Data Processing Agreement for Direct Sales (DPA)

Last updated: 2026

This Data Processing Agreement ("DPA") forms part of the agreement governing the provision of the Services (the "Agreement") between:

  • The applicable Varnish Software entity set forth in the Agreement ("Varnish", "Processor"), and

  • The customer entity identified in the Agreement ("Customer", "Controller").

This DPA is entered into pursuant to Article 28 of the EU General Data Protection Regulation (Regulation (EU) 2016/679) (“GDPR”). It applies to the processing of Personal Data by Varnish as a Data Processor on behalf of the Customer (acting as Data Controller) in connection with the self-hosted software and related support services.

1. Definitions 

Capitalised terms not defined in this DPA shall have the meaning set out in the GDPR.

  • "Controller" means the Customer that determines the purposes and means of processing.

  • "Processor" means Varnish, who processes Personal Data on behalf of the Controller.

  • "Sub-processor" means any third party engaged by Varnish to assist in fulfilling its support and business operation obligations under the Agreement.

  • "Personal Data" means any information relating to an identified or identifiable natural person. 

  • "Administrative Data" means the categories of personal data processed by Varnish as an independent Controller for its own business purposes, as further described in Varnish's Privacy Policy, as updated from time to time.

2. Roles of the Parties

2.1 Roles of the Parties: The parties acknowledge that for any Personal Data processed under this DPA, the Customer acts as the Data Controller and Varnish acts as the Data Processor.

2.2 Documented Instructions: Varnish processes Personal Data solely on the Customer’s documented instructions. The Customer warrants that all instructions provided to Varnish are lawful and in accordance with applicable data protection laws. 

2.3 Independent Controller Processing: This DPA does not apply to Administrative Data processed by Varnish as an independent controller.

3. Categories of Data Subjects and Personal Data

3.1 Data Subjects: The Customer’s employees, administrators, or network users whose data may be captured in system logs, support tickets, or diagnostic materials provided to Varnish.

3.2 Categories of Personal Data:

  • IP addresses and usernames embedded in system logs or support tickets

  • Technical diagnostic information and system configuration files

  • Varnishgather archives and crash dumps uploaded for troubleshooting

  • Contact details of Customer administrators accessing support systems

Varnish does not intentionally process special categories of personal data under Article 9 GDPR.

4. Processing Overview

The processing is limited to what is necessary to provide technical support and maintain the self-hosted software in accordance with the Agreement. Varnish processes Personal Data solely for the purpose of:

  • providing technical support and customer assistance,

  • diagnosing software issues, bugs, and performance problems,

  • validating software licenses and software entitlements, and

  • maintaining secure support channels and issue tracking tools.

5. Customer Obligations

The Customer represents and warrants that:

  • it has a valid legal basis under applicable data protection laws for providing Personal Data to Varnish.

  • its instructions to Varnish comply with GDPR and other applicable data protection laws; and

  • it will not instruct Varnish to process Personal Data in a manner that violates applicable law.

  • it shall ensure that it sanitizes, redacts, or anonymizes any Personally Identifiable Information (PII) from log files, crash dumps, and varnishgather archives before uploading or transferring them to Varnish support.

6. Duration and Deletion of Data

Processing of Personal Data shall continue for the duration of the Agreement. Upon resolution of a support ticket or termination of the Agreement, Varnish shall delete or destroy support archives, varnishgather output, and log files provided by Customer within 30 days, unless longer retention is required by law.

7. Security Measures

Varnish security measures can be found at https://www.varnish-software.com/legal-compliance/

8. Confidentiality

Varnish ensures that all personnel authorised to process Personal Data are subject to appropriate confidentiality obligations and access such data only as necessary to perform the Services.

9. Sub-processing

9.1 Authorized Sub-processors: Customer grants general written authorization to Varnish to engage Sub-processors for support ticket management, CRM, and business operations tools (such as Zendesk or Jira). The current list of Sub-processors is available upon request or is specified in Varnish's Privacy Policy.

9.2 Sub-processor Obligations: Varnish shall ensure that Sub-processors are bound by written agreements imposing data protection obligations no less protective than those set out in this DPA.Varnish remains fully liable for the performance of its Sub-processors’ obligations.

9.3 Changes to Sub-processors: Varnish shall provide advance notice of any material changes to its Sub-processors.

10. Data Transfers

Personal Data provided during support interactions shall be stored and processed within the EU/EEA or other countries providing an adequate level of data protection. Where support tools or sub-processors transfer data outside the EU/EEA, such transfers shall rely directly on an applicable adequacy decision pursuant to Article 45 GDPR or be governed by Standard Contractual Clauses pursuant to Article 46 GDPR.

11. Assistance

Varnish shall, taking into account the nature of processing and to the extent technically feasible, assist the Customer in complying with its obligations under the GDPR, including with respect to responding to data subject requests under Articles 12–23 GDPR and meeting obligations relating to security, personal data breaches, data protection impact assessments, and consultations with supervisory authorities, provided that such assistance will be performed at the Customer’s cost.

12. Personal Data Breach

Varnish shall notify the Customer without undue delay, and in any event within 72 hours after becoming aware of a Personal Data Breach affecting Personal Data processed on behalf of Customer, and shall provide information reasonably necessary for the Customer to comply with its legal obligations.

13. Audit

Upon at least two (2) months’ prior written notice from the Customer, Varnish shall make available relevant documentation or certifications demonstrating compliance with this DPA. Audits shall be limited to processing of Personal Data under this DPA and reasonably necessary to verify compliance. Audits shall be carried out by the Customer and shall not unreasonably interfere with Varnish’s operations or service delivery. The Customer shall treat all non-public information obtained during the audit as confidential. Any audit shall be conducted at the Customer’s expense and shall not occur more than once per calendar year.

14. Liability

Liability arising under this DPA shall be subject to the limitations set out in the Agreement.

15. Order of Precedence

In the event of conflict between this DPA and the Agreement, this DPA shall prevail with respect to data protection matters.

16. Governing Law and Dispute Resolution

This DPA shall be governed by the laws and jurisdiction set out in the Agreement, which contains all relevant provisions regarding governing law and dispute resolution.

17. Changes to this DPA

Varnish may update this DPA from time to time to reflect changes in applicable law (including data protection law), industry standards, or updates to the Services/Offering, with such changes taking effect upon publication. For material changes, including any material changes to its Sub-processors, Varnish will use reasonable efforts to provide at least 30 days’ prior notice. What constitutes a material change shall otherwise be determined at Varnish’s reasonable discretion. Any objections to proposed Sub-processor changes must be presented timely and based on reasonable, documented data-protection grounds.

Request a free trial