Data Processing Agreement
This Data Processing Agreement ("DPA") forms part of the ChangelogForge Terms of Service between the customer (the "Controller") and Universal Global Services Ltd (Company No. 17423506, the "Processor").
1. Scope
This DPA applies to personal data processed by ChangelogForge on behalf of the Controller, including account data, repository metadata and content used to generate changelogs. To the extent the Controller is a business customer, the Processor acts as a data processor; where the Controller is an individual consumer, the Privacy Policy applies instead.
2. Processing instructions
The Processor processes personal data only on documented instructions from the Controller, unless required otherwise by law. The subject matter is the provision of automated changelog generation and release publishing.
3. Sub-processors
The Processor uses sub-processors including Google and Microsoft (sign-in and account authentication), GitHub (repository integration and release publishing), Stripe (payments and tax) and hosting and LLM infrastructure providers. The Processor remains responsible for its sub-processors and will inform the Controller of material changes through the Service.
4. Security
The Processor implements appropriate technical and organisational measures including encryption in transit, access controls, secret scanning, backups and monitoring.
5. Data subject rights and assistance
The Processor will assist the Controller in responding to data subject requests and in complying with obligations under applicable data protection law.
6. Breach notification
The Processor will notify the Controller without undue delay after becoming aware of a personal data breach affecting Controller data.
7. International transfers
To the extent personal data is transferred outside the UK or EEA, transfers are protected by UK or EU Standard Contractual Clauses or an equivalent lawful transfer mechanism.
8. Contact
Last updated: 15 September 2026.