Data Processing Addendum
Where you use logg to handle other people's personal data — subscriber addresses, contributor names — you are the controller and we are your processor. This addendum sets out the terms of that, as Article 28 UK GDPR and EU GDPR require. It forms part of the Terms of Service and needs no signature.
Last updated 21 August 2026
1. Definitions
“Data Protection Law” means the UK GDPR, the Data Protection Act 2018, the EU GDPR (Regulation 2016/679) and any law that implements or supplements them, each as it applies. “Customer Personal Data” means personal data that we process on your behalf in providing the Service, as described in Annex 1. “Controller”, “processor”, “data subject”, “personal data breach” and “processing” have the meanings given in Data Protection Law. “Customer” and “you” mean the account holder or organisation that agreed to the Terms of Service.
2. Roles and scope
For Customer Personal Data you are the controller and [COMPANY LEGAL NAME] Ltd is the processor. For the personal data of account holders themselves we are an independent controller, as described in the Privacy Policy, and this addendum does not apply to it.
3. Your instructions
We process Customer Personal Data only on your documented instructions. The Terms, this addendum, and your use of the Service’s features (enabling subscriptions, connecting a repository, configuring a digest) are those instructions. We will tell you if we believe an instruction infringes Data Protection Law, and we may process the data where the law we are subject to requires it, in which case we will inform you unless the law forbids it.
4. Your obligations
You are responsible for the lawfulness of the Customer Personal Data you bring to the Service: for having a lawful basis, for giving data subjects the information they are owed, and for keeping your subscriber list to people who asked to be on it, as the Acceptable Use Policy requires.
5. Confidentiality
We ensure that anyone we authorise to process Customer Personal Data is bound by a duty of confidentiality, and processes it only as necessary to provide the Service.
6. Security
We implement the technical and organisational measures described in Annex 2, and keep them under review so that they remain appropriate to the risk.
7. Subprocessors
You give general authorisation for us to engage the subprocessors listed on the Subprocessors page. We impose on each of them data-protection obligations no less protective than those in this addendum, and we remain responsible for their performance. We will post changes to that list at least 14 days before a new subprocessor processes Customer Personal Data; during that period you may object on reasonable data-protection grounds by emailing privacy@logg.sh, and if we cannot resolve the objection you may terminate the affected part of the Service and receive a pro-rata refund of prepaid fees.
8. Data subject requests
Taking into account the nature of the processing, we help you meet your obligations to respond to data subjects by providing unsubscribe links in every subscriber email, subscriber management in the dashboard, and by forwarding to you without undue delay any request we receive that concerns your Customer Personal Data. We do not respond to such requests ourselves except to direct the person to you, unless the law requires otherwise.
9. Assistance
We assist you, to the extent reasonable given the information available to us, with data protection impact assessments and prior consultation with a supervisory authority where they concern the Service.
10. Personal data breaches
We notify you without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data, and give you the information we have about its nature, the data and data subjects concerned, its likely consequences and the measures taken or proposed. We will not notify the data subjects on your behalf unless you ask us to.
11. International transfers
We process Customer Personal Data in the United Kingdom and, through subprocessors, in the countries listed on the Subprocessors page. Where a transfer from the UK or the EEA is restricted under Data Protection Law we ensure it is covered by an adequacy decision or by appropriate safeguards. For those transfers the EU Standard Contractual Clauses (Commission Decision 2021/914, Module 2, controller-to-processor) and, for UK transfers, the UK International Data Transfer Addendum to them are incorporated into this addendum by reference, with you as data exporter and us as data importer, the optional docking clause included, the option under Clause 17 set to the law of Ireland, and Clause 13 to the supervisory authority of your establishment. The Annexes to this addendum serve as the Annexes to those clauses.
12. Deletion and return
You can export your data from the Service at any time. When the Service ends, or when you delete a project, organisation or account, we delete the Customer Personal Data within 30 days, and it persists only in backups for up to 30 further days before those backups are overwritten, unless the law requires us to retain it.
13. Audit
We make available the information needed to demonstrate our compliance with this addendum. Where that is not sufficient to meet a legal requirement you have, we allow an audit by you or an independent auditor you appoint, no more than once in any twelve months, on at least 30 days’ notice, at your cost, under confidentiality, and during normal business hours in a way that does not disrupt the Service.
14. Liability and precedence
Liability under this addendum is subject to the limitations in the Terms of Service. If this addendum conflicts with the Terms, this addendum prevails for the processing of Customer Personal Data. The addendum lasts as long as we process Customer Personal Data for you.
Annex 1 — Details of processing
| Item | Description |
|---|---|
| Subject matter | Provision of the logg changelog service to the Customer. |
| Duration | The life of the Customer's account, plus the deletion period in section 12. |
| Nature and purpose | Hosting, storing, and generating changelog content from repository data; storing subscriber addresses and sending them the emails the Customer configures; posting notifications to channels the Customer connects. |
| Categories of data subjects | People who subscribe to the Customer's changelog; contributors to the Customer's repositories; the Customer's staff and members. |
| Categories of personal data | Email addresses, confirmation status and preferences of subscribers; names, usernames and email addresses of contributors as they appear in commits, pull requests and issues; names and handles of members. |
| Special categories | None are intended or required. The Customer must not submit them. |
| Frequency | Continuous, for as long as the Service is used. |
Annex 2 — Technical and organisational measures
- Encryption of all data in transit (TLS 1.2 or higher).
- Encryption of stored access tokens (AES-256-GCM) with a key held outside the database; sign-in links stored only as SHA-256 hashes.
- Session cookies that are HTTP-only, secure, same-site, and expire.
- Role-based access within organisations (owner, admin, member) and authorisation checks on every request.
- Rate limiting on public and authentication endpoints.
- An append-only audit log of significant actions.
- Production access restricted to named operators, over authenticated, encrypted channels, with intrusion detection and automatic blocking of hostile sources on the server.
- Secrets held only in the server environment, never in source control or container images.
- Automated deployment of only those builds that passed type checks, linting and tests.
- Regular database backups, retained for a limited period and then overwritten.
- Subprocessors bound by written data-protection terms.