Part of the agreement

GitLab Data Processing Addendum

7,504 words, 203 clausesno date on the pageread 12/10/2026source

·GitLab Data Processing Addendum

·The terms of this Data Processing Addendum ("DPA") supplement the Subscription Agreement where Customer is entering into the Subscription Agreement on behalf of an Enterprise. Customer's acceptance of the Subscription Agreement shall be treated as its execution of this DPA and, where applicable, the Standard Contractual Clauses. Capitalized terms used but not defined in this DPA shall have the meanings ascribed to them in the Subscription Agreement.

·The parties agree that this DPA sets forth both parties' obligations with respect to the processing and security of Personal Data, to the extent GitLab processes such Personal Data. The parties hereby enter into this DPA in order to comply with the obligations under Applicable Data Protection Laws (as defined below).

11. Definitions. The capitalized terms will have the meanings set forth below:
2"Applicable Data Protection Laws" means any applicable laws, statutes or regulations as may be amended, extended, re-enacted from time to time, or any successor laws which relate to Personal Data including: (i) the GDPR and any European Economic Area (the "EEA") Member State laws implementing the GDPR; (ii) the California Consumer Privacy Act of 2018 (the "CCPA"), as amended by the California Privacy Rights Act of 2020 (the "CPRA"), and the California Attorney General Regulations thereof; (iii) the United Kingdom (the "UK") Data Protection Act 2018, as amended, and the GDPR, as incorporated into UK law (the "UK GDPR"); (iv) the Swiss Federal Act on Data Protection of 25 September 2020 and its corresponding ordinances, as in force from 1 September 2023 (the "Swiss FADP"), and (v) any other applicable data protection or privacy law to which the Processing under this DPA is subject, in each case to the extent applicable to the respective Party in its role under this DPA.
3"Customer Product Usage Information" means de-identified (aggregated or pseudonymized) metrics derived from Customer's use of the Software and found at https://about.gitlab.com/handbook/legal/privacy/customer-product-usageinformation/. Customer Product Usage Information shall not include Customer Content.
4"Data Breach" means a confirmed accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data.
5"DPF" means the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework.
6"GDPR" means the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the
7Processing of Personal Data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
8"Personal Data" has the meaning set out in Article 4(1) of the GDPR and, to the extent applicable, the equivalent term under any other Applicable Data Protection Law, in each case where Processed by GitLab under this DPA.
9"Process", "Processing", "Processor", and "Controller" shall have the meaning as defined under GDPR.
10"Restricted Transfer(s)" means a transfer of Personal Data from the EEA, the UK or Switzerland to a country that has not received an adequacy decision from the European Commission or the UK or Swiss authorities.
11"Service(s)" means the software and services licensed under the Subscription Agreement.
12"Standard Contractual Clauses" means (i) where the GDPR applies, the contractual clauses annexed to the European Commission's Implementing Decision 2021/914 of 4 June 2021 available at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj (the "EU SCCs"); (ii) where the UK GDPR applies, the International Data Transfer Addendum issued by the United Kingdom's Information Commissioner's Office to the EU Commission's Standard Contractual Clauses available at https://ico.org.uk/media/for-organisations/documents/4019539/international-datatransfer-addendum.pdf (the "UK SCCs"); and (iii) where the Swiss FADP applies, those clauses in Section 15.d of this DPA (the "Switzerland Clauses").
13"Sub-processor(s)" means any third-party Processor engaged by GitLab to Process Personal Data in order to provide the Services to Customer under the Subscription Agreement.
14"Subscription Agreement" shall mean GitLab's standard subscription agreement with respect to its software and professional services generally made available here: https://about.gitlab.com/terms/ or such separate agreement as agreed to between the parties in writing similarly governing the use and delivery of GitLab's software and professional services.
22. Status of the Parties. This DPA applies when GitLab Processes Personal Data in the provision of the Services. In this context, Customer may act as Controller of Personal Data, or as Processor of Personal Data on behalf of a third-party Controller. Where Customer acts as a Processor on behalf of its own Controller(s), Customer remains responsible for ensuring this DPA meets the requirements of its own Controller agreement. GitLab's obligations under this DPA run to Customer, and GitLab has no direct contractual relationship with Customer's controllers. For purposes of this DPA,

·references to Customer's obligations apply regardless of whether Customer acts as a Controller or as a Processor on behalf of an underlying Controller. GitLab is the Processor of Personal Data, except for those Processing activities detailed in Section 18.a of the DPA.

33. Details of the Processing and Transfer Description. The subject-matter of the Processing of Personal Data to be carried out by GitLab under the Subscription Agreement, along with the duration of the Processing, the nature and purpose of the Processing, the types of Personal Data, and the categories of data subjects Processed under these terms are further specified in Exhibit A. To the extent the Standard Contractual Clauses apply, the information in Exhibit A shall set forth the basis for such transfers under the Standard Contractual Clauses.
44. Processing Instructions. Where GitLab acts as a Processor, GitLab shall only Process Personal Data on behalf of Customer and only in accordance with documented instructions received from Customer. The parties agree that this DPA, the Subscription Agreement, any features and settings used in the Software, and any processing initiated by Customer's users in their use of the Services shall constitute Customer's documented instructions. GitLab will notify Customer promptly if it considers that an instruction from Customer is in breach of any Applicable Data Protection Laws, and GitLab shall be entitled to suspend execution of the instructions. GitLab will notify Customer promptly if it determines that it can no longer meet its obligations under this DPA, in which case the parties will cooperate to agree on reasonable steps to address the situation. Where GitLab, in its role as Processor, is required to Process Personal Data under Applicable Data Protection Laws or other applicable law to which it is subject, GitLab shall without undue delay notify Customer of this legal requirement before carrying out such Processing, unless GitLab is legally prohibited from making such notice.
55. Confidentiality by GitLab Personnel. GitLab will limit access to Personal Data to personnel who are required to access Personal Data in order to perform the obligations under the Subscription Agreement. GitLab shall impose appropriate contractual obligations upon its personnel to maintain the confidentiality of the Personal Data.
66. Security Measures. GitLab will implement and maintain appropriate technical and organizational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored or otherwise Processed. Those measures are set forth in Exhibit B to this DPA. Such measures take into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the Processing. GitLab reserves the right to modify the measures set forth in Exhibit B, provided that such changes will not result in a material degradation of security.
77. Data Breach. In the event that GitLab becomes aware of a Data Breach, GitLab will: (i) notify Customer without undue delay after GitLab becomes aware of the Data Breach;
6(ii) as part of the notification, provide Customer with information regarding the Data Breach, to the extent such information is available to GitLab, to enable Customer to comply with its notification requirements under the Applicable Data Protection Laws; and (iii) promptly commence an investigation into the Data Breach and take appropriate remedial steps to prevent and minimize any possible harm. For the avoidance of doubt, Data Breaches will not include unsuccessful attempts or activities that do not compromise the security of Personal Data. The obligations herein shall not apply to incidents that are caused by Customer or Customer's users. Customer shall promptly notify GitLab of any reasonably suspected misuse of accounts or authentication credentials, or any security incident related to Customer's use of the Services. Neither party's notification of or response to a Data Breach under this Section is an acknowledgement of any fault or liability with respect to the Data Breach.
88. Data Subject Rights. Where GitLab is a Processor and it receives a data subject request in relation to Customer, GitLab will either notify the Customer directly or redirect the data subject to contact Customer. Customer is responsible for ensuring such requests are handled in accordance with Applicable Data Protection Laws. GitLab will assist Customer with its obligations in connection with data subject requests. To the extent GitLab is a Controller and it receives a data subject request, GitLab will comply with the requirements of Applicable Data Protection Laws.
99. Data Protection Impact Assessments (DPIA) and Prior Consultation. Upon Customer's request, GitLab shall provide Customer with reasonable cooperation and assistance needed to fulfill Customer's obligation under Applicable Data Protection Laws to carry out a data protection impact assessment related to Customer's use of the Service. GitLab shall provide reasonable assistance to Customer in the cooperation or prior consultation with supervisory authorities in the performance of its tasks relating to this Section 9, to the extent required under Applicable Data Protection Laws.

1010. Disclosure of Customer Personal Data.

1GitLab will not disclose or provide access to any Customer Personal Data unless it is:
2in accordance with Customer's instructions; or
3as described in this DPA; or
4required by law, in which case GitLab will challenge the request for disclosure if, after careful assessment, GitLab believes the request is unlawful, and GitLab will provide the minimum amount of Personal Data permitted when responding.
5GitLab will not disclose or provide access to any Customer Personal Data to law enforcement unless required by law or compelled by legal process. Requests by law enforcement or inquiries by a supervisory authority regarding Customer Personal Data will be directed to Customer where possible.
6GitLab will promptly inform Customer if disclosure of Customer Personal Data is compelled or requested, providing as much relevant information as possible, unless GitLab is legally prohibited from doing so (such as in order to preserve the confidentiality of an investigation). If the laws of the country of destination prohibit GitLab from notifying Customer, GitLab will attempt to obtain a waiver of such prohibition to permit the required notification.
1111. Return or Deletion of Personal Data. Customer may, at any time during the term or upon termination of the Agreement, delete any groups containing Personal Data through the in-product administrative settings or group dashboard. For clarity, GitLab does not automatically delete Customer groups upon termination or expiry of the Subscription. Following termination or expiry of the Subscription, GitLab will not process Personal Data within inactive groups except for and only to the extent necessary to comply with Applicable Data Protection Laws or as otherwise described in this DPA. GitLab will not actively process such Personal Data for any other purpose. Further, GitLab will, upon request, securely destroy or, at Customer's sole discretion, return all Personal Data (including all copies) and confirm to Customer that it has taken such measures, in each case to the extent permitted by applicable law. GitLab agrees to preserve the confidentiality of any Personal Data retained by it in accordance with applicable law. GitLab shall ensure that the obligations set forth in this Section are also required of Sub-processors.
1212. Controller Obligations. Customer, acting as the Controller or on behalf of the Controller, agrees that:
9It shall comply with all Applicable Data Protection laws, and as between Customer and GitLab, it shall have sole responsibility for the accuracy, quality, and legality of Personal Data and the means by which Customer acquired Personal Data;
10It has provided all legally required notices to and obtained all legally required consents from the data subjects whose Personal Data is Processed under the Subscription Agreement;
11All instructions from Customer to GitLab with respect to Processing of Personal Data shall comply with Applicable Data Protection Laws;
12It shall promptly inform GitLab of any non-compliance by Customer, its employees or contractors with this DPA or the provisions of the Applicable Data Protection Law relating to the protection of Personal Data Processed under the Subscription Agreement; and
13It is solely responsible for making an independent determination as to whether the technical and organizational measures for the Service meet Customer's

·requirements, including any of its security obligations under applicable data protection requirements. Customer acknowledges and agrees that the security practices and policies implemented and maintained by GitLab provide a level of security appropriate to the risk with respect to its Personal Data. Customer is responsible for implementing and maintaining privacy protections and security measures for components that Customer provides or controls.

·GitLab is not responsible for compliance with data protection laws applicable solely to Customer or Customer's industry that are not generally applicable to GitLab as a Processor.

1313. Audit.

1GitLab Certification Audits. GitLab uses external auditors to verify the adequacy of its security measures, excluding the physical and environmental security of the thirdparty physical data centers from which GitLab provides the Services, as those controls are inherited by the third-party Sub-processor. This audit: (a) will be performed at least annually; (b) will be performed according to System and Organization Controls (SOC) 2 Report and/or ISO 27001 standards or such other alternative standards that are substantially equivalent to System and Organization Controls (SOC) 2 Report and/or ISO 27001; (c) will be performed by independent third-party security professionals at GitLab's selection and expense; and (d) will result in the generation of an audit report ("Report"), which will be GitLab confidential information. At Customer's written request, and provided that the parties have applicable confidentiality terms in place, GitLab will provide Customer with a copy of the Report so that Customer can reasonably verify GitLab's compliance with its obligations under this DPA.
2GitLab Customer Audits. GitLab shall enable remote self-serve audits of its security program by granting Customer access to the GitLab Trust Center and GitLab Handbook. The GitLab Trust Center and GitLab Handbook will include documentation evidencing GitLab's policies, procedures and security measures as well as copies of third-party audit reports as listed in Section 13.a. GitLab reserves the right to refuse to provide Customer (or its representatives) information which would pose a security risk to GitLab or its customers.
3Feedback. Upon completion of the remote self-serve audit, Customer may submit audit results in writing to GitLab. GitLab may in its sole discretion make commercially reasonable efforts to implement Customer's suggested improvements.
4Audit Rights Under Standard Contractual Clauses. To the extent GitLab is a Processor and Customer's audit requirements under the Standard Contractual Clauses or Article 28 of the GDPR cannot reasonably be satisfied through the Reports and selfserve audits set forth above, Customer may request an additional audit. Before the

·commencement of an audit, Customer and GitLab will mutually agree upon the scope, timing, duration, control and evidence requirements, and fees for the audit. To the extent needed to perform the audit, GitLab will make the Processing systems and supporting documentation relevant to the Processing of Personal Data by GitLab and its Sub-processors available, including inspections (provided that no access to third-party confidential information will be permitted). Such an audit will be conducted by Customer or by an independent, accredited third-party auditor during regular business hours, with reasonable advance notice to GitLab, and subject to reasonable confidentiality procedures. Customer is responsible for all costs and fees related to such audit, including all reasonable costs and fees for any and all time GitLab expends for any such audit. If the audit report generated as a result of Customer's audit includes any finding of material non-compliance, Customer shall share such audit report with GitLab. Nothing in this Section of the DPA varies or modifies the Standard Contractual Clauses or affects any supervisory authority's or data subject's rights under the Standard Contractual Clauses.

1414. Sub-processors. To the extent that GitLab acts as a Processor:

1Customer agrees that GitLab shall be entitled to use the Sub-processors listed at https://about.gitlab.com/privacy/subprocessors/ for the Service. If GitLab wishes to add a new Sub-processor to the list, GitLab will update the list on the website. Customer may subscribe at https://about.gitlab.com/privacy/subprocessors/#signup to receive email notifications of updates to the list, which will serve as written notice to Customer. If Customer wishes to object to the approval of a new Subprocessor, meaning an organization or entity not previously listed at https://about.gitlab.com/privacy/subprocessors/, it must provide such objection in writing to GitLab within thirty (30) days after notice has been received. GitLab will not engage a new Sub-processor to Process Customer Personal Data before the expiry of the thirty (30) day objection period, unless Customer has provided earlier written confirmation of no objection. If Customer objects to the change in Subprocessor, the parties will work together in good faith to resolve the objection, including making a commercially reasonable change to Customer's configuration or use of the Services to avoid the Processing of Personal Data by the new Subprocessor. Customer can only object to the addition of a new Sub-processor on the basis that such addition would cause Customer to violate data protection commitments or other applicable legal requirements. If Customer does not object within the referred period the respective Sub-processor shall be considered approved by Customer.
2To the extent applicable for Customer whose Services include GitLab's Dedicated software with a specified regional hosting location, as may be mutually agreed and described in an Order Form or Subscription Agreement as applicable, that hosting location will be as so designated. Therefore, the cloud hosting location for any cloud hosting Sub-processors listed at

·https://about.gitlab.com/privacy/subprocessors/#third-party-sub-processors shall be amended to the location as listed and agreed as between Customer and GitLab.

1To the extent Customer has purchased Professional Services separate from the Subscription, as that term is defined under the GitLab Professional Services Agreement, and the parties have agreed GitLab will facilitate all or a part of such Professional Services via a subcontractor, Customer agrees that GitLab's use of such subcontractor(s) shall be an approved Sub-processor as listed at https://about.gitlab.com/privacy/subprocessors/#professionalservices-sub-processors. If GitLab wishes to add a Sub-processor for Professional Services, it will follow the same notification process as described in Section 14.a. of the DPA. All other provisions of this Section 14 and the Standard Contractual Clauses, where applicable, will apply to those Subprocessors appointed under this provision.
2Where a Sub-processor is appointed as described in Section 14.a. above: (i) GitLab will restrict the Sub-processor's access to Personal Data to what is necessary to maintain the Service or to provide the Service to Customer in accordance with the documentation, and GitLab will prohibit the Sub-processor from accessing Personal Data for any other purpose; (ii) GitLab will enter into a written agreement with the Sub-processor and, to the extent that the Sub-processor is Processing Personal Data to enable the Service provided by GitLab under this DPA, GitLab will impose on the Sub-processor substantially similar contractual obligations that GitLab has under this DPA; and (iii) GitLab will remain responsible for its compliance with the obligations of this DPA and for any acts or omissions of the Sub-processors that cause GitLab to breach any of GitLab's obligations under this DPA.

1515. International Data Transfers.

1Transfers of Personal Data from Customer in the EEA, the United Kingdom or Switzerland to GitLab, Inc. in the United States take place under the DPF. GitLab, Inc. participates in and has certified compliance with the DPF and commits to provide at least the same level of privacy protection as is required by the DPF Principles, including with respect to onward transfer liability, and to cooperate with the U.S. Department of Commerce and the Federal Trade Commission in relation to the DPF. GitLab has engaged JAMS as its independent recourse mechanism for unresolved DPF complaints (https://www.jamsadr.com/DPF-Dispute-Resolution). GitLab's DPF certification can be verified at https://www.dataprivacyframework.gov/list.

·Where the DPF is suspended, invalidated or otherwise ceases to apply, where Customer elects not to rely on the DPF, or where there is a Restricted Transfer, the Parties are deemed to have signed, and the transfer will take place pursuant to, the Standard Contractual Clauses set out in this Section 15, including their annexes. GitLab will

·promptly notify Customer if it determines it no longer participates in, or complies with, the DPF.
·To the extent the EU SCCs apply, the parties agree that:
·where Module One of the EU SCCs applies to the Personal Data transferred for those Processing activities detailed in Section 18.a of the DPA, Customer is acting as a Controller and "Data Exporter" and GitLab is acting as independent Controller and "Data Importer";
·where Module Two of the EU SCCs applies to the Personal Data transferred, Customer is acting as a Controller and "Data Exporter" and GitLab is acting as a Processor and "Data Importer";
·where Module Three of the EU SCCs applies to the Personal Data transferred, Customer is acting as a Processor and "Data Exporter" and GitLab is acting as a Processor and "Data Importer";
7Clause 7. The optional docking clause does not apply;
9Clause 9(a). The parties select "Option 2 General Written Authorization" under Module Two and Module Three for the engagement of the Subprocessors identified in Section 14 of this DPA and the time period for prior written notice of changes shall be thirty (30) days;
11Clause 11. The optional language will not apply;
17Clause 17. Option 2 will apply and the EU SCCs will be governed by the law of the Netherlands;
18Clause 18(b). Disputes shall be resolved before the courts of the Netherlands;
Annex IAnnex I.A and I.B of the EU SCCs shall be deemed complete with the information set out in Exhibit A to this DPA;
Annex IAnnex I.C of the EU SCCs, where the data exporter is established in the EEA shall be the supervisory authority with responsibility for ensuring compliance by the Data Exporter with GDPR as regards to the data transfer. Where the data exporter is not established in the EEA, but is within the territorial scope of application of the GDPR in accordance with Article 3(2) and has appointed a representative pursuant to Article 27(1), the supervisory authority shall be the member state in which the representative within the meaning of Article 27(1) is established. If the data exporter is not established in the EEA, but falls within the territorial scope of application of the GDPR without having to appoint a representative pursuant to Article 27(2), the supervisory authority of the Netherlands shall act as the competent supervisory authority.
Annex IIAnnex II of the EU SCCs shall be deemed complete with the information set out in Exhibit B to this DPA; and
Annex IIIAnnex III of the EU SCCs shall be deemed complete due to the General Authorization granted to those Sub-processors listed in Section 14 of this DPA.
·To the extent the UK SCCs apply, the parties agree that:
·any references in the EU SCCs to "Directive 95/46/EC" or "Regulation (EU) 2016/679" shall be interpreted as references to the UK GDPR; references to specific Articles of "Regulation (EU) 2016/679" are replaced with the equivalent article or Section of the UK GDPR; and references to "EU", "Union" and "Member State law" are all replaced with "UK";
·Clause 13(a) of the EU SCCs is not used;
·references to the "competent supervisory authority" and "competent courts" shall be interpreted as references to the Information Commissioner and the courts of England and Wales;
·Clause 17 of the EU SCCs is replaced to state that "The Clauses are governed by the laws of England and Wales";
·Clause 18 of the EU SCCs is replaced to state "Any dispute arising from these Clauses shall be resolved by the courts of England and Wales. A data subject may bring legal proceedings against the Data Exporter and/or Data Importer before the courts of any country in the UK. The Parties agree to submit themselves to the jurisdiction of such courts"; and
·the relevant Annexes of the UK SCCs shall be deemed complete with the information set out in Exhibit A to this DPA.
·To the extent the Switzerland Clauses apply, the parties agree that:
·the EU SCCs as implemented above will apply provided that "GDPR" shall be interpreted as references to the Swiss FADP;
·references to the "EU", "Union", and "Member State law" shall be interpreted as references to Switzerland and Swiss law;
·the term "member state" shall not exclude data subjects in Switzerland from being able to sue for their rights in their place of habitual residence; and
·references to any competent supervisory authority or court shall be interpreted as references to the Swiss Federal Data Protection and Information Commissioner and courts in Switzerland.
·Jurisdiction Specific Terms. To the extent GitLab Processes Personal Data originating from and protected by Applicable Data Protection Laws in one of the jurisdictions listed in "Exhibit C Jurisdiction Specific Terms" of this DPA, the terms specified in Exhibit C with respect to the applicable jurisdiction(s) apply in addition to the terms of this DPA.
·If there is a conflict or inconsistency between this DPA and the Standard Contractual Clauses, the Standard Contractual Clauses will prevail to the extent of the conflict or inconsistency.
·California Consumer Privacy Act and California Privacy Rights Act. The following applies where GitLab is Processing Personal Data that is within the scope of CCPA or CPRA:
·The parties agree that GitLab is a service provider as defined under CCPA, and that any Personal Data transferred to GitLab is done for a valid business purpose and for GitLab to perform the Services;
·Subject to exceptions under CCPA, GitLab agrees that it will not sell or share Personal Data Processed under the Subscription Agreement, as the terms "sell" and "share" are defined in the CCPA;
·GitLab will not share, rent, release, disclose, disseminate, make available, transfer or otherwise communicate orally, in writing or by electronic or other means, the Personal Data, transferred under the Subscription Agreement or to perform the Services, to a third-party for cross-contextual behavioral advertising in which no money is exchanged;
·Customer may monitor GitLab's compliance with this DPA through those measures set forth in Section 13, provided Customer will be subject to all requirements and limitations as specified in Section 13.d. GitLab will notify Customer if it determines that it can no longer meet its obligations under the CCPA with respect to the Processing of Personal Data, in which case Customer may take reasonable and appropriate steps to stop and remediate any unauthorized use of Personal Data;
·GitLab will not use or disclose Personal Data outside its direct business relationship with Customer; and
·GitLab will not combine the Personal Data transferred under the Subscription Agreement or to perform the Services with information that it receives from or on behalf of a third-party or that it collects independently from California residents, except that GitLab may combine Personal Data to perform a valid business purpose as permitted under the CCPA and/or CPRA.
·GitLab certifies that it understands the restrictions set out in this Section and will comply with them.
·Limitation of Liability. To the maximum extent allowed under Applicable Data Protection Laws, the parties intend and agree that each party's liability, taken together in the aggregate, arising out of or related to this DPA, whether in contract, tort or under any other theory of liability, is subject to the 'Limitation of Liability' Section of the Subscription Agreement, and any reference in such Section to the liability of a party means the aggregate liability of that party under the Agreement and this DPA.

1818. Miscellaneous.

1GitLab's Role as a Controller. Customer acknowledges and agrees that as part of providing the Services, GitLab will Process certain Personal Data as a Controller for
2the following legitimate business purposes: (i) to manage the relationship with Customer, such as the creation of customer relationship accounts, billing and licensing management, and facilitating transactional notifications related to the Services (such as billing reminders, subscription updates, and service announcements); (ii) to conduct internal business operations, such as accounting, audit, tax, and other financial reporting purposes; (iii) to ensure the security of the Services, such as identity verification services and to prevent fraud and mitigate risk; (iv) to comply with our legal or regulatory obligations; (v) to improve and develop our products and Services through the collection and Processing of Customer Product Usage Information. GitLab will not attempt to re-identify Customer Product Usage Information, except solely to verify that its de-identification processes comply with Applicable Data Protection Laws or are functioning as intended; and (vi) only where Customer has opted-in, to collect and process prompts and tracing data related to AI-powered features, for the purposes of improving service quality, debugging, and developing product improvements. To the extent any data Processed under this Section is Personal Data, GitLab agrees that it will Process such Personal Data in compliance with Applicable Data Protection Laws and only for the purposes that are compatible with those described in this Section 18.a. Customer Content will not be Processed for any of the purposes listed under this Section, unless required under applicable law. GitLab shall be an independent Controller for the Processing listed in this Section and will be solely responsible and liable for any such Processing.
3This DPA, including the Standard Contractual Clauses, constitutes the entire agreement and understanding of the parties, and supersedes any prior agreement or understanding between the parties, in each case in respect of the Processing of Personal Data for the purposes specified herein. In case of discrepancies between this DPA and Subscription Agreement, this DPA shall prevail. The provisions of this DPA will survive termination or expiration of the Subscription Agreement.
4GitLab may update the terms of this DPA where such changes are (a) required to comply with Applicable Data Protection Laws, applicable regulation, or guidance issued by a supervisory authority, or (b) do not materially diminish the protections for Personal Data under this DPA.

Exhibit AEXHIBIT A

·Details of the Processing and Transfer Description

AA. Section 2 of this DPA or Modules Two/Three of the EU SCCs

11. Data Exporter: Customer

·Contact Details: As listed by Customer in the website purchase portal or as identified on any combination of an Order Form or Subscription Agreement.

·Signature and Date: Customer is deemed to have signed this DPA and the Restricted Transfer documentation incorporated herein, including their Exhibits, as of the effective date of acceptance via purchase by Customer through GitLab.com, or the date an Order Form or Subscription Agreement is fully executed. Role: Controller or Processor

·Data Importer: GitLab, Inc.

·Contact Details: 268 Bush St 350, San Francisco, CA, 94104-3503, USA; dpo@gitlab.com. Signature and Date: GitLab is deemed to have signed this DPA and the Restricted Transfer documentation incorporated herein, including their Exhibits, as of the effective date of acceptance via purchase by Customer through GitLab.com, or the date an Order Form or Subscription Agreement is fully executed. Role: Processor or Sub-processor

22. Categories of data subjects whose Personal Data is transferred

·Customer's prospects, clients, business partners, and vendors (who are natural persons)
·Customer's employees, agents, advisors and freelancers (who are natural persons)
·Customer's users authorized by Customer to use the Services
·Any other natural persons who become identifiable through content provided via Customer's use of the Services

33. Categories of Personal Data transferred

·Account Information, such as name, username, email address, and password
·Profile Information, such as name, public avatar or photo, employer, email address, job title, address, social media handles, and biography
·Contact information, such as name, address, email address, and telephone
·Content provided through the use of the Services, such as repositories, issues, commits, project contributions, comments, and input/output related to AI-powered features
·Customer Support Information, such as the request you are making or the services being provided
·Product Analytics for Customer to measure engagement by their own users, such as user-level metrics and counts related to interactions with the Software
·Other information provided by the user in unstructured data fields, such as free-text inputs and file uploads.

44. Sensitive or special categories of Personal Data

·GitLab does not intentionally collect Sensitive Data as defined in the Subscription Agreement. These data elements should not be submitted to the Services without GitLab's consent, pursuant to Section 14 of the Subscription Agreement.

·In the event Customer submits Sensitive Data to the Services without GitLab's consent, such data will be subject to GitLab's technical and organizational security measures set forth in Exhibit B.

55. Nature of the Processing

·The Processing relates to Customer's use of the Services for purposes determined and controlled by Customer in its sole discretion.

66. Purpose(s) of any data transfer and further Processing

·Purposes of the data transfer are to allow GitLab entities to provide the Services, which are hosted and processed on servers in the United States, or as otherwise agreed in the Order Form. Further, GitLab has a globally distributed workforce and a transfer of Personal Data may be necessary to render Customer Support.

77. The frequency of any data transfer

·Personal Data will be transferred for the duration of the Subscription Term under the Subscription Agreement and this DPA on a continual basis.

88. The period for which Personal Data will be retained

·Personal data will be retained for the period determined by Customer, including until termination of the Subscription Term, subject to exceptions allowed by law and under the Subscription Agreement with Customer.

99. Transfers to Sub-processors

·GitLab's Sub-processors import data under the Standard Contractual Clauses or other lawful transfer mechanism for the purposes of cloud hosting, search functionality, application logging and debugging, content delivery, transactional emails, Customer Support, and AI functionality. GitLab uses Sub-processors in order to provide the Services to Customer.

BB. Section 18.a of this DPA or Module One of the EU SCCs

11. Data Exporter: Customer

·Contact Details: As listed by Customer in the website purchase portal or as identified on any combination of an Order Form or Subscription Agreement.

·Data Importer: GitLab, Inc.

22. Categories of data subjects whose Personal Data is transferred

·Customer's employees, agents, advisors and freelancers (who are natural persons)
·Customer's users authorized by Customer to use the Services

33. Categories of Personal Data transferred

·Account Management Information, such as license data, historical user data, and account administrator contact information
·Billing Information, such as Customer's billing address, billing contact, and credit card or banking information
·Customer Product Usage Information, as defined in the DPA, such as feature usage and engagement metrics
·Security and Fraud Prevention Information, such as log data, prompts, device data and IP address
·AI Feature Data: Only where Customer has opted-in to such collection, prompts and tracing data related to AI-powered features
·Feedback Information, such as voluntarily submitted user satisfaction scores and free text comments

44. Sensitive or special categories of Personal Data

·GitLab does not collect sensitive or special categories of Personal Data for the purposes as described under this subsection B of Exhibit A.

55. Nature of the Processing

·The Processing allows for GitLab to understand how the Services are used, to process payments for the Services, to administer the Services, to comply with legal obligations, and to protect the safety and property of GitLab and Customer.

66. Purpose(s) of any data transfer and further Processing

·The purposes of the data transfer are to enable GitLab to Process Personal Data as a Controller for the legitimate business purposes described in Section 18.a of this DPA. GitLab has a globally distributed workforce of employees who may be located in the United States and other countries outside of the European Economic Area, the United Kingdom and Switzerland.

77. The frequency of any data transfer

·Personal Data will be transferred for the duration of the Subscription Term under the Subscription Agreement and this DPA on a continual basis.

88. The period for which Personal Data will be retained

·Personal Data will be retained for the period described in the Data Retention Section of the GitLab Privacy Statement and in accordance with our Records Retention Policy posted at https://handbook.gitlab.com/handbook/legal/record-retention-policy/.

Exhibit BEXHIBIT B

·Technical and Organizational Measures to Ensure the Security of Personal Data

·GitLab will implement and maintain the following security measures:

·Those Technical and Organizational Security Measures for GitLab cloud services found at https://handbook.gitlab.com/handbook/security/securityassurance/technical-and-organizational-measures/.
·Those policies and certifications found in our Trust Center (https://trust.gitlab.com/).
·Sub-processors will implement and maintain security measures substantively similar to those listed in this Exhibit.

11. AUSTRALIA

·The definition of Applicable Data Protection Laws includes the Australian Privacy Principles and the Australian Privacy Act (1988) and any succeeding amendments or accompanying regulations. The definition of Personal Data includes "Personal Information" as defined under the Australian Privacy Principles and the Australian Privacy Act as amended from time to time.

22. BRAZIL

·The following terms apply where GitLab Processes Personal Data originating from Brazil and subject to the Lei Geral de Proteção de Dados of 14 August 2018 (Law No. 13.709/2018), as amended (the "LGPD").

1Applicable Data Protection Laws. The definition of Applicable Data Protection Laws includes the LGPD and the regulations issued by the Autoridade Nacional de Proteção de Dados ("ANPD"), including Resolution CD/ANPD No. 19 of 23 August 2024 (the "Data Transfer Regulation").
2Terminology. Where the LGPD applies: (i) references to "Processor" include "operator" (operador) as defined in Art. 5(VII) of the LGPD; (ii) references to "Controller" include "controller" (controlador) as defined in Art. 5(VI) of the LGPD; and (iii) references to "Personal Data" include "personal data" (dados pessoais) as defined in Art. 5(I) of the LGPD.
3Data Breach Notification. For purposes of the LGPD, the obligations in Section 7 of this DPA extend to security incidents that may result in relevant risk or damage to data subjects, as required by Art. 48 of the LGPD, regardless of whether such incident constitutes a Data Breach as defined in Section 1.c of this DPA. GitLab will cooperate with Customer in notifying the ANPD and affected data subjects where required under Art. 48 of the LGPD.
4International Data Transfers. Where the Processing of Personal Data involves the cross-border transfer of Personal Data of data subjects in Brazil to a country or territory that has not been recognized by the ANPD as providing an adequate level of data protection, the parties hereby incorporate and agree to comply with the Brazilian Standard Contractual Clauses contained in Annex II of the Data Transfer Regulation (the "Brazil SCCs"), available at https://www.gov.br/anpd/pt-br/centrais-de-conteudo/outros-documentos-epublicacoes-institucionais/regulation-on-international-transfer-of-personaldata.pdf. In such cases:

Exhibit CEXHIBIT C

·Jurisdiction Specific Terms

33. JAPAN

·The definition of Applicable Data Protection Laws includes the Act on Protection of Personal Information and its amendments and accompanying regulations (the "APPI"). The definition of Personal Data includes "Personal Information" as defined under the APPI. Where the APPI applies, GitLab's obligations to Customer are those express obligations on a "Processor" when Processing Personal Data on behalf of a "Business Operator," as defined under the APPI.

44. SINGAPORE

·The definition of Applicable Data Protection Laws includes the Personal Data Protection Act of 2012 of Singapore and its amendments and accompanying regulations (the "PDPA"). Where the PDPA applies, GitLab's obligations to Customer are those express

1The informational tables contained in Clause 1.1 of the Brazil SCCs shall be completed with the identification and contact information of Customer and GitLab, as set forth in the Subscription Agreement and this DPA;
2For the purposes of the checkboxes set forth in Clause 1.1 of the Brazil SCCs regarding the roles of the parties: Customer shall be deemed the "Exporter." Where Customer is a Controller, the "Controller" checkbox shall be deemed selected for Customer. Where Customer is a Processor acting on behalf of a Controller, the "Processor" checkbox shall be deemed selected for Customer. GitLab shall be deemed the "Importer" and the "Operator" (Processor) checkbox shall be deemed selected for GitLab;
3The data transfer description table contained in Clause 2.1 of the Brazil SCCs shall be replaced by the information set out in Exhibit A (Details of Processing) to this DPA;
4For the purposes of Clause 3.1 of the Brazil SCCs (Onward Transfers), Option B shall apply (Processor onward transfer), and the descriptive table in Clause 3.1 shall be replaced by the Sub-processor information maintained in accordance with Section 14 of this DPA;
5For the purposes of Clause 4.1 of the Brazil SCCs (Responsibilities of the Parties), Option A shall apply. Where Customer is a Controller, the obligations set forth in items (a), (b), and (c) of Clause 4.1 shall be the responsibility of Customer as Exporter. Where Customer is a Processor acting on behalf of a Controller, such obligations shall be allocated in accordance with the instructions of the relevant Controller;
6The table contained in Section III of the Brazil SCCs (Technical and Organizational Measures) shall be replaced by the information set out in Exhibit B (Technical and Organizational Measures) to this DPA; and
7To the extent any provision of this DPA or the Subscription Agreement conflicts with the Brazil SCCs, the Brazil SCCs shall prevail with respect to the transfer of Personal Data from Brazil.

·obligations imposed by the PDPA on a "Data Intermediary" when Processing Personal Data on behalf of an "Organisation," as defined under the PDPA. Any claims arising from or related to the PDPA will be governed by the laws of Singapore and disputes shall be resolved before a court of general jurisdiction in Singapore.

55. SOUTH AFRICA

·The definition of Applicable Data Protection Laws includes the Protection of Personal Information Act 4 of 2013 ("POPIA"). Where POPIA applies, GitLab's obligations to Customer are those express obligations imposed on an "operator" when Processing Personal Information on behalf of a "responsible party" as defined under POPIA.

66. TURKEY

1The definition of Applicable Data Protection Laws includes the Turkish Personal Data Protection Law No. 6698 dated 7 April 2016 (the "KVKK") and its amendments and accompanying regulations, including the Regulation on the Procedures and Principles Regarding the Transfer of Personal Data Abroad (Official Gazette No. 32598, dated 10 July 2024).
2Data Transfers. Where the KVKK applies and a transfer of Personal Data from Turkey constitutes a cross-border transfer requiring appropriate safeguards under the KVKK, the following terms apply:
3Turkish Standard Contracts. Where Customer determines that the execution of standard contracts published by the Turkish Personal Data Protection Board (the "Turkish SCCs") is required for the transfer of Personal Data under the KVKK, Customer shall notify GitLab in writing, and GitLab shall cooperate with Customer to execute the applicable Turkish SCC template(s) as a separate instrument within a reasonable period following such request. Information required to complete the Annexes of the Turkish SCCs, including the description of transfer, technical and organizational measures, and Sub-processor list, is available in Exhibit A, Exhibit B, and the Sub-processor page referenced in Section 14 of this DPA, each of which may be adapted as necessary to match the structure of the relevant Turkish SCC template.
4No Modification of Turkish SCCs. Nothing in this DPA or the Subscription Agreement is intended to modify, contradict, or supplement the Turkish SCCs, or to prejudice the fundamental rights or freedoms of data subjects under the KVKK.
5Notification to the Competent Authority. Customer is responsible for notifying the Turkish Personal Data Protection Board of the execution of the Turkish SCCs within five (5) business days of execution, as required by the KVKK, together with all required supporting documentation.
6Audit. Where the Turkish SCCs grant audit rights, Customer may exercise
7those rights subject to the requirements and limitations set out in Section 13 of this DPA, to the extent consistent with the Turkish SCCs.
8Precedence. To the extent of any conflict or inconsistency between the Turkish SCCs and the remainder of this DPA (including the Subscription Agreement), the Turkish SCCs shall prevail.

77. APEC CROSS-BORDER PRIVACY RULES

·For transfers of Personal Data to or from jurisdictions participating in the APEC CrossBorder Privacy Rules ("CBPR") System or the Global CBPR Framework:

·Where the Customer is established in, or transfers Personal Data from, a jurisdiction that recognizes CBPR or PRP certification as a valid transfer mechanism, GitLab shall, upon written request, provide reasonable cooperation to support the Customer's compliance with applicable cross-border transfer requirements, including by providing information about GitLab's data protection practices and the safeguards described in Exhibit B.