Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between the Customer (controller) and [Legal entity name] (processor) and implements Article 28 of the General Data Protection Regulation (EU) 2016/679 (“GDPR”).

1. Roles

1.1 For investigation data — targets, tool output, evidence, findings and reports — the Customer is the controller and we are the processor.

1.2 We remain controller for account, billing and audit data, and for our own safeguards (the opt-out/suppression list and abuse detection). That processing is described in our Privacy Notice.

2. Details of the processing

Item	Description
Subject matter	Running OSINT investigations requested by the Customer
Duration	The term of the subscription plus the retention period
Nature	Collection from public sources, storage, correlation, reporting, deletion
Purpose	The purpose declared by the Customer for each investigation
Data subjects	Persons whose data appears in public infrastructure records (for example domain registrants or names in certificates); later, subjects of person searches
Categories of data	Technical identifiers (domains, IPs, host names), registration contact data, data in public certificates and web responses
Special categories	Not intended. The Customer must not instruct processing of special-category data or data about minors

3. Our obligations

We will:

process personal data only on the Customer’s documented instructions, including the declared purpose, unless EU or Member State law requires otherwise
ensure that authorised staff are bound by confidentiality
implement the technical and organisational measures in Annex 1 (Art. 32 GDPR)
use subprocessors only as set out in section 4
assist the Customer, taking into account the nature of the processing, in answering data-subject requests and with DPIAs and prior consultations
notify the Customer of a personal data breach without undue delay, and where feasible within 48 hours of becoming aware of it, so the Customer can meet its own 72-hour notification duty
make available the information needed to demonstrate compliance and allow audits, as set out in section 6

4. Subprocessors

4.1 The Customer gives general authorisation for the subprocessors listed on our Subprocessors page.

4.2 We will notify the Customer of new or replaced subprocessors at least 30 days in advance. The Customer may object on reasonable data-protection grounds; if we cannot resolve the objection, the Customer may terminate the affected service.

4.3 We impose data-protection obligations on each subprocessor equivalent to this DPA and remain liable for them.

5. International transfers

Hosting and storage are in the EU. Where a subprocessor processes data outside the EEA, we rely on an adequacy decision or the Standard Contractual Clauses, supported by a transfer impact assessment.

6. Audits

We will answer reasonable written questions and provide summaries of relevant certifications or third-party assessments. On-site audits require 30 days’ notice, take place no more than once a year unless a breach occurred, and are at the Customer’s cost. [Scope to be confirmed by counsel.]

7. Deletion and return

7.1 Evidence and reports are deleted at the end of the plan’s retention period, or earlier at the Customer’s request.

7.2 On termination, we delete investigation data within 30 days unless the Customer exports it first or law requires retention. Backups are kept for at most 30 days, and deletions are re-applied after any restore.

Annex 1 — Technical and organisational measures (summary)

EU hosting; encryption in transit (TLS) and at rest for evidence and reports
tenant isolation enforced in the application layer and covered by automated tests
short-lived signed download URLs (5 minutes or less); downloads are logged
tools run in short-lived, non-root, read-only sandbox containers whose network access goes through an egress proxy
managed authentication; MFA for owners, admins and verified tenants
least-privilege staff access through SSO and MFA; every admin action is audited
logs contain identifiers, not personal data; target values are hashed in logs
dependency and image scanning; yearly external penetration test
point-in-time backups kept 30 days or less, with quarterly restore tests