Spitfirev0.62.8 · What's new

Data Processing Agreement (DPA)

Version 2026-10-30.1, effective 31 October 2026.

1. Self-hosted: we do not process your test data

Spitfire is installed and run by the customer on the customer's own infrastructure. Test definitions, results, credentials, logs and any personal data contained in requests sent to the systems tested stay in the customer's installation and database. Albiferro Yazılım ve Sistem Limited Şirketi (Albiferro Software & System Limited Company) has no access to them and does not process them on the customer's behalf. The license key is verified offline. For this data the customer is the controller and no processor relationship exists with us, so for normal use no data processing agreement under GDPR Art. 28 is needed.

The data we receive as the seller (buyer and invoice details, account data) we process as a controller, as the Privacy notice and the GDPR privacy notice describe.

2. When this agreement applies

If, in the course of support, the customer chooses to give us data from its installation (for example a log file, a database export, a screenshot or a test definition) that contains personal data, we process that data as the customer's processor under the terms below. These terms form part of the license agreement with the customer; no signature is needed. A customer that needs a countersigned copy can ask contact@usespitfire.com.

Please remove or mask personal data before you send us support material whenever you can.

3. Processor terms (GDPR Art. 28(3))

  • Subject and duration: handling the support request; for as long as the request is open, then section 3.8.
  • Nature and purpose: reading and analysing the material to answer the support request; nothing else.
  • Data and data subjects: whatever the customer chooses to send; typically the customer's users and test accounts, or data subjects in the tested systems' requests.
  • Instructions: we process the data only on the customer's documented instructions (the support request is such an instruction), unless the law requires otherwise, in which case we tell the customer first if the law allows.
  • Confidentiality: only the people who handle the request see the data, and they are bound to confidentiality.
  • Security (Art. 32): the material is kept in access-controlled mailboxes and devices with encrypted storage and is not copied into other systems; it is not used to train any model or for any other customer.
  • Sub-processors: the material reaches us by e-mail through the providers listed on usespitfire.com/subprocessors (the mail delivery and routing services). We tell the customer in advance of a new sub-processor for this purpose by updating that list; the customer may object by writing to us. We impose the same data protection obligations on them.
  • Deletion: when the request is closed, we delete the material, at the latest 30 days later, unless the customer asks for it back first or the law requires us to keep it.
  • Assistance: we help the customer, as far as is reasonable, to answer data subjects' requests and to meet its obligations under Art. 32–36.
  • Breaches: we tell the customer without undue delay, and within 48 hours of becoming aware, of a personal data breach affecting its material.
  • Audits: we make available the information needed to show compliance with these terms and answer written questions; on-site audits by agreement.
  • Transfers: we are established in Türkiye. Where material comes from the EEA, the UK or Switzerland, the European Commission's Standard Contractual Clauses (module 2, controller to processor; with the UK Addendum where relevant) apply between the customer as exporter and us as importer, and are incorporated by reference.

4. Order of precedence

On data protection these terms prevail over other terms between us.