Data Processing Agreement for Partner (DPA)

Last updated: October 2026

This Data Processing Agreement ("DPA") forms part of the agreement governing the provision of the Services (the "Partner Agreement") between:

• The applicable Varnish Software entity set forth in the Agreement ("Varnish", "Processor"), and

• The partner entity identified in the Partner Agreement ("Partner", "Processor").

This DPA is entered into pursuant to Article 28 of the EU General Data Protection Regulation (Regulation (EU) 2016/679) (“GDPR”). It applies to the processing of Personal Data by Varnish as a Sub-processor on behalf of the Partner (acting as Processor) and the End-User (acting as Controller) in connection with the Services/Offering.

1. Definitions

Capitalised terms not defined in this DPA shall have the meaning set out in the GDPR.

• "Controller" means the End-User (Partner’s customer) that determines the purposes and means of processing.

• "Processor" means the Partner who processes data on behalf of the Controller.

• "Sub-processor" means Varnish or any third party engaged by Varnish to process Personal Data.

• "Personal Data" means any information relating to an identified or identifiable natural person. 

• "Administrative Data" means the categories of personal data processed by Varnish as an independent Controller for its own business purposes, as further described in Varnish's Privacy Policy, as updated from time to time.

• "Support & Diagnostic Data" means Personal Data processed through support and diagnostic interactions, including IP addresses, system diagnostic logs, crash dumps, and support tickets.

2. Roles of the Parties

2.1 Processing Chain: The parties acknowledge that for Support & Diagnostic Data, the End-User is the Controller, the Partner is the Processor, and Varnish is the Sub-processor as summarized below.

2.2 Documented Instructions: Varnish processes Support & Diagnostic Data solely on the Partner’s documented instructions. The Partner warrants that all instructions provided to Varnish are consistent with the instructions received from the End-User Controller.

2.3 Independent Controller Processing: This DPA does not apply to Administrative Data processed by Varnish as an independent controller, which is governed by Varnish’s Privacy Notice.

3. Categories of Data Subjects and Personal Data

3.1 Data Subjects: End-User’s employees, administrators, or network users whose data may be captured in system diagnostic logs.

3.2 Categories of Personal Data:

• IP addresses, usernames, request headers, and technical metadata captured in system logs, crash dumps, or varnishgather diagnostic archives submitted for support.

Varnish does not intentionally process special categories of personal data under Article 9 GDPR.

4. Processing Overview

Processing is limited to what is necessary to provide the Services/Offering in accordance with the Partner Agreement. Given that, Varnish processes Support & Diagnostic Data solely for the purpose of providing technical support, diagnosing software issues, and validating software licenses.

5. Partner’s Obligations

5.1 Warranty of Legal Basis and Transparency: The Partner represents and warrants that it has, and will maintain throughout the term of the Partner Agreement: 

(a) a valid legal basis under applicable data protection laws (including the GDPR) for Varnish to process Support & Diagnostic Data as a Sub-processor; and

(b) all necessary approvals, consents, and authorizations from the End-User Controller, and has provided all required transparency disclosures to End-Users regarding Varnish and its sub-processors.

5.2 Data Minimization and Sanitization: The Partner shall instruct and ensure that the End-User Controller sanitizes, redacts, or anonymizes Personally Identifiable Information (PII) from all log files, crash dumps, and varnishgather diagnostic archives prior to uploading or submitting them to Varnish for support or troubleshooting purposes.

5.3 Compliance and flow-down:The Partner is solely responsible for flowing down all relevant data protection terms to its End-Users. The Partner shall immediately notify Varnish if it becomes aware of any withdrawal of consent by an End-User or any instruction from a Controller that would cause Varnish to violate applicable data protection laws.

6. Deletion of Data

Processing of Support & Diagnostic Data shall continue for the duration of the Partner's use of the Services/Offering. Upon termination of the Services/Offering, Varnish shall delete Support & Diagnostic Data that is no longer required for the provision of the Services/Offering or return Support & Diagnostic Data upon Partner's written request within 15 days of termination. Notwithstanding the foregoing, Support & Diagnostic Data retained for security, fraud prevention, auditing, or operational purposes may be retained for up to 12 months, after which it will be permanently deleted, unless a longer retention period is required by applicable law.

7. Security Measures

Details of such measures are set out in the Varnish Security Policy.

8. Confidentiality

Varnish ensures that all personnel authorised to process Personal Data are subject to appropriate confidentiality obligations and access such data only as necessary to perform the Services/Offering.

9. Sub-processing

9.1 Authorized Sub-processors: Varnish utilizes its affiliates and support sub-processors (such as ticketing and customer support systems) to assist in providing technical support and managing service delivery. Partner provides general written authorization for Varnish to engage the Sub-processors listed in the Varnish Privacy Policy.

9.2 Sub-processor Obligations: Varnish shall ensure all Sub-processors are bound by written agreements containing data protection terms no less protective than those established in this DPA. Varnish remains fully liable to the Partner for the performance of its Sub-processors’ obligations.

10. Data Transfers

The Partner acknowledges that to provide 24/7 global technical assistance, Support & Diagnostic Data may be processed by Varnish and its authorized Sub-processors outside of the European Union (EU)/European Economic Area (EEA). Where Varnish transfers Support & Diagnostic Data outside the EU/EEA, Varnish shall ensure such transfers are strictly limited to the purpose of providing technical support and are governed as follows:

• Transfers to countries recognized by the European Commission as providing an adequate level of data protection pursuant to Article 45 GDPR or be governed by Standard Contractual Clauses pursuant to Article 46 GDPR.

11. Assistance

Varnish shall, taking into account the nature of processing and to the extent technically feasible, assist the Partner in complying with its obligations under the GDPR, including with respect to responding to data subject requests under Articles 12–23 GDPR and meeting obligations relating to security, personal data breaches, data protection impact assessments, and consultations with supervisory authorities, provided that such assistance will be performed at the Partner’s cost.

12. Personal Data Breach

Varnish shall notify the Partner without undue delay, and in any event within 72 hours after becoming aware of a Personal Data Breach affecting Support & Diagnostic Data, and shall provide information reasonably necessary for the Partner to comply with its legal obligations.The Partner is solely responsible for notifying the End-User Controller of the breach.

13. Audit

Upon at least two (2) months’ prior written notice from the Partner, Varnish shall make available relevant documentation or certifications demonstrating compliance with this DPA. Audit shall be limited to processing of Support & Diagnostic Data under this DPA and reasonably necessary to verify compliance. Audit shall be carried out by the Partner and shall not unreasonably interfere with Varnish’s operations or service delivery. The Partner shall treat all non-public information obtained during the audit as confidential. Any audit shall be conducted at the Partner’s expense and shall not occur more than once per calendar year.

14. Liability

Liability arising under this DPA shall be subject to the limitations set out in the Partner Agreement.

15. Order of Precedence

In the event of conflict between this DPA and the Partner Agreement, this DPA shall prevail with respect to data protection matters.

16. Governing Law and Dispute Resolution

This DPA shall be governed by the laws and jurisdiction set out in the Partner Agreement, which contains all relevant provisions regarding governing law and dispute resolution.

17. Changes to this DPA

Varnish may update this DPA from time to time to reflect changes in applicable law (including data protection law), industry standards, or updates to the Services/Offering, with such changes taking effect upon publication. For material changes, including any material changes to its Sub-processors, Varnish will use reasonable efforts to provide at least 30 days’ prior notice. What constitutes a material change shall otherwise be determined at Varnish’s reasonable discretion. Any objections to proposed Sub-processor changes must be presented timely and based on reasonable, documented data-protection grounds.