Verwerkersovereenkomst

Laatst bijgewerkt: 23 oktober 2026

Dit document is alleen in het Engels beschikbaar. De Engelse tekst is bindend.

This Data Processing Agreement ("DPA") forms part of the agreement between:

Controller: the customer using the Helium Rooms Service ("Customer")

Processor: Lighthouse Intelligence, a sole proprietorship (eenmanszaak) registered in the Netherlands (Chamber of Commerce number 75754355), operating the Helium Rooms platform ("Processor")

The Customer accepts this DPA by creating an account or using the Service. Terms not defined here have the meaning given in the Terms and the GDPR.

Deze verwerkersovereenkomst geldt voor accounts die op of na 23 oktober 2026 zijn aangemaakt, en voor bestaande accounts vanaf 23 november 2026.

1. Subject Matter and Duration

This DPA applies to the personal data the Processor processes on behalf of the Customer in connection with the Service. It lasts as long as the agreement, and after that until all such personal data has been returned or deleted.

2. Nature and Purpose of Processing

The Processor processes personal data only to provide, secure and support the Service, including:

  • Syncing data from the Customer's Linear workspace
  • Hosting the Customer's rooms and the comments, requests, votes, approvals and files added to them
  • Writing room input back into the Customer's Linear workspace
  • Authentication and access control
  • Sending emails such as invitations, notifications and digests
  • AI-assisted drafting of release notes, when the Customer uses it
  • Backups, error monitoring and abuse prevention
  • Customer support

Details are listed in Annex A. The Processor also processes limited usage and error data about the Service for its own purposes, such as product analytics and security. For that processing the Processor is an independent controller, as described in the Privacy Policy. The same applies to account and billing data of the Customer.

3. Instructions

  1. The Processor processes personal data only on documented instructions of the Customer, including with regard to transfers outside the EEA, unless EU or Dutch law requires otherwise. In that case the Processor informs the Customer of that legal requirement before processing, unless the law prohibits this. The agreement, this DPA and the Customer's configuration of the Service are the Customer's instructions.
  2. The Processor will inform the Customer if it believes an instruction infringes data protection law.

4. Obligations of the Processor

The Processor shall:

  • Ensure that anyone authorized to process the personal data is bound by confidentiality
  • Implement the security measures described in Annex B
  • Assist the Customer, taking into account the nature of the processing, in responding to requests from data subjects and in meeting its obligations under Articles 32 to 36 GDPR
  • Notify the Customer without undue delay after becoming aware of a personal data breach, and provide the information listed in Article 33(3) GDPR as it becomes available

5. Sub-processors

  1. The Customer gives general authorization for the use of sub-processors. The current sub-processors are:
    • Vercel Inc. (hosting)
    • Supabase Inc. (database and authentication)
    • Backblaze Inc. (file storage and backups)
    • GitHub Inc. (database backup job)
    • Resend Inc. (email delivery)
    • PostHog Inc. (product analytics)
    • Functional Software Inc., Sentry (error monitoring)
    • Anthropic PBC (AI-assisted drafting of release notes from text and Linear issues the Customer selects)
  2. The Processor will notify the Customer by email at least 30 days before adding or replacing a sub-processor. The Customer may object on reasonable grounds. If the objection cannot be resolved, the Customer may terminate the agreement and receive a refund of prepaid fees for the unused period.
  3. The Processor imposes data protection obligations on each sub-processor that offer the same level of protection as this DPA, and remains responsible for its sub-processors, subject to section 9.
  4. Linear is not a sub-processor. The Customer connects its own Linear workspace, and Linear processes that data under its own agreement with the Customer.

6. International Transfers

Where personal data is transferred to or accessed from outside the EEA, the Processor relies on the EU-US Data Privacy Framework where the recipient is certified, and otherwise on the EU Standard Contractual Clauses (Commission Decision 2021/914) in the sub-processor's data processing terms. A copy is available on request.

7. Return and Deletion

At the Customer's choice, the Processor will return the personal data in a common format or delete it, within 30 days after the Customer's request. When the Customer's account is closed, the Processor deletes the personal data within 30 days, unless the Customer asked for it to be returned first. Backups are deleted automatically within 60 days. The Processor may keep personal data only where EU or Dutch law requires it. Data that the Service wrote into the Customer's Linear workspace remains there.

8. Audit and Information

The Processor makes available the information reasonably necessary to demonstrate compliance with this DPA, for example by answering a security questionnaire. Once a year, and in addition after a personal data breach or when a supervisory authority requires it, the Customer may have an audit carried out with 30 days' notice, at its own cost, by an independent auditor bound by confidentiality, in a way that does not disrupt the Service or expose other customers' data.

9. Liability

Liability under this DPA is subject to the limitations in the Terms.

10. Governing Law

This DPA is governed by Dutch law. Disputes are submitted to the court named in the Terms.

Annex A: Details of Processing

  • Data subjects: the Customer's team members, the Customer's clients and other people invited to rooms, visitors of public rooms, and people mentioned in data synced from Linear
  • Personal data: names, email addresses, company names, issue and comment content, requests, votes, approvals, uploaded files, login and session data, IP addresses, and usage data
  • Special categories: none intended. The Customer should not place special categories of personal data in the Service.
  • Frequency: continuous, for the duration of the agreement

Annex B: Technical and Organizational Measures

  • Encryption in transit (TLS) for all traffic
  • Database storage encrypted at rest by the database provider
  • Separation of customers at database level through row-level security, and access checks in the application
  • Administrative access to production systems limited to one person
  • Verified signatures on incoming webhooks
  • Rate limiting on sending login codes, password resets, signup and visitor actions
  • Daily database backups, kept for up to 60 days
  • Error monitoring with sensitive request data removed