LEGAL
Data processing agreement
Effective 16 September 2026. This page describes how personal data is handled when we build or operate a platform on a client's behalf. It is a description of the general position, not the signed DPA itself, which is put in place per engagement where one is needed.
When a DPA applies
A data processing agreement is relevant whenever a platform we build or operate handles personal data belonging to a client's customers, users or staff. For that engagement, the client is typically the data controller and Gigagrams is the processor, acting only on the client's documented instructions.
What we actually process
This varies by engagement and is scoped in writing before work starts. As a general position: we process what a platform genuinely needs to function, records, transactions and content generated by its use, and nothing beyond that. Analytics data used to monitor and improve a platform is anonymised and de-identified, numbers rather than names, as a standing engineering principle here, not a per-project promise.
Subprocessors
Some processing runs through named third-party services, payment processing, messaging and infrastructure among them. The current list is published on the subprocessors page and kept current there rather than duplicated here.
Security measures
Platforms run on hardened Linux servers at DigitalOcean in Frankfurt, and our security practice is measured against the NIST Cybersecurity Framework, currently at Tier 3 Repeatable, working toward Tier 4 Adaptive. Measures are published, not guaranteed: no system is beyond attack, and we say so rather than claim otherwise.
International transfer
Gigagrams operates from offices in Dubai, UAE and Morganville, New Jersey, USA. Data may be processed in either location depending on where a given engagement is run. Where a client's own regulatory position requires specific transfer terms, those are agreed in writing as part of that engagement's DPA.
Retention and deletion
Data is retained for as long as an active engagement requires it and is deleted or returned at the engagement's end, on request. Specific retention periods for a given platform are set out in that platform's own agreement, since they depend on what the platform is and what it is legally required to keep.