Trust · Last updated 28 September 2026
Data processing agreement
How Four Nibbles handles personal data that passes through your Fabric pipelines, written to meet Article 28 of the GDPR. It forms part of the terms of service and applies automatically; write to legal@fournibbles.com if you need a countersigned copy.
This document is a working draft and has not yet been reviewed by counsel. If you need a signed copy or have questions, write to legal@fournibbles.com.
1. Parties and roles
This agreement is between the customer who accepted the terms of service ("you", the controller) and Four Nibbles, [to be completed], of [to be completed] ("we", the processor). Where you are yourself a processor for someone else, we are your subprocessor and the same obligations apply.
"GDPR" means the EU General Data Protection Regulation 2016/679 and, where they apply, the UK GDPR and the Swiss Federal Act on Data Protection. "Customer personal data" means personal data in your sources, your destinations, or the connection settings you give us, that we process to provide the service.
2. What we process
| Subject matter | Reading changes from the sources you connect and writing them to the destinations you choose. |
|---|---|
| Duration | For as long as the terms of service are in force, then section 9. |
| Nature of processing | Connecting to, reading from, transforming (where you configure it), transmitting, and writing to your systems. Rows are held in memory only until committed to your destination; we do not store them. |
| Types of personal data | Whatever your selected tables contain — decided by you. Also credentials for your systems, which may identify an individual. |
| Data subjects | Whoever your selected tables describe — typically your customers, users, employees, or contacts. |
| Special categories | Only if you choose to replicate them; you are responsible for having a lawful basis to do so. |
3. Instructions
We process customer personal data only on your documented instructions: the terms of service, this agreement, and how you configure your pipelines. We will tell you if we believe an instruction breaks data protection law, and if the law requires us to process it otherwise, unless the law forbids telling you.
4. Confidentiality
Everyone we authorise to process customer personal data is bound by a duty of confidentiality.
5. Security
We maintain the technical and organisational measures described on our security page, which forms the annex of security measures to this agreement. In summary: secrets encrypted at rest; each workspace in its own namespace with deny-by-default network policy and its own database role restricted by row-level security; HTTPS for all traffic; passwordless, single-use sign-in; access to production limited to the people who operate the service. We may improve these measures, but will not reduce the overall level of protection.
6. Subprocessors
You authorise us to use the subprocessors listed below. We will give you at least 30 days' notice by email before adding or replacing one; if you object on reasonable data protection grounds and we can't resolve it, you may end the affected service and receive a pro-rated refund of prepaid fees. We impose data protection obligations on each subprocessor at least as protective as these, and remain responsible for them.
| Subprocessor | Purpose | Location |
|---|---|---|
| DigitalOcean, LLC | Hosting of the platform, its databases and the pipeline runners | |
| Cloudflare, Inc. | Website hosting and bot protection on the sign-in form (Turnstile) | Global network |
| Resend, Inc. | Delivery of sign-in links and account emails | United States |
Your destinations and sources are your own systems, chosen by you; the providers that host them are not our subprocessors.
7. Helping you
- Data subject requests. Your data lives in your own systems, where you can answer most requests directly. We will help with the rest, and pass on any request we receive about your data without answering it ourselves.
- Impact assessments and consultations. We will provide the information you reasonably need about our processing.
8. Personal data breaches
We will notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting customer personal data. We will tell you what we know — the nature of the breach, the data and people likely affected, its likely consequences, and what we are doing about it — and keep you updated as we learn more.
9. At the end
When the service ends, we stop processing and delete the workspace, its connection settings and its pipeline state within 60 days, unless the law requires us to keep something. Because your rows are written to your own destinations, you already hold them; there is nothing to return.
10. Audits
We will make available the information needed to show we meet this agreement, and answer your reasonable security questionnaires. If that is not enough, you may audit us, or have an independent auditor bound by confidentiality do so, once a year with 30 days' notice, during business hours, at your cost, and without access to other customers' data.
11. International transfers
Four Nibbles is based in India, and the service runs on DigitalOcean, LLC. For transfers of customer personal data from the EEA to a country without an adequacy decision, the parties agree to the Standard Contractual Clauses adopted by the European Commission in Decision 2021/914 — Module 2 (controller to processor), or Module 3 where you are a processor — which are incorporated by reference, with these choices: clause 7 (docking) applies; clause 9 option 2 (general authorisation, with the notice period in section 6); the optional language in clause 11 does not apply; clauses 17 and 18: the law and courts of Ireland. Annexes I and II are completed by sections 1, 2 and 5 of this agreement, and Annex III by section 6. For the UK, the International Data Transfer Addendum issued by the Information Commissioner applies; for Switzerland, the clauses apply with the Federal Data Protection and Information Commissioner as the competent authority.
12. General
Each party's liability under this agreement is subject to the limitations in the terms of service, to the extent the law allows. If this agreement conflicts with the terms of service, this agreement wins; if it conflicts with the Standard Contractual Clauses, the clauses win.