Appendix 4 – Data processing agreement

1. Parties and roles

This data processing agreement (the “DPA”) is entered into between the Customer as controller (the “Controller”) and Nansec Software AB as processor (the “Processor”) and forms an integral part of the Agreement.

The DPA applies only to the extent that the Processor processes personal data on the Controller’s behalf. The Parties’ roles are determined by the actual circumstances and applicable data protection law.

2. Subject matter and duration

The subject matter of the processing is the provision of DMARC Vision and thereby receiving, storing, structuring, analysing, presenting, protecting, exporting and deleting personal data to the extent required for the Service.

The processing continues for the term of the Agreement and for the subsequent period required for export, deletion, backup cycles or legal obligations under this DPA.

3. Nature and purpose

The processing is carried out to deliver features for email and domain security analysis, reporting, monitoring, alerts, support, troubleshooting and secure operation. The Processor may not process personal data for its own purposes.

As part of the Service, the Processor may anonymise data for statistics and capacity planning under clause 8 of the main agreement. Information that has been anonymised is not personal data and is not covered by this DPA.

4. Types of personal data

Depending on the Customer’s configuration and use of the Service, the processing may include:

• IP addresses, domain names and email addresses,
• identifiers and technical data related to email authentication,
• technical header, report and log data,
• user account and contact details, including user identity, assigned role and permission level in the Service,
• authentication metadata and time of login,
• technical log data related to use, operation, access control and security in the Service, and
• where applicable, in RUF reports, parts of message information or other personal data that appears in the report.

The processing is limited to the personal data necessary to provide, administer, monitor, troubleshoot and protect the Service and to carry out the processing that follows from the Customer’s use and configuration of the Service.

5. Categories of data subjects

Data subjects may include the Customer’s users and administrators, employees and contractors, senders and recipients of email, and other persons whose data appears in reports or technical logs processed on the Customer’s behalf.

6. Documented instructions

The Processor may process personal data only on documented instructions from the Controller, including the Agreement, the Customer’s configuration, and written instructions consistent with the agreed Service.

If the Processor is required by EU or Swedish law to process personal data otherwise, the Controller shall be informed before the processing, unless such information is prohibited by law.

If the Processor considers that an instruction infringes the GDPR or other applicable data protection law, the Controller shall be informed without undue delay.

7. Confidentiality

The Processor shall ensure that persons authorised to process personal data have committed to confidentiality or are under an appropriate statutory obligation of confidentiality, and have access only to the extent needed for their tasks.

8. Security

The Processor shall take appropriate technical and organisational measures under Article 32 GDPR, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing, and the risks to the rights and freedoms of data subjects. The main measures are set out in Appendix 5.

9. Sub-processors

The Controller gives the Processor a general prior written authorisation to engage sub-processors. Current sub-processors are listed in Appendix 5.

The Processor shall inform the Controller of planned additions or replacements of sub-processors at least thirty (30) days before the new or replacement sub-processor begins processing personal data on the Controller’s behalf.

The information shall contain such information as is reasonably needed for the Controller to assess the change, including:

• the identity of the sub-processor,
• which service or processing the sub-processor provides,
• which types of personal data the sub-processor may process,
• in which country or countries the processing takes place, and
• where applicable, which mechanism is used for transferring personal data to a third country.

Within fifteen (15) days of receiving the information, the Controller may object to the new or replacement sub-processor.

An objection shall be specific and reasoned, based on circumstances relating to data protection, information security, applicable data protection law or other relevant risks attributable to the processing by the sub-processor concerned. An objection based solely on general preferences, commercial considerations or a general dislike of the sub-processor shall not in itself constitute reasonable grounds.

If the Controller makes a reasoned objection, the Parties shall promptly try to find a reasonable solution that removes the grounds for the objection.

The Processor may, where practically and commercially reasonable, for example refrain from using the sub-processor concerned for the Controller’s processing or offer an alternative technical or organisational solution.

If the Parties cannot find a reasonable solution before the new or replacement sub-processor is to begin processing personal data, and the Processor cannot reasonably provide the Service without the sub-processor concerned, the Controller is entitled to terminate the part of the Service affected by the change.

If the affected part of the Service cannot reasonably be separated from the rest of the Service, the Controller is entitled to terminate the Agreement in its entirety.

In the event of such termination, the termination shall take effect no later than when the new or replacement sub-processor begins the processing covered by the objection, unless the Parties agree otherwise.

If the Controller has paid subscription fees in advance, the Processor shall refund the proportionate part of the prepaid fee that relates to the period after the termination takes effect. No further compensation or remuneration is payable solely on account of such termination.

The Processor shall, by written agreement, impose on the sub-processor data protection obligations that, in relevant respects, provide at least the same protection as follows from this DPA.

The Processor is liable to the Controller for the sub-processor’s performance of its data protection obligations to the extent provided by the GDPR.

10. Transfers to third countries

The Processor processes personal data within the EU/EEA, with the exceptions set out in clause 10 of the main agreement and Appendix 5. Personal data may otherwise be transferred to or made accessible from a third country only if the requirements of Chapter V GDPR are met and an appropriate transfer mechanism and, where required, supplementary measures are used.

11. Data subject rights

Taking into account the nature of the processing, the Processor shall, through appropriate technical and organisational measures and insofar as possible, assist the Controller in responding to requests to exercise data subject rights under Chapter III GDPR. If the Processor receives such a request concerning Customer Data directly, it shall normally refer it to the Customer without answering the substance itself, unless the Customer has instructed otherwise.

12. Assistance under Articles 32–36

Taking into account the nature of the processing and the information available to the Processor, the Processor shall reasonably assist the Customer with obligations concerning security, personal data breaches, impact assessments and prior consultation under Articles 32–36 GDPR. Particularly extensive assistance beyond the normal Service and the Processor’s statutory obligations may be charged at the agreed consulting rate if reasonable and agreed in advance.

13. Personal data breaches

The Processor shall notify the Controller without undue delay after becoming aware of a personal data breach affecting personal data processed on the Controller’s behalf.

An initial notification shall be provided even if the breach has not yet been fully investigated.

The notification shall, to the extent information is available, describe the nature of the breach, the categories of data and data subjects concerned, the likely consequences, and the measures taken or proposed. Information may be provided in stages if not everything is known at the first notification.

14. Audits and information

The Processor shall make available the information reasonably required to demonstrate compliance with Article 28 and this DPA, and shall allow for and contribute to audits or inspections by the Customer or an independent auditor appointed by the Customer.

An audit shall normally be preceded by at least 30 days’ written notice, take place during normal working hours, be limited to the relevant scope, and be carried out in a way that does not unreasonably disrupt operations or jeopardise the confidentiality or security of other customers. The Customer bears its own audit costs. The Processor may charge reasonable compensation for extensive assistance beyond normal compliance documentation, unless the audit reveals a material breach by the Processor.

15. Deletion and return

When the processing ends, the Processor shall, at the Controller’s choice, delete or return the personal data processed on the Controller’s behalf, unless continued storage is required by law.

During the term of the Agreement, the Controller may export such data for which the Service provides an export function, for example audit logs and alerts.

If the Controller chooses return, available original reports in RUA and TLS-RPT format and, where applicable, RUF format may be provided through the Processor’s support function, provided that the reports are still within the applicable retention period. They may be provided as an archive file or in another reasonable and technically usable format and, where justified, encrypted.

The Processor is not obliged to provide copies of the Service’s internal databases, internal data structures or other internal system information, provided that the personal data covered by the return can be provided in another reasonable and technically usable way.

When the Service ends, the Customer’s data is deleted from the active service, including data in the Service’s databases. Data stored separately, for example in object storage, shall be deleted no later than thirty (30) days after the Agreement ends, unless continued storage is required by law.

Technical security and system logs that contain personal data and are necessary to maintain the security of the Service, investigate security incidents, verify access or meet documentation requirements may be retained for up to six (6) months from the time the data was recorded. During the retention period, such log data may be processed only for these purposes and shall then be deleted in accordance with the Service’s ordinary deletion routines.

Personal data in backups may remain until the ordinary backup cycle has expired, provided that the data is protected, is not returned to active processing except for a necessary restore, and is then again subject to deletion.

16. Liability and precedence

Liability is governed by the GDPR and the Agreement to the extent permitted by law. In the event of conflict between this DPA and other contractual terms concerning the processing of personal data, this DPA takes precedence.

17. Summary of processing instructions