and companies checked. Processor engages an identity-verification provider as a subprocessor for KYC, KYB, and AML infrastructure. That provider’s DPA and end-user identity terms apply to that processing. Processor will name the current provider to Controller on request. Controller is responsible for its own AML programme and lawful basis, including biometrics.
10. Contact
privacy@valgrind.io or support@valgrind.io