Data processing agreement

This agreement is between you, the customer, and GOO HOLDINGS LTD, trading as runners.io, company number 17141115 (“we”). It forms part of our terms of service and applies whenever we process personal data on your behalf in providing the service. Where it and the terms disagree about personal data, this agreement wins.

For that data you are the controller and we are your processor, under the UK GDPR and the Data Protection Act 2018, and under the EU GDPR where it applies to you. For the data we hold about you as our customer — your account, your invoices — we are the controller, and our privacy policy covers it instead.

• Subject matter: running your CI jobs and Terraform-compatible runs, and storing what they need and produce.
• Duration: for as long as we provide the service to you, and afterwards until the data is deleted under clause 9.
• Nature: executing your code on machines we operate; collecting and storing build logs, test results, caches and sticky disks; storing Terraform configuration, variables, state, plans and run output; and sending results back to GitHub.
• Purpose: only to provide the service you asked for, and to keep it secure for you and for the other customers on it. We do not use your data for our own purposes, sell it or use it to train models.

We do not choose what personal data passes through the service; you do, by what you run. In practice it is:

• Categories of people: your staff and contractors, the authors of commits in your repositories, and anyone whose details appear in your code, build output, test data or infrastructure.
• Categories of data: names, usernames and email addresses in commits and logs; whatever your build prints or your tests use; and whatever your Terraform configuration and state hold, which can include credentials, IP addresses and account identifiers.
• Special category data: the service is not designed for it. Do not put it through the service unless you have made sure that is lawful and that this agreement is enough.

• We process the data only on your documented instructions. These terms, this agreement and the way you configure the service are those instructions. If the law requires us to do otherwise, we will tell you first unless the law forbids it, and we will tell you if we think an instruction breaks data protection law.
• Everyone we allow to process the data is bound to keep it confidential.
• We keep the data secure with the technical and organisational measures described on our security page, which UK GDPR Article 32 requires: among them a virtual machine started fresh from our image for every job, which is destroyed, or rebuilt from that image, when the job ends so that nothing the job leaves on its machine can be seen by another job; encryption in transit; and encryption at rest for your caches, sticky disks, account data and Terraform state.
• We help you meet your own obligations, as clause 8 says, and we give you the information you need to show that we keep this agreement, as clause 10 says.

You give us general authorisation to use the sub-processors listed in clause 5 of our privacy policy, which says what each does and where. Each of them is bound by data protection terms no less protective than this agreement, and we remain responsible to you for what they do. GitHub is not a sub-processor: we send data to GitHub only on your instruction, under your own agreement with it.

Before we add or replace a sub-processor, we update that list and email your organisation’s owners at least 30 days in advance. If you object on reasonable data protection grounds, tell us within that time. If we cannot resolve it, you may end the service and you pay nothing for the period after the change.

Your jobs run, and what they produce is stored, in the United Kingdom and the European Economic Area, which UK law treats as adequate. Where the EU GDPR applies to you, your data comes to us under the European Commission’s adequacy decision for the United Kingdom or, failing that, the EU Standard Contractual Clauses.

These sub-processors also process data in the United States, or worldwide: Google Cloud, Vercel, Stripe, Resend, Infracost, Google Workspace. Clause 5 of the privacy policy says what each one does. We transfer personal data to them only where one of these safeguards is in place: a UK adequacy regulation, including the UK extension to the EU–US Data Privacy Framework where the company is certified under it; the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses; and, for data subject to the EU GDPR, the EU Standard Contractual Clauses.

If we become aware of a personal data breach affecting data we process for you, we will tell your organisation’s owners without undue delay, and no later than 72 hours after we become aware of it. We will tell you what happened, what data and how many people are likely to be affected, the likely consequences, and what we have done and will do about it. If we do not know all of that yet, we will tell you what we know and follow up as we learn more. We will help you with any notice you have to give to a regulator or to the people affected.

We will help you respond to people exercising their rights over their data, and with data protection impact assessments and any consultation with a regulator that concerns the service. Most of this you can do yourself in the dashboard and through the API; for the rest, write to legal@runners.io. If we receive a request directly from someone whose data you control, we pass it to you rather than answer it ourselves.

Until the service ends you can download your Terraform state, as our guide to leaving describes, and read your build output for as long as clause 7 of the privacy policy says we keep it. When the service ends, or when you ask us to, we delete the personal data we process for you within 30 days, unless the law requires us to keep it. Copies in our backups are deleted as those backups age out, within 8 more days.

We will give you the information you reasonably need to show that we keep this agreement. If that is not enough, you, or an independent auditor bound to confidentiality, may audit our compliance once in any 12 months, on 30 days’ written notice, during business hours and without disrupting the service for other customers. You may audit more often after a breach, or if a regulator requires it. Each of us bears its own costs.

Each party’s liability under this agreement is subject to clause 8 of the terms of service. Nothing in this agreement limits either party’s liability to the people whose data it is, or to a regulator. This agreement is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction, except where the EU Standard Contractual Clauses require otherwise for the transfers they cover.