Updated October 31, 2026
The tools you connect can hold other people’s personal data.
For that data, you are the controller and Galliano AS processes it for you.
This Data Processing Agreement sets out how, under Article 28 of the GDPR.
It is part of the Terms of Service and applies automatically.
We process the data only on your instructions: these terms, your settings, and what you do in AppWhy.
If we believe an instruction breaks data protection law, we tell you.
We never use the data for another customer, for benchmarks, or for any purpose of our own.
Everyone at AppWhy who can reach the data is bound to keep it confidential.
They use it only to help you when you ask, or to fix a problem.
You authorise these companies to process the data for us:
We tell you at least 14 days before we add or replace one.
You can object. If we can’t solve it, you can end your use of AppWhy.
We keep this list current, and choose only companies whose own data processing terms protect the data.
Where data leaves the EEA, it is protected by:
We help you answer people who use their rights, such as to see or delete their data.
We help with impact assessments and with the data protection authority, where it’s reasonable.
If a breach affects the data, we tell you without undue delay, and within 48 hours of confirming it.
We tell you what we know, what we are doing, and what you may need to do.
Delete a workspace or an account in Profile and account, and its data is deleted at once.
Stored files follow shortly after, and backups within 7 days.
Export what you want to keep first, from Settings.
We give you the information you need to see that we meet this agreement.
You may audit once a year, with 30 days’ notice, at your cost, by an auditor bound to confidentiality.
The liability limits in our Terms apply to this agreement.
Where this agreement and the terms differ on personal data, this agreement wins.
Processor: Galliano AS, Karjolvegen 51, 7712 Steinkjer, Norway.
Organisation number 933 775 240 MVA.
Contact: [email protected]