Dew Data Processing Agreement
Effective date: 30 September 2026
This Data Processing Agreement (“DPA”) is part of the Dew Terms & Conditions (“Terms”) between the customer (“Customer”, controller) and Trinode ApS, Kaersangervej 6, DK-8300 Odder, Denmark, CVR DK46248333 (“Trinode”, processor). It meets the requirements of Article 28(3) of the General Data Protection Regulation (EU) 2016/679 (“GDPR”).
1. Scope
Dew is self-hosted. Using the Dew software does not make Trinode a processor of the Customer’s data, because that data stays on infrastructure the Customer controls.
This DPA applies only when Trinode processes personal data for which the Customer is controller while providing support:
- material the Customer sends, such as a Dew diagnostic report, log extracts, screenshots, configuration exports, or files attached to a support request;
- data Trinode can see or access while the Customer gives Trinode access to its Dew installation, for example through a screen-sharing session or remote access to its server.
It does not cover data Trinode processes as its own controller, such as the Customer’s contact details, billing records and license records. The Dew Privacy Policy covers those.
2. Details of the processing
| Subject matter | Investigating and resolving the Customer’s support requests |
| Duration | For as long as a support request is open, then until deletion under section 10 |
| Nature | Receiving, storing, viewing and analyzing material the Customer sends; viewing and operating the Customer’s Dew installation while the Customer gives access |
| Purpose | Providing support under the Terms |
| Types of personal data | Whatever the material contains, typically: names, email addresses, IP addresses, user agents, file names and share-link activity in access and audit logs, and account settings |
| Special categories | None intended. The Customer must not send special-category data (GDPR Article 9) unless it is necessary for the request. |
| Data subjects | The Customer’s Dew users, administrators, and people who send or receive files through the Customer’s Dew installation |
3. Instructions
Trinode processes the personal data only on the Customer’s documented instructions. The Terms, this DPA and the Customer’s support request are those instructions. Trinode does not process the data for any other purpose, including product analytics or training.
If Trinode believes an instruction infringes the GDPR or other data-protection law, it will tell the Customer promptly.
If EU or member-state law requires Trinode to process the data in another way, Trinode will tell the Customer first, unless that law prohibits it.
4. Confidentiality
Only personnel who need the data to resolve the request can access it. They are bound by a duty of confidentiality.
5. Security
Trinode applies appropriate technical and organizational measures under GDPR Article 32. Support material is kept in Trinode’s email system, which encrypts data in transit and at rest.
Dew diagnostic reports mask email addresses in application logs before download. The Customer should still review material and remove what is not needed before sending it.
When the Customer gives Trinode access to its installation, the Customer decides the scope and duration of that access and can end it at any time. Trinode uses the access only for the support request, and copies data out of the installation only when the request needs it and the Customer agrees. Such copies are support material under section 10.
6. Sub-processors
The Customer gives general authorization for Trinode to use sub-processors. Current sub-processors:
| Sub-processor | Service | Location |
|---|---|---|
| Microsoft Ireland Operations Limited | Email and support correspondence (Microsoft 365) | EU (Microsoft EU Data Boundary) |
Trinode will inform the Customer in advance of any intended addition or replacement, giving the Customer a reasonable period to object.
Trinode imposes the same data-protection obligations as in this DPA on each sub-processor by contract, and remains liable to the Customer for its sub-processors’ performance.
7. International transfers
Trinode processes support data in the EU/EEA. Where a sub-processor transfers data outside the EEA, the transfer is covered by an adequacy decision or the EU Standard Contractual Clauses. For Microsoft, those are its certification under the EU-U.S. Data Privacy Framework and the Standard Contractual Clauses in its Data Protection Addendum.
8. Assistance
Taking into account the nature of the processing, Trinode will help the Customer:
- respond to requests from data subjects exercising their rights under GDPR Chapter III. Trinode forwards any such request it receives directly and does not answer it itself;
- meet its obligations under GDPR Articles 32 to 36, including security, breach notification, data-protection impact assessments and prior consultation.
9. Personal data breaches
Trinode will notify the Customer without undue delay after becoming aware of a personal data breach affecting the Customer’s data. The notice will include the information the Customer needs under GDPR Article 33(3), as far as it is available at that time.
10. Deletion
Trinode deletes support material containing personal data no later than 90 days after the support request is closed, and in any case when the Terms end, unless EU or member-state law requires it to be kept. The Customer may ask for earlier deletion at any time. Returning the data is not relevant, because the Customer keeps the originals on its own infrastructure.
11. Information and audits
Trinode will make available to the Customer the information needed to demonstrate compliance with this DPA. Trinode will allow and contribute to audits, including inspections, by the Customer or an auditor it appoints.
Audits require 30 days’ written notice, take place during business hours, at most once a year unless a supervisory authority requires otherwise or following a personal data breach, and are at the Customer’s cost. Auditors must be bound by confidentiality.
12. General
This DPA stays in force while Trinode holds personal data under it. The Terms govern liability, governing law and jurisdiction. If this DPA and the Terms conflict on data protection, this DPA prevails.
13. Contact
Privacy: privacy@getdew.io Support: support@getdew.io