[{"data":1,"prerenderedAt":566},["ShallowReactive",2],{"navigation":3,"hamburger-docs-nav":112,"/legal/dpa-partner":146},[4],{"title":5,"path":6,"stem":7,"children":8,"page":44},"Docs","/docs","docs",[9,45],{"title":10,"path":11,"stem":12,"children":13},"Introduction","/docs/getting-started","docs/00.getting-started/index",[14,15,19],{"title":10,"path":11,"stem":12},{"title":16,"path":17,"stem":18},"Quickstart","/docs/getting-started/quickstart","docs/00.getting-started/00.quickstart",{"title":20,"path":21,"stem":22,"children":23,"page":44},"Core Concepts","/docs/getting-started/core-concepts","docs/00.getting-started/core-concepts",[24,28,32,36,40],{"title":25,"path":26,"stem":27},"What is an Organisation?","/docs/getting-started/core-concepts/what-is-an-org","docs/00.getting-started/core-concepts/01.what-is-an-org",{"title":29,"path":30,"stem":31},"What is a Service?","/docs/getting-started/core-concepts/what-is-a-service","docs/00.getting-started/core-concepts/02.what-is-a-service",{"title":33,"path":34,"stem":35},"Routing Traffic","/docs/getting-started/core-concepts/routing-traffic","docs/00.getting-started/core-concepts/03.routing-traffic",{"title":37,"path":38,"stem":39},"Securing your content","/docs/getting-started/core-concepts/securing-content","docs/00.getting-started/core-concepts/04.securing-content",{"title":41,"path":42,"stem":43},"Invalidating Cache","/docs/getting-started/core-concepts/invalidating-cache","docs/00.getting-started/core-concepts/05.invalidating-cache",false,{"title":10,"path":46,"stem":47,"children":48},"/docs/configuration","docs/01.configuration/index",[49,50,99],{"title":10,"path":46,"stem":47},{"title":51,"path":52,"stem":53,"children":54,"page":44},"Configuration","/docs/configuration/configuration","docs/01.configuration/configuration",[55,59,63,67,71,75,79,83,87,91,95],{"title":56,"path":57,"stem":58},"Domains","/docs/configuration/configuration/domains","docs/01.configuration/configuration/00.domains",{"title":60,"path":61,"stem":62},"Origins","/docs/configuration/configuration/origins","docs/01.configuration/configuration/01.origins",{"title":64,"path":65,"stem":66},"General","/docs/configuration/configuration/general","docs/01.configuration/configuration/02.general",{"title":68,"path":69,"stem":70},"High Availability","/docs/configuration/configuration/high-availability","docs/01.configuration/configuration/03.high-availability",{"title":72,"path":73,"stem":74},"Query Parameters","/docs/configuration/configuration/query-parameters","docs/01.configuration/configuration/04.query-parameters",{"title":76,"path":77,"stem":78},"Headers","/docs/configuration/configuration/headers","docs/01.configuration/configuration/05.headers",{"title":80,"path":81,"stem":82},"Cookies","/docs/configuration/configuration/cookies","docs/01.configuration/configuration/06.cookies",{"title":84,"path":85,"stem":86},"Security","/docs/configuration/configuration/security","docs/01.configuration/configuration/07.security",{"title":88,"path":89,"stem":90},"Image Handling","/docs/configuration/configuration/image-handling","docs/01.configuration/configuration/08.image-handling",{"title":92,"path":93,"stem":94},"Overrides","/docs/configuration/configuration/overrides","docs/01.configuration/configuration/09.overrides",{"title":96,"path":97,"stem":98},"API Configuration Reference","/docs/configuration/configuration/api-configuration","docs/01.configuration/configuration/10.api-configuration",{"title":100,"path":101,"stem":102,"children":103,"page":44},"Global Configuration","/docs/configuration/global-configuration","docs/01.configuration/global-configuration",[104,108],{"title":105,"path":106,"stem":107},"Managing TLS Certificates","/docs/configuration/global-configuration/tls","docs/01.configuration/global-configuration/TLS",{"title":109,"path":110,"stem":111},"Purge Tokens","/docs/configuration/global-configuration/purge-tokens","docs/01.configuration/global-configuration/purge-tokens",[113],{"title":5,"path":6,"stem":7,"children":114,"page":44},[115,126],{"title":10,"path":11,"stem":12,"children":116},[117,118,119],{"title":10,"path":11,"stem":12},{"title":16,"path":17,"stem":18},{"title":20,"path":21,"stem":22,"children":120,"page":44},[121,122,123,124,125],{"title":25,"path":26,"stem":27},{"title":29,"path":30,"stem":31},{"title":33,"path":34,"stem":35},{"title":37,"path":38,"stem":39},{"title":41,"path":42,"stem":43},{"title":10,"path":46,"stem":47,"children":127},[128,129,142],{"title":10,"path":46,"stem":47},{"title":51,"path":52,"stem":53,"children":130,"page":44},[131,132,133,134,135,136,137,138,139,140,141],{"title":56,"path":57,"stem":58},{"title":60,"path":61,"stem":62},{"title":64,"path":65,"stem":66},{"title":68,"path":69,"stem":70},{"title":72,"path":73,"stem":74},{"title":76,"path":77,"stem":78},{"title":80,"path":81,"stem":82},{"title":84,"path":85,"stem":86},{"title":88,"path":89,"stem":90},{"title":92,"path":93,"stem":94},{"title":96,"path":97,"stem":98},{"title":100,"path":101,"stem":102,"children":143,"page":44},[144,145],{"title":105,"path":106,"stem":107},{"title":109,"path":110,"stem":111},{"id":147,"title":148,"archived":44,"body":149,"description":555,"extension":556,"group":557,"meta":558,"navigation":559,"path":560,"seo":561,"stem":562,"updated":563,"version":564,"__hash__":565},"legal/legal/dpa-partner.md","Data processing agreement for partners",{"type":150,"value":151,"toc":534},"minimark",[152,165,193,196,201,204,248,252,258,321,327,340,344,350,355,372,375,379,382,396,400,406,409,412,418,422,425,429,440,444,447,451,460,466,470,473,485,489,492,496,499,503,506,510,513,517,520,524,527,531],[153,154,155,156,160,161,164],"p",{},"This Data Processing Agreement (\"",[157,158,159],"strong",{},"DPA","\") forms part of the agreement governing the provision of the Services (the \"",[157,162,163],{},"Partner Agreement","\") between:",[166,167,168,183],"ul",{},[169,170,171,174,175,178,179,182],"li",{},[157,172,173],{},"Varnish Software AB",", reg. no. 556805-6203, Wallingatan 12, 111 60 Stockholm, Sweden (\"",[157,176,177],{},"Varnish","\", \"",[157,180,181],{},"Sub-processor","\"), and",[169,184,185,186,178,189,192],{},"The partner entity identified in the Partner Agreement (\"",[157,187,188],{},"Partner",[157,190,191],{},"Processor","\").",[153,194,195],{},"This DPA is entered into pursuant to Article 28 of the EU General Data Protection Regulation (Regulation (EU) 2016/679) (\"GDPR\"). It applies to the processing of\nPersonal Data by Varnish as a Sub-processor on behalf of the Partner (acting as Processor) and the End-User (acting as Controller) in connection with the Services.",[197,198,200],"h2",{"id":199},"_1-definitions","1. Definitions",[153,202,203],{},"Capitalised terms not defined in this DPA shall have the meaning set out in the GDPR.",[166,205,206,212,218,224,230,236,242],{},[169,207,208,211],{},[157,209,210],{},"\"Controller\"",": means the End-User (Partner's customer) that determines the purposes and means of processing.",[169,213,214,217],{},[157,215,216],{},"\"Processor\"",": means the Partner who processes data on behalf of the Controller.",[169,219,220,223],{},[157,221,222],{},"\"Sub-processor\"",": means Varnish or any third party engaged by Varnish to process Personal Data.",[169,225,226,229],{},[157,227,228],{},"\"Personal Data\"",": means any information relating to an identified or identifiable natural person.",[169,231,232,235],{},[157,233,234],{},"\"Administrative Data\"",": means the categories of personal data processed by Varnish as an independent Controller for its own business purposes, as further\ndescribed in Varnish's Privacy Policy, as updated from time to time.",[169,237,238,241],{},[157,239,240],{},"\"Traffic Data\"",": means Personal Data processed through the CDN services, including IP addresses, request headers, and traffic or security logs.",[169,243,244,247],{},[157,245,246],{},"\"Varnish Sovereign Service Layer\"",": means the subset of Varnish's infrastructure and sub-processors that process Traffic Data within the EU/EEA.",[197,249,251],{"id":250},"_2-roles-of-the-parties","2. Roles of the Parties",[153,253,254,257],{},[157,255,256],{},"2.1 Processing Chain:"," The parties acknowledge that for Traffic Data, the End-User is the Controller, the Partner is the Processor, and Varnish is the\nSub-processor as summarized below.",[259,260,261,277],"table",{},[262,263,264],"thead",{},[265,266,267,271,274],"tr",{},[268,269,270],"th",{},"Entity",[268,272,273],{},"Role",[268,275,276],{},"Personal data processed",[278,279,280,292,301,310],"tbody",{},[265,281,282,286,289],{},[283,284,285],"td",{},"End-User",[283,287,288],{},"Controller",[283,290,291],{},"Sets the rules for their traffic.",[265,293,294,296,298],{},[283,295,188],{},[283,297,191],{},[283,299,300],{},"Manages the End-User relationship.",[265,302,303,305,307],{},[283,304,177],{},[283,306,181],{},[283,308,309],{},"Operates the CDN and Sovereign Layer.",[265,311,312,315,318],{},[283,313,314],{},"Varnish's own subsidiaries or third party infrastructure providers",[283,316,317],{},"Sub-processors to Varnish",[283,319,320],{},"Provide the physical infrastructure.",[153,322,323,326],{},[157,324,325],{},"2.2 Documented Instructions:"," Varnish processes Traffic Data solely on the Partner's documented instructions. The Partner warrants that all instructions provided to\nVarnish are consistent with the instructions received from the End-User Controller.",[153,328,329,332,333,339],{},[157,330,331],{},"2.3 Independent Controller Processing:"," This DPA does not apply to Administrative Data processed by Varnish as an independent controller, which is governed by\nVarnish's Privacy Notice ",[334,335,336],"a",{"href":336,"rel":337},"https://www.varnish-cdn.com/legal/privacy-policy",[338],"nofollow",".",[197,341,343],{"id":342},"_3-categories-of-data-subjects-and-personal-data","3. Categories of Data Subjects and Personal Data",[153,345,346,349],{},[157,347,348],{},"3.1 Data Subjects:"," Website users accessing the End-User's websites.",[153,351,352],{},[157,353,354],{},"3.2 Categories of Personal Data:",[166,356,357,360,363,366,369],{},[169,358,359],{},"IP addresses",[169,361,362],{},"Request headers",[169,364,365],{},"Traffic and security logs",[169,367,368],{},"Limited technical metadata required for routing and security",[169,370,371],{},"Partner personnel contact and account data: name, business email address, and account or authentication credentials and tokens used to access Varnish's management\nportal or APIs.",[153,373,374],{},"Varnish does not intentionally process special categories of personal data under Article 9 GDPR.",[197,376,378],{"id":377},"_4-processing-overview","4. Processing Overview",[153,380,381],{},"Processing is limited to what is necessary to provide the Services in accordance with the Partner Agreement. Given that, Varnish processes Traffic Data solely for the\npurpose of:",[166,383,384,387,390,393],{},[169,385,386],{},"delivering and routing content via the CDN,",[169,388,389],{},"ensuring availability, performance, and resilience of the Services,",[169,391,392],{},"detecting, preventing, and mitigating malicious traffic, and",[169,394,395],{},"securing and maintaining the Services.",[197,397,399],{"id":398},"_5-partner-obligations","5. Partner Obligations",[153,401,402,405],{},[157,403,404],{},"5.1 Warranty of Legal Basis and Transparency:"," The Partner represents, warrants, and covenants that it has, and will maintain throughout the term of the Agreement:",[153,407,408],{},"(a) a valid legal basis under applicable data protection laws (including the GDPR) for Varnish to process Traffic Data as a Sub-processor; and",[153,410,411],{},"(b) all necessary approvals, consents, and authorizations from the End-User Controller, and has provided all required transparency disclosures to End-Users regarding\nVarnish and its infrastructure sub-processors.",[153,413,414,417],{},[157,415,416],{},"5.2 Compliance and flow-down:"," The Partner is solely responsible for flowing down all relevant data protection terms to its End-Users. The Partner shall immediately\nnotify Varnish if it becomes aware of any withdrawal of consent by an End-User or any instruction from a Controller that would cause Varnish to violate applicable data\nprotection laws.",[197,419,421],{"id":420},"_6-duration-and-deletion-of-data","6. Duration and Deletion of Data",[153,423,424],{},"Processing of Traffic Data shall continue for the duration of the Partner's use of the Services. Upon termination of the Services, Varnish shall delete Traffic Data\nthat is no longer required for the provision of the Services or return Traffic Data upon Partner's written request within 15 days of termination. Notwithstanding the\nforegoing, Traffic Data retained for security, fraud prevention, auditing, or operational purposes may be retained for up to 12 months, after which it will be\npermanently deleted, unless a longer retention period is required by applicable law.",[197,426,428],{"id":427},"_7-security-measures","7. Security Measures",[153,430,431,432,435,436,339],{},"Details of such measures are set out in the ",[157,433,434],{},"Varnish Security Policy",", which is provided in a separate document and available at:\n",[334,437,438],{"href":438,"rel":439},"https://www.varnish-cdn.com/legal/security-and-compliance",[338],[197,441,443],{"id":442},"_8-confidentiality","8. Confidentiality",[153,445,446],{},"Varnish ensures that all personnel authorised to process Personal Data are subject to appropriate confidentiality obligations and access such data only as necessary\nto perform the Services.",[197,448,450],{"id":449},"_9-sub-processing","9. Sub-processing",[153,452,453,456,457,339],{},[157,454,455],{},"9.1 Authorized Sub-processors:"," Varnish utilizes various affiliates and third-party infrastructure providers to support the CDN Services. The Partner provides general\nwritten authorization for Varnish to engage the Sub-processors listed in the Varnish Privacy Notice ",[334,458,336],{"href":336,"rel":459},[338],[153,461,462,465],{},[157,463,464],{},"9.2 Sub-processor Obligations:"," Varnish shall ensure all Sub-processors are bound by written agreements containing data protection terms no less protective than\nthose established in this DPA. Varnish remains fully liable to the Partner for the performance of its Sub-processors' obligations.",[197,467,469],{"id":468},"_10-geographic-processing-and-data-transfers","10. Geographic Processing and Data Transfers",[153,471,472],{},"Traffic Data processed as part of Varnish's Sovereign Service Layer shall be stored and processed within the European Union (EU)/European Economic Area (EEA). Varnish\nshall not transfer Traffic Data outside the EU/EEA unless instructed by the Partner or required by applicable EU/EEA law. Where the Partner instructs Varnish to deploy\nnodes or process Traffic Data outside the EU/EEA, the transfer shall be governed as follows:",[166,474,475,478],{},[169,476,477],{},"Transfers to countries recognized by the European Commission as providing an adequate level of data protection pursuant to Article 45 GDPR shall rely directly on\nthe applicable adequacy decision.",[169,479,480,481],{},"Transfers to countries without an adequacy decision shall be governed by the EU Standard Contractual Clauses (Module 3: Processor-to-Processor), which are hereby\nincorporated into this DPA by reference and available at ",[334,482,483],{"href":483,"rel":484},"https://www.varnish-cdn.com/",[338],[197,486,488],{"id":487},"_11-assistance","11. Assistance",[153,490,491],{},"Varnish shall, taking into account the nature of processing and to the extent technically feasible, assist the Partner in complying with its obligations under the\nGDPR, including with respect to responding to data subject requests under Articles 12–23 GDPR and meeting obligations relating to security, personal data breaches,\ndata protection impact assessments, and consultations with supervisory authorities, provided that such assistance will be performed at the Partner's cost.",[197,493,495],{"id":494},"_12-personal-data-breach","12. Personal Data Breach",[153,497,498],{},"Varnish shall notify the Partner without undue delay, and in any event within 72 hours after becoming aware of a Personal Data Breach affecting Traffic Data, and\nshall provide information reasonably necessary for the Partner to comply with its legal obligations. The Partner is solely responsible for notifying the End-User\nController of the breach.",[197,500,502],{"id":501},"_13-audit","13. Audit",[153,504,505],{},"Upon at least two (2) months' prior written notice from the Partner, Varnish shall make available relevant documentation, audit summaries, or certifications\ndemonstrating compliance with this DPA. Audit shall be limited to processing of Traffic Data under this DPA and reasonably necessary to verify compliance. Audit shall\nbe carried out by the Partner or an independent third-party auditor mandated by the Partner and bound by confidentiality, and shall not unreasonably interfere with\nVarnish's operations or service delivery. The Customer shall treat all non-public information obtained during the audit as confidential and shall only have access to\nthe information that Varnish provides in relation to the audit. Any audit shall be conducted at the Partner's expense and shall not occur more than once per calendar\nyear.",[197,507,509],{"id":508},"_14-liability","14. Liability",[153,511,512],{},"Liability arising under this DPA shall be subject to the limitations set out in the Partner Agreement.",[197,514,516],{"id":515},"_15-order-of-precedence","15. Order of Precedence",[153,518,519],{},"In the event of conflict between this DPA and the Partner Agreement, this DPA shall prevail with respect to data protection matters.",[197,521,523],{"id":522},"_16-governing-law-and-dispute-resolution","16. Governing Law and Dispute Resolution",[153,525,526],{},"This DPA shall be governed by the laws and jurisdiction set out in the Partner Agreement, which contains all relevant provisions regarding governing law and dispute\nresolution.",[197,528,530],{"id":529},"_17-changes-to-this-dpa","17. Changes to this DPA",[153,532,533],{},"Varnish may update this DPA from time to time to reflect changes in applicable law (including data protection law), industry standards, or updates to the Services,\nwith such changes taking effect upon publication. For material changes, including any material changes to its Sub-processors, Varnish will use reasonable efforts to\nprovide at least 30 days' prior notice. What constitutes a material change shall otherwise be determined at Varnish's reasonable discretion. Any objections to proposed\nSub-processor changes must be presented timely and based on reasonable, documented data-protection grounds.",{"title":535,"searchDepth":536,"depth":536,"links":537},"",2,[538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554],{"id":199,"depth":536,"text":200},{"id":250,"depth":536,"text":251},{"id":342,"depth":536,"text":343},{"id":377,"depth":536,"text":378},{"id":398,"depth":536,"text":399},{"id":420,"depth":536,"text":421},{"id":427,"depth":536,"text":428},{"id":442,"depth":536,"text":443},{"id":449,"depth":536,"text":450},{"id":468,"depth":536,"text":469},{"id":487,"depth":536,"text":488},{"id":494,"depth":536,"text":495},{"id":501,"depth":536,"text":502},{"id":508,"depth":536,"text":509},{"id":515,"depth":536,"text":516},{"id":522,"depth":536,"text":523},{"id":529,"depth":536,"text":530},"This Data Processing Agreement (\"DPA\") forms part of the agreement governing the provision of the Services (the \"Partner Agreement\") between:","md","partner",{},true,"/legal/dpa-partner",{"title":148,"description":555},"legal/dpa-partner","September 2026",null,"oOhoNTTOUv0vci3Z1U1plyehT7A1O9ilURA-cVc2bls",1791970578935]