Data Processing Agreement

Preamble

This Data Processing Agreement ("DPA") forms part of the Terms of Service between the Customer ("Controller") and Black Cat Security ("Processor") and governs the processing of personal data by the Processor on behalf of the Controller in connection with the provision of the Service.

1. Definitions

For the purposes of this DPA, the following terms have the meanings ascribed to them in Article 4 of the General Data Protection Regulation (EU) 2016/679 ("GDPR"):

• "Controller" means the natural or legal person which determines the purposes and means of the processing of personal data — in this DPA, the Customer.
• "Processor" means the natural or legal person which processes personal data on behalf of the Controller — in this DPA, Black Cat Security.
• "Data Subject" means an identified or identifiable natural person whose personal data is processed.
• "Personal Data" means any information relating to an identified or identifiable natural person.
• "Sub-processor" means any third party engaged by the Processor to process personal data on behalf of the Controller.
• "Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored, or otherwise processed.

2. Scope and Roles

The Customer acts as the Controller and Black Cat Security acts as the Processor with respect to the personal data processed through the Service. This DPA supplements the Terms of Service and applies to all processing activities performed by the Processor on behalf of the Controller.

In the event of any conflict between this DPA and the Terms of Service, the provisions of this DPA shall prevail with respect to data protection matters.

3. Processing Instructions

The Processor shall process personal data only in accordance with the Controller's documented instructions, as set out in this DPA and the Terms of Service. The Processor shall not process personal data for any purpose other than the provision of the Service unless required to do so by applicable EU or Member State law, in which case the Processor shall inform the Controller of that legal requirement before processing, unless the law prohibits such information on important grounds of public interest.

The Processor shall immediately inform the Controller if, in its opinion, an instruction from the Controller infringes the GDPR or other applicable data protection legislation.

4. Categories of Data Processed

The following categories of personal data are processed by the Processor on behalf of the Controller in connection with the Service:

5. Sub-processors

The Controller authorises the Processor to engage the following sub-processors for the processing of personal data:

The Processor shall notify the Controller of any intended changes to its sub-processors at least 30 days before the new sub-processor begins processing personal data. The Controller shall have a period of 30 days from receipt of such notification to object in writing. If the Controller raises a reasonable objection, the parties shall discuss the matter in good faith and, if no resolution is reached, the Controller may terminate the affected services.

6. Security Measures

The Processor shall implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including but not limited to:

• Encryption of personal data at rest using AES-256.
• Encryption of personal data in transit using TLS 1.2 or higher.
• Role-based access control (RBAC) with mandatory multi-factor authentication (MFA) for all personnel with access to personal data.
• Comprehensive audit logging of all access to and modifications of personal data.
• Regular security assessments and vulnerability testing.
• Incident response procedures with defined escalation and notification processes.
• Employee training on data protection and information security, conducted at onboarding and at least annually.

7. Data Breach Notification

In the event of a Data Breach, the Processor shall notify the Controller without undue delay and in any case within 72 hours of becoming aware of the breach. The notification shall include:

• A description of the nature of the breach, including, where possible, the categories and approximate number of Data Subjects and personal data records concerned.
• The name and contact details of the data protection officer or other contact point.
• A description of the likely consequences of the breach.
• A description of the measures taken or proposed to address the breach, including measures to mitigate its possible adverse effects.

The Processor shall cooperate with the Controller and take all reasonable steps to assist in the investigation, mitigation, and remediation of the breach.

8. Data Subject Rights

The Processor shall assist the Controller in fulfilling its obligations to respond to requests from Data Subjects exercising their rights under the GDPR (including access, rectification, erasure, restriction, portability, and objection). The Processor shall promptly notify the Controller of any request received directly from a Data Subject and shall not respond to such requests except on the Controller's instructions.

The Processor shall provide reasonable cooperation and assistance, taking into account the nature of the processing and the information available to the Processor.

9. Audits

The Processor shall make available to the Controller all information necessary to demonstrate compliance with this DPA and shall allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller.

Audits shall be conducted with at least 30 days' written notice, during normal business hours, and in a manner that minimises disruption to the Processor's operations. The costs of the audit shall be borne by the Controller. The Processor may satisfy audit requirements by providing relevant certifications, audit reports, or compliance attestations from independent third parties.

10. International Data Transfers

Where personal data is transferred outside the European Economic Area (EEA), the Processor shall ensure that appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) adopted by the European Commission, adequacy decisions, or other GDPR-approved transfer mechanisms. The Processor shall inform the Controller of any transfer and provide details of the safeguards applied.

11. Data Return and Deletion

Upon termination or expiry of the Terms of Service, the Processor shall, at the Controller's election, either return all personal data to the Controller or delete it. The Controller shall have a period of 30 days following termination to request the export of its data in a standard format (JSON or CSV). After this period, the Processor shall securely delete all personal data, except where retention is required by applicable law.

The Processor shall provide written confirmation of deletion upon the Controller's request.

12. Duration and Termination

This DPA shall remain in effect for the duration of the Terms of Service and shall automatically terminate upon the termination or expiry of the Terms of Service. The obligations of the Processor regarding data protection, security, and confidentiality shall survive termination for as long as the Processor retains any personal data of the Controller.

13. Annexes

The following annexes form an integral part of this DPA:

• Annex A — Details of Processing: the categories of data processed, the Data Subjects concerned, and the purposes of processing are described in Section 4 of this DPA.
• Annex B — Technical and Organisational Measures: the security measures implemented by the Processor are described in Section 6 of this DPA.