Data Processing Agreement

Preamble

This Data Processing Agreement ("DPA") forms part of the Terms of Service between the Customer ("Controller") and Black Cat Security ("Processor") and governs the processing of personal data by the Processor on behalf of the Controller in connection with the provision of the Service.

1. Definitions

For the purposes of this DPA, the following terms have the meanings ascribed to them in Article 4 of the General Data Protection Regulation (EU) 2016/679 ("GDPR"):

• "Controller" means the natural or legal person which determines the purposes and means of the processing of personal data — in this DPA, the Customer.
• "Processor" means the natural or legal person which processes personal data on behalf of the Controller — in this DPA, Black Cat Security.
• "Data Subject" means an identified or identifiable natural person whose personal data is processed.
• "Personal Data" means any information relating to an identified or identifiable natural person.
• "Sub-processor" means any third party engaged by the Processor to process personal data on behalf of the Controller.
• "Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored, or otherwise processed.

2. Scope and Roles

The Customer acts as the Controller and Black Cat Security acts as the Processor with respect to the personal data processed through the Service. This DPA supplements the Terms of Service and applies to all processing activities performed by the Processor on behalf of the Controller.

In the event of any conflict between this DPA and the Terms of Service, the provisions of this DPA shall prevail with respect to data protection matters.

3. Processing Instructions

The Processor shall process personal data only in accordance with the Controller's documented instructions, as set out in this DPA and the Terms of Service. The Processor shall not process personal data for any purpose other than the provision of the Service unless required to do so by applicable EU or Member State law, in which case the Processor shall inform the Controller of that legal requirement before processing, unless the law prohibits such information on important grounds of public interest.

The Processor shall immediately inform the Controller if, in its opinion, an instruction from the Controller infringes the GDPR or other applicable data protection legislation.

4. Categories of Data Processed

The following categories of personal data are processed by the Processor on behalf of the Controller in connection with the Service:

5. Sub-processors

The Controller authorises the Processor to engage the following sub-processors for the processing of personal data:

The Processor shall notify the Controller of any intended changes to its sub-processors at least 30 days before the new sub-processor begins processing personal data. The Controller shall have a period of 30 days from receipt of such notification to object in writing on reasonable grounds relating to the protection of personal data. If the Controller raises a reasonable objection, the parties shall discuss the matter in good faith and, if no resolution is reached within 30 days of the objection, the Controller may terminate the affected services and shall receive a pro-rata refund of any prepaid fees for the remainder of the then-current subscription term.

Where transfer mechanisms above reference adequacy decisions or the EU-US Data Privacy Framework, the Standard Contractual Clauses (Module 2 of Commission Implementing Decision (EU) 2021/914) apply as a fallback should those mechanisms cease to be in force.

6. Security Measures

The Processor shall implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as detailed in Annex B. The measures described below represent the minimum standards maintained by the Processor and shall not be materially reduced during the term of this DPA.

7. Data Breach Notification

In the event of a Data Breach, the Processor shall notify the Controller without undue delay and in any case within 48 hours of becoming aware of the breach. This notification timeline is stricter than the 72-hour obligation owed by the Controller to the supervisory authority under Article 33 of the GDPR, in order to give the Controller adequate time to meet its own regulatory obligations. The notification shall include:

• A description of the nature of the breach, including, where possible, the categories and approximate number of Data Subjects and personal data records concerned.
• The name and contact details of the data protection officer or other contact point.
• A description of the likely consequences of the breach.
• A description of the measures taken or proposed to address the breach, including measures to mitigate its possible adverse effects.

The Processor shall cooperate with the Controller and take all reasonable steps to assist in the investigation, mitigation, and remediation of the breach.

8. Assistance with Controller Obligations

The Processor shall assist the Controller in fulfilling its obligations to respond to requests from Data Subjects exercising their rights under the GDPR (including access, rectification, erasure, restriction, portability, and objection). The Processor shall promptly notify the Controller of any request received directly from a Data Subject and shall not respond to such requests except on the Controller's instructions.

The Processor shall provide reasonable cooperation and assistance, taking into account the nature of the processing and the information available to the Processor.

In accordance with Article 28(3)(f) of the GDPR, the Processor shall provide the Controller with reasonable assistance in fulfilling its obligations under Articles 32 to 36 of the GDPR, including (i) ensuring the security of processing, (ii) notifying personal data breaches to the supervisory authority and to data subjects where applicable, and (iii) carrying out data protection impact assessments and prior consultations with the supervisory authority. Such assistance is provided taking into account the nature of the processing and the information available to the Processor.

9. Audits

The Processor shall make available to the Controller all information necessary to demonstrate compliance with this DPA and shall allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller.

Audits shall be conducted with at least 30 days' written notice, during normal business hours, and in a manner that minimises disruption to the Processor's operations. The costs of the audit shall be borne by the Controller. The Processor may satisfy audit requirements by providing relevant certifications, audit reports, or compliance attestations from independent third parties.

10. International Data Transfers

For transfers to the United States, the Processor primarily relies on the EU-US Data Privacy Framework (Cloudflare, Inc. and Functional Software, Inc. (Sentry) are DPF-certified) and uses the SCCs as a fallback should the relevant adequacy decision cease to apply. For transfers to the United Kingdom, the Processor relies on the UK adequacy decision (Commission Implementing Decision (EU) 2021/1772). The Processor has performed and documented Transfer Impact Assessments (TIAs) consistent with the EDPB Recommendations 01/2020.

11. Data Return and Deletion

Upon termination or expiry of the Terms of Service, the Processor shall, at the Controller's election, either return all personal data to the Controller or delete it. The Controller shall have a period of 30 days following termination to request the export of its data in a standard format (JSON or CSV).

After the 30-day export period, the Processor shall delete personal data according to the following timelines: (a) personal data in production systems shall be deleted within 60 days; (b) personal data in backup systems shall be isolated from further processing and deleted within 180 days. During the period between isolation and deletion, backup data shall be protected by the same security measures described in Section 6 and shall not be used for any purpose other than disaster recovery. These timelines apply except where longer retention is required by applicable law, in which case this DPA continues to apply to the retained data.

Upon the Controller's request, the Processor shall provide a written certificate of destruction confirming the deletion of all personal data, specifying the date of deletion and the categories of data deleted.

12. Duration and Termination

This DPA shall remain in effect for the duration of the Terms of Service and shall automatically terminate upon the termination or expiry of the Terms of Service. The obligations of the Processor regarding data protection, security, and confidentiality shall survive termination for as long as the Processor retains any personal data of the Controller.

13. Annexes

The following annexes form an integral part of this DPA:

• Annex A — Details of Processing: the categories of data processed, the Data Subjects concerned, and the purposes of processing are described in Section 4 of this DPA.
• Annex B — Technical and Organisational Measures: the security measures implemented by the Processor are detailed in Section 6 of this DPA (subsections 6.1 through 6.8).
• Annex C — Standard Contractual Clauses (EU 2021/914 Modules 2 and 3): incorporated by reference; full text at scc-module-2-2021-914.pdf and populated Annexes I/II/III at scc-annex-i-ii-iii.pdf. SCC parameters populated in Section 10 of this DPA.