pikapod

← All documents

Data processing agreement

Version of 13 August 2026.

This agreement covers the personal data your forge holds, where you decide what happens to it and we act on your instructions. It is Article 28 of the General Data Protection Regulation, and it applies automatically from the moment you have an instance — there is nothing to sign and nothing to request. Data about you as our customer is the privacy policy, where we are the controller.

If your organisation needs this executed as a signed document on your own paper, email us and we will sign yours.

1. The parties

Controller: you, the account holder.

Processor:

The provider's registered name and address are not published here yet. Until they are, this service is not being offered for sale, and the address below is the way to reach whoever is operating it.

Email: support@forgejo.dc-analytic.com

2. What is processed, and why

Subject matter
Hosting and operating a dedicated Forgejo instance for you.
Duration
For as long as you have an instance, plus the 30-day retention window in section 8.
Nature of the processing
Storage, transmission, backup, restoration, and deletion. We run the machine your forge is on and the storage its data sits on. We do not read it, index it, analyse it, or use it to train anything.
Categories of data subject
Whoever you give access to your forge: your staff, contractors, collaborators, and anyone whose details end up in a repository, an issue or a commit. You decide who they are; we do not.
Categories of personal data
Account names, email addresses, credentials and tokens held by your forge; commit and issue authorship; whatever your users write; and anything you choose to store in a repository. If that includes special categories of data, that is your decision and your responsibility — the instance is technically capable of it and we have no way to know.

3. Our instructions

We process this data only on your documented instructions. Your instructions are: these terms, the actions you take in the portal, and anything you ask us to do in writing. If we are ever legally required to process it otherwise, we will tell you before doing so unless the law forbids us from telling you.

If we think an instruction breaks data protection law, we will say so rather than quietly carry it out.

4. Confidentiality and access

Everyone with access is bound to confidentiality. Access is limited to the people who operate the platform, and only for operating it.

Be clear about what that means technically, because a vaguer statement would be a more comfortable one:

5. Security measures

6. Restore drills — read this one

A backup nobody has restored is a hope. So the platform is built to prove them: on a nightly schedule it restores a backup into a temporary machine, boots it, checks it, and destroys it. Its own forge is drilled every night, and a customer instance is drilled whenever none has been drilled in the past seven days — the one that has gone longest without.

There are two copies of every backup, and one night in seven the platform drills the second one — the copy at the other provider — by downloading it back in full before it boots anything. That deeper drill is only ever run against our own forge, never against a customer's: proving that the second copy comes back is a question about the machinery, and we would rather answer it with our data than move yours across the internet to do it. A drill of your instance reads the copy that is already on the host it lives on.

Where this stands today: the schedule and the drill are built and tested, and neither has yet run on the production hosts. So no copy of your data has been made this way yet. It is disclosed here before it happens rather than after, which is the only order in which disclosure is worth anything — and the service levels page carries the same fact in the table of what we have and have not rehearsed.

This means a copy of your instance's data may be restored into a scratch environment without you asking. When it happens: the copy is made on the same host, from the copy of the backup already on that host, inside the same encryption boundary; it is not reachable from the internet; nobody reads its contents; and it is destroyed when the drill finishes. Nothing leaves the platform and nothing leaves the EU.

We could have written this in a way you would not have noticed. We would rather you can decide whether it is acceptable, because it is a real processing activity that you did not individually instruct.

7. Subprocessors

You give general authorisation for us to use subprocessors. Every one of them is listed, with what they do and where, on the subprocessor page, which is public and needs no account to read.

Each is bound by a contract imposing the same obligations as this one, and we remain responsible to you for what they do. We will give you at least 30 days' notice by email before adding or replacing one. If you object on reasonable data protection grounds, tell us within those 30 days: we will look for another way, and if there is none you may terminate and get back the unused part of what you have paid.

8. Deletion and return

Your data and its backups are kept for 30 days from the moment an instance is suspended — for non-payment, on cancellation, or because you asked us to delete it — and are then permanently destroyed, in both backup repositories.

That is the same period as in the terms of service: there is one retention period, and it is this one.

Throughout the window you can export a complete copy from the portal, and export works while an instance is suspended so that it survives the moment you stop paying. If you would like it destroyed sooner than 30 days, ask.

One exception we would rather name than have you find: a logo or favicon you uploaded through the branding panel is currently not removed when an instance is purged. It is an image you chose to publish on your own forge, it is held on the platform's own host, and it is deleted on request. We are fixing it.

9. Data subject requests

Requests from your users go to you: it is your forge, your relationship, and your instance's own administration tools are where the data is. If somebody sends one to us we will pass it on to you rather than act on it, and we will help you answer it — including with the export, which is the fastest complete answer to a portability request that exists.

10. Breaches

We will tell you without undue delay after becoming aware of a personal data breach affecting your instance, with what we know at the time: what happened, which data was involved, what the likely consequences are, and what we have done. We will not wait for a complete picture before telling you — you have your own 72-hour clock, and it starts when we tell you.

11. Audits

You are entitled to information demonstrating that we meet these obligations. Ask, and we will answer specifically, in writing. For an audit or an inspection, we will agree a scope that does not put other customers' data at risk; a reasonable-cost audit once in any twelve months is fine, and more than that we will discuss.

12. Transfers outside the EU

Your instance's data — repositories, database, backups — is processed in the EU and does not leave it. Two suppliers with United States parents are used for email and for payments; what they see is described on the subprocessor page, and transfers to them are made under the European Commission's standard contractual clauses.

13. Liability and precedence

This agreement takes precedence over the terms of service on anything to do with personal data. The liability limits in those terms apply to this agreement, except where the GDPR does not permit them to.