Sibylline Platform Data Processing Agreement

Document control

1. Scope and precedence

1.1 This Data Processing Agreement ("DPA") is between Sibylline Labs Limited ("Sibylline") and the Organisation that has accepted the Sibylline Platform Terms of Service (the "Terms"). It forms part of the Terms and takes effect when the Terms do. No signature is needed. An Organisation that needs a signed copy can ask contact@sibylline.group.

1.2 This DPA applies to Customer Personal Data: personal data contained in Customer Data that Sibylline processes on the Organisation's behalf in providing the Services. It does not apply to Account Data, Usage Data or Vendor Reports, which Sibylline processes as a controller under the Privacy Policy.

1.3 If this DPA conflicts with the rest of the Terms on a data protection matter, this DPA prevails. Capitalised terms not defined here have the meanings in the Terms.

2. Definitions

• Data Protection Laws means the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications (EC Directive) Regulations 2003, and, where the Organisation is established in the EEA or the processing is otherwise subject to it, the EU GDPR, together with any law that replaces or supplements them.
• UK GDPR means Regulation (EU) 2016/679 as it forms part of the law of England and Wales, Scotland and Northern Ireland under the European Union (Withdrawal) Act 2018. EU GDPR means Regulation (EU) 2016/679.
• Customer Personal Data has the meaning in clause 1.2.
• Sub-processor means a third party Sibylline engages to process Customer Personal Data on its behalf.
• Personal Data Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
• Controller, processor, data subject, personal data, processing and supervisory authority have the meanings given in the Data Protection Laws.

3. Roles

3.1 For Customer Personal Data, the Organisation is the controller and Sibylline is the processor. Where the Organisation is itself a processor for its own client (for example, an agency managing a client's Linear workspace), the Organisation warrants that its client has authorised the processing described here and that the instructions in this DPA are consistent with the client's instructions.

3.2 Annex 1 describes the subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects.

4. Sibylline's obligations as processor

4.1 Instructions. Sibylline will process Customer Personal Data only on the Organisation's documented instructions, which are: the Terms, this DPA, the Organisation's configuration in the Portal and the CLI, and any further written instruction the Organisation gives that is consistent with them. Sibylline may also process Customer Personal Data where required by law, in which case it will tell the Organisation first unless the law forbids it. Sibylline will tell the Organisation if, in its opinion, an instruction breaches the Data Protection Laws.

4.2 Confidentiality. Sibylline will ensure that every person it authorises to process Customer Personal Data is bound by a duty of confidentiality, and that access is limited to those who need it to perform the Services.

4.3 Security. Sibylline will implement and maintain the technical and organisational measures in Annex 2, and such other measures as are appropriate to the risk under Article 32 of the UK GDPR. Sibylline may update the measures from time to time provided the overall level of protection does not fall.

4.4 Sub-processors. Clause 6 applies.

4.5 Data subject requests. Taking into account the nature of the processing, Sibylline will assist the Organisation, through appropriate technical and organisational measures, in responding to requests from data subjects exercising their rights. If Sibylline receives such a request directly, it will forward it to the Organisation within five business days and will not respond to the data subject except to acknowledge receipt and direct them to the Organisation.

4.6 Assistance. Sibylline will assist the Organisation in meeting its obligations under Articles 32 to 36 of the UK GDPR (security, breach notification, data protection impact assessments and prior consultation), taking into account the nature of the processing and the information available to Sibylline. Sibylline may charge a reasonable fee for assistance that goes beyond what the Services and the Portal already provide.

4.7 Deletion at the end. When the Services end for a Product, or the Organisation deletes the Organisation or its data in the Portal, Sibylline will delete the Customer Personal Data as set out in clause 10.6 of the Terms and the applicable Schedule. Return is not offered separately, because every delivered Report is already held in the Organisation's own Linear workspace. Sibylline may keep Customer Personal Data where the law requires it, and only for as long as the law requires. On request, Sibylline will confirm deletion in writing.

4.8 Information and audit. Clause 9 applies.

4.9 No other use. Sibylline will not use Customer Personal Data for its own purposes, sell it, or use it to train machine-learning or AI models.

5. The Organisation's obligations

5.1 The Organisation is responsible for the lawfulness of the Customer Personal Data it submits and of its instructions, including having a lawful basis for the processing and giving data subjects any notices required.

5.2 The Organisation will not submit, and will configure its Users and Agents so that they do not submit, special category data, criminal offence data, payment card data, credentials or secrets in Reports. Sibylline's redaction is a safeguard and not a substitute for this obligation.

5.3 The Organisation will keep its destination configuration, Users and credentials under review, and will revoke access for anyone who no longer needs it.

5.4 The Organisation acknowledges that the Services store and process Customer Personal Data in the United States only (clause 7), and that it is responsible for deciding whether that location is appropriate for the data it submits.

6. Sub-processors

6.1 The Organisation gives Sibylline general authorisation to engage Sub-processors. The Sub-processors engaged at the date of this DPA are listed in Annex 3.

6.2 Sibylline will give the Billing Administrator at least 30 days' notice by email before adding or replacing a Sub-processor that processes Customer Personal Data, and will keep the list in Annex 3, as published at the Portal, up to date.

6.3 If the Organisation objects to a new Sub-processor on reasonable data protection grounds, it must tell Sibylline in writing within the notice period. The parties will discuss the objection in good faith. If Sibylline cannot reasonably accommodate it, the Organisation may terminate the affected Product by notice before the change takes effect, and Sibylline will refund any Fees paid in advance for the period after termination.

6.4 Sibylline will impose on each Sub-processor, by written contract, data protection obligations that provide at least the same level of protection as this DPA. Sibylline remains fully liable to the Organisation for the performance of its Sub-processors.

7. International transfers

7.1 Sibylline is established in the United Kingdom. Its Sub-processors store and process Customer Personal Data in the United States. The Services are offered in one region only, and Sibylline does not offer storage in the United Kingdom, the EEA or elsewhere.

7.2 Where the Organisation is in the United Kingdom, the transfer of Customer Personal Data from the Organisation to Sibylline is not a restricted transfer. The onward transfer from Sibylline to its Sub-processors in the United States is Sibylline's restricted transfer, and Sibylline makes it under one of these mechanisms: the UK-US data bridge (the UK Extension to the EU-US Data Privacy Framework), where the Sub-processor is certified under it; or the International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the Information Commissioner's Office, incorporated in Sibylline's contract with the Sub-processor. Annex 3 states which applies to each Sub-processor.

7.3 Where the Organisation is in the EEA, the transfer to Sibylline in the United Kingdom is covered by the European Commission's adequacy decision for the United Kingdom, and Sibylline's onward transfers are made under the EU Standard Contractual Clauses in its Sub-processor contracts, or under the EU-US Data Privacy Framework where the Sub-processor is certified.

7.4 Where the Organisation is elsewhere, the Organisation is responsible for ensuring that its transfer of Customer Personal Data to Sibylline complies with the law that applies to it. Sibylline will cooperate reasonably, including by entering into standard contractual clauses that the Organisation's law requires, at the Organisation's cost where that cost is material.

7.5 Sibylline will give the Organisation a copy of the transfer safeguards it relies on, on request, with commercial terms redacted.

8. Personal Data Breaches

8.1 Sibylline will notify the Billing Administrator by email without undue delay, and in any case within 48 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data.

8.2 The notification will describe, so far as Sibylline knows at the time, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. Sibylline may provide the information in stages as it becomes available.

8.3 Sibylline will cooperate with the Organisation and take reasonable steps to contain, investigate and remedy the breach. Sibylline's notification is not an admission of fault.

9. Information and audit

9.1 Sibylline will make available to the Organisation the information reasonably necessary to demonstrate compliance with Article 28 of the UK GDPR, including this DPA, Annex 2, the audit events for the Organisation available in the Portal, and summaries of any third-party security assessments of the Services or its Sub-processors that Sibylline holds.

9.2 If that information does not reasonably satisfy the Organisation, the Organisation may, no more than once in any 12 months unless a supervisory authority requires it or a Personal Data Breach has occurred, audit Sibylline's compliance with this DPA. An audit requires at least 30 days' written notice, takes place during business hours, must not unreasonably disrupt Sibylline's operations, is limited to systems that process Customer Personal Data, and is at the Organisation's cost. An auditor must be bound by confidentiality and must not be a competitor of Sibylline. Audits of Sub-processors are limited to the audit rights Sibylline itself has against them.

10. Liability and term

10.1 Each party's liability under this DPA is subject to the exclusions and limits in clause 18 of the Terms. The parties agree that those limits apply to the aggregate of all liability under the Terms and this DPA.

10.2 This DPA lasts for as long as Sibylline processes Customer Personal Data on the Organisation's behalf, and clause 4.7 survives until deletion is complete.

10.3 This DPA is governed by the law of England and Wales, and clause 23 of the Terms applies to any dispute under it.

Annex 1: Details of the processing

Annex 2: Technical and organisational measures

Annex 3: Sub-processors

Current as of 30 October 2026. Changes are notified under clause 6.2.

Not a Sub-processor. Linear Orbit, Inc. receives Reports when Sibylline delivers them to the Organisation's Linear workspace. Linear acts for the Organisation under the Organisation's own agreement with Linear, on the Organisation's authorisation given when it installs the Eris Yaks app. The Organisation is responsible for its relationship with Linear, including Linear's data location and transfer terms.

Change log