1. Parties and scope
This Data Processing Agreement (“DPA”) is between DIGISMART MEGA LTD (“Processor”), trading as SmartCodeFixer, and the business customer that uses SmartCodeFixer (“Controller”). It forms part of our Terms of Service and applies when the Controller's users submit personal data within code or error details. If this DPA conflicts with the Terms on data protection, this DPA prevails.
Terms such as “personal data” and “processing” have the meanings given in the UK GDPR and EU GDPR.
2. Processing details
- Purpose: analysing submitted code and error details to provide explanations and fixes, keeping fix history and personalising suggestions.
- Data: any personal data contained in submitted code, files and error messages; user account details (name, email).
- Data subjects: the Controller's users, and any individuals whose data appears in submitted code.
- Duration: while the Controller has access, plus the retention period in section 6.
3. Processor obligations
The Processor will:
- process personal data only on the Controller's documented instructions, including those given through the service;
- not use personal data or submitted code to train AI models or for any other purpose;
- make sure anyone processing the data is bound by confidentiality;
- keep appropriate technical and organisational security measures in place (section 7);
- help the Controller respond to data subject requests and meet its security, breach and impact-assessment obligations;
- notify the Controller without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach;
- delete or return personal data at the end of the service, unless the law requires it to be kept;
- make available the information needed to show compliance with this DPA.
4. Sub-processors
The Controller authorises the Processor to use the sub-processors below. The Processor will tell the Controller about any new sub-processor in advance, giving it a chance to object, and will bind each sub-processor to data protection terms equivalent to this DPA.
| Sub-processor | Purpose | Location |
|---|---|---|
| Airwallex | Payment processing (card payments, refunds) | UK / EU / global |
| OpenAI | AI models that generate explanations and fixes (business API) | United States |
| Anthropic | AI models that generate explanations and fixes (business API) | United States |
| Hostinger | Website hosting | Data centre of our hosting plan (EU or US) |
OpenAI and Anthropic are used through their business API services, under terms that do not allow them to use API data to train their models.
5. International transfers
Where personal data is transferred outside the UK or EEA, the Processor relies on adequacy regulations where available, or on the UK International Data Transfer Addendum and the EU Standard Contractual Clauses.
6. Retention
Fix history and account data are kept while the Controller has access and for 90 days after the last access period ends, then deleted, unless the Controller asks for earlier deletion or the law requires longer retention.
7. Security measures
- Encryption in transit (TLS) and at rest
- Authentication credentials stored only in hashed form
- Access to personal data limited to what is needed to run and support the service
- Use of sub-processors bound by written data protection terms (section 4)
8. Governing law and signed copies
This DPA is governed by the law of England and Wales. To request a signed copy or raise a data protection question, email info@smartcodefixer.com.