BIMP Beta Data Processing Addendum
Version: v1.0
Effective date: 4 August 2026
1. Scope
This Data Processing Addendum (“DPA”) forms part of the BIMP Beta Terms and Conditions governing your use of BIMP (the “Agreement”).
It applies only where you are the controller of personal data processed through BIMP and Pendrica Ltd is processing that data on your behalf.
Personal data that Pendrica processes for its own purposes, including account management and communications, is covered by the BIMP Beta Privacy Policy.
Terms such as controller, processor, personal data, processing, data subject and personal data breach have the meanings given in the UK GDPR.
2. Your responsibilities
You are responsible for ensuring that:
- you have a lawful basis for the processing;
- any required privacy information has been provided;
- your instructions comply with data protection law; and
- you have the right to provide or make the personal data available to BIMP.
Your use and configuration of BIMP constitute your documented instructions to Pendrica.
3. Pendrica’s responsibilities
Pendrica will:
- process personal data only on your documented instructions, unless required otherwise by law;
- tell you if we believe an instruction infringes data protection law;
- ensure that people authorized to process the data are subject to confidentiality obligations;
- maintain appropriate technical and organizational security measures;
- notify you without undue delay after becoming aware of a personal data breach;
- provide reasonable assistance with data subject requests, security obligations, data protection impact assessments and regulatory inquiries;
- provide information reasonably necessary to demonstrate compliance with this DPA; and
- permit reasonable audits where that information is not sufficient, subject to reasonable notice and appropriate confidentiality and security protections.
4. Subprocessors
You authorize Pendrica to use the subprocessors listed in Schedule 2.
Pendrica may add or replace subprocessors. The current list and any intended changes will be published in Schedule 3. You agree that publication on that page constitutes notice of the change.
Before a new subprocessor begins processing personal data on your behalf, you will have a reasonable opportunity to object by contacting hello@bimp.ai. Any objection must be based on reasonable data protection grounds.
Pendrica will require its subprocessors to provide an equivalent level of data protection and will remain responsible for their compliance with those obligations.
Services that you choose to connect to BIMP, such as repository providers or notification destinations, are not Pendrica’s subprocessors.
5. Hosting and international transfers
BIMP is hosted using Google Cloud’s global infrastructure. Information about Google Cloud’s data processing practices and locations is available in its Cloud Data Processing Addendum and Cloud locations documentation.
Information about Google Cloud’s processing and locations is available in its:
Pendrica will ensure that transfers of personal data comply with UK data protection law. Where required, we will use an appropriate safeguard, such as UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to approved standard contractual clauses.
If you would like to discuss dedicated or privately hosted deployment options, contact hello@bimp.ai.
6. Ending the processing
When your use of BIMP ends, you may ask Pendrica to return or delete personal data processed on your behalf.
If you do not request its return, your instruction is for Pendrica to delete it. Pendrica may retain data where required by law, and data held in backups will be deleted through our ordinary backup deletion process.
7. General
The liability provisions and governing law in the Agreement also apply to this DPA. Nothing limits any rights or liabilities that cannot lawfully be limited.
If this DPA conflicts with the Agreement on the processing of personal data, this DPA takes priority.
This DPA continues for as long as Pendrica processes personal data on your behalf.
Privacy inquiries can be sent to privacy@pendrica.com.
Schedule 1: Processing details
| Detail | Description |
|---|---|
| Subject matter | Providing and operating BIMP |
| Duration | While you use BIMP and for any period required to return or delete the data |
| Nature and purpose | Connecting to repositories selected by you, scanning repository content, providing findings and recommendations, and supporting BIMP-generated changes and related comments |
| Types of personal data | Usernames, repository account identifiers, comments or replies, and personal data incidentally included in repository content |
| Data subjects | BIMP users and individuals who interact with BIMP-generated changes or comments |
| Special category data | BIMP is not intended to process special category data or criminal offense data |
Schedule 2: Approved subprocessors
| Subprocessor | Purpose | Website | References |
|---|---|---|---|
| Google Cloud | Hosting, storage and infrastructure | Google Cloud | Data Processing Addendum, Privacy Notice, Subprocessors, Data residency, Locations |
| Resend | Transactional email delivery | Resend | Data Processing Addendum, Privacy Policy, Subprocessors, GDPR information |
| Google Workspace | Business communications and administration | Google Workspace | Data Processing Addendum, Privacy Notice, Subprocessors, Service-specific terms, Security and data use |
| Posthog | Product Analytics | Posthog | Privacy Policy, Subprocessors |
Schedule 3: New subprocessors
None at present