This Data Processing Agreement ("DPA") forms part of the agreement governing the provision of the Varnish CDN Service Terms ("Terms of the Services") between:
Varnish Software AB, reg. no. 556805-6203, Wallingatan 12, 111 60 Stockholm, Sweden ("Varnish", "Processor"), and the customer entity identified in the Varnish CDN Service Terms or Order ("Customer", "Controller").
This DPA is entered into pursuant to Article 28 of the EU General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR") and applies to the processing of Personal Data by Varnish on behalf of the Customer in connection with the Terms of the Services.
1. Definitions
Capitalised terms not defined in this DPA shall have the meaning set out in the Terms of the Services or the GDPR.
- "Personal Data" means any information relating to an identified or identifiable natural person.
- "Traffic Data" means Personal Data processed through the CDN services, including IP addresses, request headers, and traffic or security logs.
- "Administrative Data" means account, billing, and contact data processed by Varnish as an independent controller.
- "Sub-processor" means any third party engaged by Varnish to process Personal Data on behalf of the Customer.
- "Varnish Sovereign Service Layer" means the subset of Varnish's infrastructure and sub-processors that process Traffic Data to deliver, secure, and operate the Services, generally within the EU/EEA, solely for the purpose of providing the contracted services, and subject to data residency and transfer restrictions as set out in Varnish's agreement with Customers.
2. Roles of the Parties
2.1 Customer as Controller The Customer acts as Data Controller for all Traffic Data processed through the Services.
2.2 Varnish as Processor Varnish acts as Data Processor for Traffic Data and processes such data solely on the Customer's documented instructions, which include this DPA, the Terms of Service, and the Customer's configuration and use of the Services.
2.3 Independent Controller Processing This DPA does not apply to Administrative Data processed by Varnish as an independent controller, which is governed by Varnish's Privacy Notice.
3. Categories of Data Subjects and Personal Data
3.1 Data Subjects
- End users accessing the Customer's websites or applications
- Customer personnel, where technically required (e.g., API access)
3.2 Categories of Personal Data
- IP addresses
- Request headers
- Traffic and security logs
- Limited technical metadata required for routing and security
Varnish does not intentionally process special categories of personal data under Article 9 GDPR.
4. Processing Overview
Varnish processes Traffic Data solely for the purpose of:
- delivering and routing content via the CDN,
- ensuring availability, performance, and resilience of the Services,
- detecting, preventing, and mitigating malicious traffic, and
- securing and maintaining the Services.
Processing is limited to what is necessary to provide the Services in accordance with the Terms of the Services.
5. Customer Obligations
The Customer represents and warrants that:
- it has a valid legal basis for processing Traffic Data;
- its instructions to Varnish comply with GDPR and other applicable data protection laws; and
- it will not instruct Varnish to process Personal Data in a manner that violates applicable law.
6. Duration and Deletion of Data
Processing of Traffic Data shall continue for the duration of the Partner's use of the Services. Upon termination of the Services, Varnish shall delete Traffic Data that is no longer required for the provision of the Services. Notwithstanding the foregoing, Traffic Data retained for security, fraud prevention, auditing, or operational purposes may be retained for up to 12 months, after which it will be permanently deleted, unless a longer retention period is required by applicable law.
7. Security Measures
Details of such measures are set out in the Varnish Security Policy, which is provided in a separate document and available at: https://www.varnish-cdn.com/legal/security-and-compliance.
8. Confidentiality
Varnish ensures that all personnel authorised to process Personal Data are subject to appropriate confidentiality obligations and access such data only as necessary to perform the Services.
9. Sub-processing
9.1 Authorised Sub-processors: The Customer authorises Varnish to engage the Sub-processors listed in Varnish's Privacy Notice, including those that form part of the Varnish Sovereign Service Layer.
9.2 Sub-processor Obligations: Varnish shall ensure that Sub-processors are bound by written agreements imposing data protection obligations no less protective than those set out in this DPA. Varnish remains fully liable for the performance of its Sub-processors' obligations.
9.3 Changes to Sub-processors: Varnish shall provide advance notice of any material changes to its Sub-processors.
10. Data Transfers and EEA Processing
10.1 EEA Processing Traffic Data processed as part of Varnish's Sovereign Service Layer shall be stored and processed within the European Economic Area (EEA).
10.2 Third-Country Transfers Varnish shall not transfer Traffic Data outside the EEA unless instructed by the Customer or required by applicable EU law. Where applicable, appropriate safeguards under Chapter V GDPR shall apply.
11. Assistance to the Customer
Varnish shall, taking into account the nature of processing and to the extent technically feasible, assist the Customer in complying with its obligations under the GDPR, including with respect to responding to data subject requests under Articles 12–23 GDPR and meeting obligations relating to security, personal data breaches, data protection impact assessments, and consultations with supervisory authorities, provided that such assistance will be performed at the Customer's cost.
12. Personal Data Breach
Varnish shall notify the Customer without undue delay, and in any event within 72 hours after becoming aware of a Personal Data Breach affecting Traffic Data, and shall provide information reasonably necessary for the Customer to comply with its legal obligations.
13. Audit
Upon at least two (2) months' prior written notice from the Customer, Varnish shall make available relevant documentation, audit summaries, or certifications demonstrating compliance with this DPA. Audits shall be limited to processing of Traffic Data under this DPA and reasonably necessary to verify compliance. Audits shall be carried out by the Customer and shall not unreasonably interfere with Varnish's operations or service delivery. The Customer shall treat all non-public information obtained during the audit as confidential and shall only have access to the information that Varnish provides in relation to the audit. Any audit shall be conducted at the Customer's expense and shall not occur more than once per calendar year.
14. Liability
Liability arising under this DPA shall be subject to the limitations set out in the Terms of the Services.
15. Order of Precedence
In the event of conflict between this DPA and the Services, this DPA shall prevail with respect to data protection matters.
16. Governing Law
This DPA shall be governed by the laws and jurisdiction set out in the Terms of the Services, which contains all relevant provisions regarding governing law and dispute resolution.
17. Changes to this DPA
Varnish may update this DPA from time to time to reflect changes in applicable law (including data protection law), industry standards, or updates to the Services, with such changes taking effect upon publication. For material changes, including any material changes to its Sub-processors, Varnish will use reasonable efforts to provide at least 30 days' prior notice. What constitutes a material change shall otherwise be determined at Varnish's reasonable discretion. Any objections to proposed Sub-processor changes must be presented timely and based on reasonable, documented data-protection grounds.