Version 2.0 · Effective 2026-10-19
This data processing agreement (the DPA) applies between Berserk AB, reg. no. 559603-5179, Sweden, for itself and on behalf of each other member of the Berserk Group (each of them, and all of them together, the Provider), and the customer named in an Order Form that incorporates the General Terms (the Customer). The Provider and the Customer are jointly referred to as the Parties and each individually as a Party.
This DPA is the instrument by which the Provider becomes the processor of Personal Data on the Customer's documented instructions, with the Customer remaining the controller under Article 4(7) of the General Data Protection Regulation (Regulation (EU) 2016/679) (the GDPR). It applies whenever the Provider processes Personal Data on the Customer's behalf under the Agreement, namely: (a) where the Provider operates the Managed Service for the Customer; and (b) where the Customer runs the Software in the Customer Environment and, in connection with support, shares Customer Content with the Provider or gives the Provider access to the Customer Environment (a Support Engagement).
This DPA forms part of the Agreement under Section 7.1 of the Berserk General Terms published at bzrk.dev/legal/general-terms (the General Terms). It applies by incorporation through the Order Form signed by the Parties and needs no separate signature. The version of this DPA published on the date of an Order Form applies to that Order Form. Later versions apply only if the Parties agree in writing.
Capitalised terms used but not defined in this DPA, including Agreement, Applicable Laws, Berserk Group, Customer Content, Customer Environment, Export Period, Fees, Managed Service, Order Form, Personal Data, Product, Software and Subscription Period, have the meanings given in the General Terms or, failing that, in the GDPR. Berserk AB enters into this DPA for itself and on behalf of each other member of the Berserk Group, and is responsible to the Customer for the performance of this DPA by each of them.
Notices and instructions to the Provider under this DPA are sent to legal@bzrk.dev, as provided in the General Terms.
1.1 Subject matter: For a Managed Service, the Provider processes Personal Data on the Customer's instructions in operating the managed Berserk instance provided under the Order Form and the General Terms. For a Support Engagement, the Provider processes Personal Data on the Customer's instructions in connection with the Support Engagement.
1.2 Duration: For a Managed Service, the Subscription Period under the Order Form, plus the deletion period under the Agreement. For a Support Engagement, the duration of the Support Engagement, plus any post-termination handover period.
1.3 Nature and purpose: For a Managed Service, hosting, storage, indexing and making available for search and querying of the telemetry (logs, metrics and traces) that the Customer sends to the instance, and operation and support of the instance. For a Support Engagement, diagnostic review of telemetry the Customer shares, and assistance with deployment, debugging or operations.
1.4 Type of Personal Data: As determined by the telemetry the Customer sends to the instance or selects when sharing telemetry with the Provider, which may include IP addresses, user, account and session identifiers, email addresses, hostnames and free-text content such as log messages. The Provider does not pre-define the categories.
1.5 Categories of data subjects: Determined by the Customer (typically the Customer's employees and contractors, users of the Customer's systems, and system identifiers).
2.1 The Customer is the controller (or, where the Customer is itself a processor for an upstream entity, the processor, in which case the Provider acts as sub-processor).
2.2 The Provider is the processor, acting only on the Customer's documented instructions.
2.3 This DPA does not apply to Personal Data that members of the Berserk Group process as controller to operate, secure and support their own systems, including user account details, the operational logs of the instance's own services and contact details of the Customer's personnel. That processing is governed by the Berserk Group's privacy notice.
The Customer gives the Provider the following documented instructions.
3.1 Process the Personal Data only for providing the Managed Service and related support, or for the Support Engagement, under the Agreement.
3.2 For a Managed Service, retain the Personal Data for the retention period stated in the Order Form and delete it in accordance with the Agreement. On termination, return or delete the Personal Data on the Customer's instruction. For a Support Engagement, do not retain Personal Data beyond the engagement's reasonable handover period. On closure of the Support Engagement, return or delete the Personal Data on the Customer's instruction.
3.3 For a Managed Service, process the Personal Data in the data region or regions stated in or agreed under the Order Form, which the Customer hereby instructs, and do not process it in any other region without the Customer's prior written instruction. A region added under the Order Form is a written instruction for the purposes of this DPA.
3.4 For a Support Engagement, do not transfer Personal Data outside the EU/EEA, other than to a country covered by an adequacy decision of the European Commission, without the Customer's prior written instruction.
3.5 Additional instructions may be given in writing, including by email to legal@bzrk.dev.
3.6 Customer Content of a Managed Service is hosted in the regions agreed under the Order Form. Authorised personnel of the Berserk Group in Denmark and Sweden may access the instance to operate and support it. Personal Data shared in a Support Engagement is processed as described for support engagements on the sub-processor page (Section 6.1).
4.1 The Provider processes Personal Data only on the documented instructions of the Customer, including with regard to international transfers, unless required to do otherwise by Union or Member State law to which the Provider is subject, in which case the Provider informs the Customer before processing, unless that law prohibits such information.
4.2 The Provider ensures that persons authorised to process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
4.3 The Provider implements the technical and organisational measures described in Annex A.
4.4 The Provider engages sub-processors only with the Customer's prior general authorisation, subject to the change-notification mechanism in Section 6 (Sub-processors).
4.5 The Provider assists the Customer, where reasonable, in fulfilling its obligations to respond to requests from data subjects exercising their GDPR rights. The Provider is not obliged to respond to a data subject directly and may refer the data subject to the Customer.
4.6 The Provider assists the Customer in ensuring compliance with Articles 32 to 36 of the GDPR (security, breach notification, data protection impact assessment and prior consultation), taking into account the nature of processing and the information available to the Provider.
4.7 At the Customer's choice, the Provider deletes or returns all Personal Data after the end of the provision of the services, and deletes existing copies, unless storage is required by Union or Member State law. Copies held in back-ups are deleted in the ordinary back-up cycle and remain protected under this DPA until deleted.
4.8 The Provider makes available to the Customer all information necessary to demonstrate compliance with these obligations, and allows for and contributes to audits in accordance with Section 8 (Audit).
4.9 For a Managed Service, the Provider maintains the access log set out in Annex B for any access by its personnel to the Customer's Personal Data outside normal operation of the instance. For a Support Engagement, the Provider maintains the data-sharing log set out in Annex B.
5.1 If the Provider becomes aware of a personal-data breach affecting the Customer's data, the Provider notifies the Customer without undue delay, with a target of no more than twenty-four (24) hours from awareness. The notification includes, to the extent known at the time: (a) the nature of the breach; (b) the categories and approximate number of data subjects and records affected; (c) the likely consequences; and (d) the measures the Provider has taken or proposes to take. Notification of a breach is not an admission of fault or liability.
5.2 This commitment supplements the Customer's own obligations under Article 33 of the GDPR to its supervisory authority. The Provider maintains an internal breach-notification procedure aligned with this commitment, which is available to the Customer on request.
6.1 The Customer authorises the Provider to engage the sub-processors listed on the Provider's sub-processor page at bzrk.dev/legal/sub-processors (the sub-processor page), which forms part of this DPA. For a Managed Service, the sub-processor is the cloud provider listed on the sub-processor page that hosts the instance in the data region stated in the Order Form. For a Support Engagement, the sub-processors are those listed for support engagements on the sub-processor page. The Provider imposes substantially equivalent data-protection obligations on each sub-processor. Members of the Berserk Group are part of the Provider and are not sub-processors.
6.2 The Provider notifies the Customer of any intended change concerning the addition or replacement of a sub-processor at least thirty (30) days before the change, and allows the Customer to object on reasonable security or compliance grounds during the notice period, and the Parties shall in good faith agree on a resolution. If the Parties have not resolved an objection by the end of the notice period, the Customer may, on written notice, terminate the affected Order Form or end the affected Support Engagement. On termination of an Order Form the Provider refunds any prepaid Fees for the period after termination. The Provider offers a means of subscribing to updates to the sub-processor page.
6.3 Where the Customer enables the AI assistant in the Product, the Product sends the prompts and the data the Customer selects to the model provider the Customer configures, using the Customer's own credentials. That provider is engaged by the Customer and is not a sub-processor of the Provider.
7.1 For a Managed Service, processing in a data region outside the European Economic Area, including the United States, involves a transfer of Personal Data to that country. For such transfers the Provider relies on the Standard Contractual Clauses in Commission Implementing Decision (EU) 2021/914 (Module Three, processor to processor) as incorporated in the sub-processor's data processing terms, and on any applicable adequacy decision. A cloud provider not listed on the sub-processor page is a new sub-processor and is subject to Section 6 (Sub-processors). The Provider does not transfer Personal Data to any other third country without the Customer's prior written instruction.
7.2 For a Support Engagement, a transfer to a country covered by an adequacy decision relies on that decision. Where any other transfer outside the EU/EEA is necessary and the Customer instructs it under Section 3.4, the Provider relies on the appropriate transfer mechanism, being the Standard Contractual Clauses in Commission Implementing Decision (EU) 2021/914 or the destination country's adequacy decision.
7.3 Where the Customer is established in the United Kingdom, references in this DPA to the GDPR include the UK GDPR and the Data Protection Act 2018. If a transfer mechanism relied on under this DPA is invalidated or replaced, or Applicable Laws on data protection change, the Parties shall negotiate in good faith the amendments needed to maintain compliance.
8.1 The Customer may, no more than once per year, request a remote audit or written attestation from the Provider regarding the technical and organisational measures in Annex A. The Provider responds with the information available, typically the artefacts published at its Trust Overview and the software bills of materials shipped in its container images, and may charge reasonable costs for additional bespoke audit work.
8.2 In addition, the Provider allows for and contributes to audits, including inspections, by the Customer or an independent auditor mandated by the Customer, where Applicable Laws or a supervisory authority require an audit or inspection beyond the process in Section 8.1. Such an audit takes place on reasonable prior notice, during normal business hours, subject to confidentiality obligations and the Provider's security policies, and without unreasonable interference with the Provider's business. The Provider cooperates with any audit or inspection by a supervisory authority.
Liability under this DPA is governed by the Agreement. Where the Agreement does not specify, Swedish law applies.
This DPA is in force for the duration of the Agreement and for any further period during which the Provider processes the Personal Data, including the Export Period. The sections governing breach notification, return and deletion, audit and liability survive termination to the extent necessary.
11.1 This DPA shall be governed by and construed in accordance with the substantive law of Sweden, without regard to its conflict-of-law rules.
11.2 Any dispute, controversy or claim arising out of or in connection with this DPA, or the breach, termination or invalidity thereof, shall be finally settled by arbitration in accordance with the Arbitration Rules of the SCC Arbitration Institute. The seat of arbitration shall be Stockholm. The language to be used in the arbitral proceedings shall be English.
These measures reflect the Provider's controls as of the effective date of this version of the DPA. The current version is published at the Provider's Trust Overview and Security Whitepaper. Items expressed as being "on the roadmap" are planned and not yet implemented.
| Area | Measure |
|---|---|
| Framework alignment | Internal control set mapped to NIS2 Article 21(2) and NIST CSF 2.0. Target profile maintained per CSF function. Mapping available to the Customer under this DPA on request. |
| Encryption in transit | TLS on every external HTTP and gRPC interface. The Rust backend services use rustls (aws-lc-rs backend), and non-Rust surfaces use the hosting provider's TLS termination. For a Managed Service on Google Cloud, internal cluster traffic is over an authenticated and encrypted network overlay. |
| Encryption at rest | For a Managed Service, Provider-managed encryption at rest on the cloud provider's object storage, block storage and managed database for the instance and on the container registry. For a Support Engagement, Personal Data the Customer shares is processed on the assigned engineer's laptop, which is full-disk encrypted. |
| Access control | For a Managed Service, SSH-key authentication and per-user accounts on the underlying infrastructure. One shared administrator account on the instance, used for support. For a Support Engagement, SSH-key authentication and per-user accounts on access to the Customer's environment, with no shared administrator account. Standing access to customer environments is not granted. |
| Authentication | Per-user accounts on Proton, GitHub and other SaaS. Two-factor authentication is enabled on Proton and on personnel GitHub accounts. Broader enforcement (SSH, every cloud console) is on the roadmap. |
| Logging | Per-host SSH logs. Per-service application logs. Aggregated audit logging is on the roadmap. |
| Personnel | Confidentiality obligations in employment contracts. Security-awareness training on onboarding and annually. |
| Incident response | Documented severity matrix and incident-response runbook. Staged-reporting commitments per NIS2 Article 23 and GDPR Article 33. |
| Vulnerability management | Daily dependency-advisory scanning across every ecosystem. CycloneDX 1.6 SBOM in every shipped container image. Coordinated vulnerability disclosure policy. |
| Sub-processors | Listed on the Provider's sub-processor page, with 30-day change notice. |
| Backups | For a Managed Service, object storage is the system of record for telemetry. The instance database is backed up by the cloud provider's managed database service. Recovery is rehearsed annually. |
Managed Service. For each access by the Provider's personnel to the Customer's Personal Data outside normal operation of the instance, the Provider records: (a) the reason; (b) the categories of Personal Data accessed; (c) the date; and (d) the engineer or engineers granted access. The log is available to the Customer on request.
Support Engagement. For each Support Engagement, the Parties record: (a) the engagement reference; (b) the categories of Personal Data shared; (c) the purpose; (d) the sharing and the return or deletion dates; and (e) the engineer or engineers granted access. The log lives in the Customer's preferred system or, by default, the Provider's internal engagement record.
Questions about this DPA may be directed to legal@bzrk.dev.