DMARC Vision General Terms

1. Parties and scope of application

These general terms (the “Terms”) apply between Nansec Software AB, company registration number 559602-3696, Blackevägen 56, 417 16 Göteborg, Sweden (the “Supplier”), and the organisation named as customer in an Order (the “Customer”). The Supplier and the Customer are together the “Parties” and each a “Party”.

An “Order” is an order or quotation that refers to the Terms and that both Parties have signed or approved in writing. The Order and the Terms with their appendices together form the “Agreement”.

The service is provided only to businesses, public authorities and other organisations for use in their operations. The Customer confirms that it enters into the Agreement in the course of its operations and not as a consumer.

2. Scope of the Agreement

The Supplier provides the cloud-based DMARC Vision service (the “Service”). The main function of the Service is to collect, analyse, visualise and alert on information related to email and domain security.

The current scope of the Service is set out in Appendix 1 – Service description and in the Order. In the event of conflict, the documents apply in the order set out in clause 31.

3. Right of use

During the term of the Agreement, the Customer receives a limited, non-exclusive and non-transferable right to use the Service for its own operations and for domains that the Customer owns, administers or otherwise has the right to monitor.

The Customer may not, without the Supplier’s written approval, sell, sublicense, resell or make the Service available to third parties as its own service.

4. Customer accounts and permissions

The Customer is responsible for ensuring that only authorised persons are given access, that roles and permissions are appropriate, and that accounts are removed when access is no longer needed.

The Supplier may temporarily suspend an account or access if reasonably required to handle suspected misuse, a security incident, or a risk to the Service or other customers.

5. Customer domains and configuration

The Customer is responsible for having the right to register and monitor the domains added to the Service. The Supplier may require technical domain verification.

The Customer is responsible for changes to its own DNS, email and identity systems. Recommendations, alerts and analyses in the Service are decision support; the Customer is responsible for its own change decisions.

6. Supplier obligations

The Supplier shall provide the Service in a professional manner, take appropriate technical and organisational security measures, and provide support according to the Customer’s subscription and Appendix 3.

The Supplier may continuously maintain and develop the Service, provided that the agreed core functionality is not materially impaired.

7. Availability and maintenance

Availability, support hours, priorities and any service credits are governed by Appendix 3 – SLA and support.

Planned maintenance shall, where practicable and where it may have a material impact, be announced in advance. Emergency maintenance may be carried out without prior notice when required for security or operational reasons.

8. Customer Data

The Customer retains the rights to data that the Customer supplies to the Service or that is processed on the Customer’s behalf (“Customer Data”). The Supplier may process Customer Data to the extent required to deliver, secure and administer the Service and to meet legal obligations.

The Supplier may use anonymised or aggregated information for statistics and capacity planning, provided that the information cannot reasonably be linked to the Customer or to an identifiable natural person. Customer Data is not sold to third parties.

9. Personal data

When the Supplier processes personal data on the Customer’s behalf, the Customer is the controller and the Supplier is the processor, unless the actual processing indicates otherwise. Such processing is governed by Appendix 4 – Data processing agreement.

The Supplier may be an independent controller for processing carried out for the Supplier’s own administrative or legal purposes, for example concerning contact persons, contract administration, invoicing and compliance with legal obligations.

10. Location of processing

Customer Data processed by the Supplier or by sub-processors engaged by the Supplier within the scope of the Service is, as a main rule, stored and processed within the EU/EEA. The Supplier’s support access to Customer Data takes place within the EU/EEA.

This commitment covers the processing of Customer Data carried out as part of the Supplier’s provision of the Service and does not cover processing or transfers carried out through systems, services or providers that the Customer itself uses, administers or engages outside the Service.

The following exceptions apply and are described in more detail in Appendix 5:

(a) The Supplier’s website and portal are distributed through Amazon CloudFront, which is part of the Amazon Web Services global content delivery network. When the website or the portal is used, certain traffic and user data, such as IP address and, where applicable, the user’s name and email address, may be processed in CloudFront nodes outside the EU/EEA. Amazon Web Services EMEA SARL is a sub-processor under Appendix 5. For transfers to third countries without an adequacy decision, the European Commission’s standard contractual clauses (SCCs) apply through the AWS Data Processing Addendum together with, where required, supplementary measures.

(b) when the Customer requests an original RUF report, it is sent as an encrypted archive file by email through Proton AG in Switzerland. The password to the archive file is provided separately through the Service’s support function.

If any other transfer of personal data to a third country becomes relevant within the scope of the Supplier’s processing, such transfer shall comply with applicable data protection law, use an applicable transfer mechanism, and take place after notice in accordance with Appendix 4, clause 9.

11. RUF and particularly sensitive report data

DMARC failure/forensic reports (RUF) may contain personal data or message information. If the Customer enables RUF functionality, the specific storage, access and protection measures in Appendices 1, 4 and 5 apply.

12. Information security

The Supplier shall maintain appropriate technical and organisational measures with regard to risk, the nature of the processing and the sensitivity of the information. The main controls are described in Appendix 5 – Information security and sub-processors.

13. Security incidents

The Supplier shall have procedures for identifying, handling and documenting security incidents. Personal data breaches relating to processing on the Customer’s behalf are handled under Appendix 4.

14. Subcontractors

The Supplier may engage subcontractors for the delivery. Sub-processors that process personal data on the Customer’s behalf are governed by Appendix 4. A current list is set out in Appendix 5.

15. Intellectual property

All intellectual property rights in the Service, software, design, documentation, analysis models and other parts created by the Supplier belong to the Supplier or its licensors. The Customer retains the rights to Customer Data and to its own trademarks and domains.

The Supplier may use feedback and suggestions for improvement without separate compensation, provided that the Customer’s confidential information is not disclosed.

16. Third-party services and external data sources

The Service may integrate with or retrieve information from external services, such as DNS, email systems, cloud services, SIEM, webhook and messaging services, and public security data sources. The Supplier is not responsible for errors, outages or changes at third parties that are beyond the Supplier’s reasonable control.

17. Fees and payment

The Customer shall pay fees according to the Order and Appendix 2. Unless the Order states otherwise, subscriptions are invoiced annually in advance with thirty (30) days’ payment terms.

In the event of late payment, the Supplier is entitled to default interest under the Swedish Interest Act and statutory fees. After a written reminder, the Supplier may restrict access if payment is still not made.

18. Price changes

The Supplier is entitled to change prices ahead of a new contract period. Price changes shall be notified to the Customer no later than sixty (60) days before the end of the current contract period.

If the Customer does not accept the price change, the Customer is entitled to terminate the Agreement with effect from the end of the current contract period. Such termination shall be made in writing no later than thirty (30) days before the end of the contract period.

If the Customer does not terminate the Agreement within this time, the new prices apply from the next contract period.

19. Term and renewal

The Agreement enters into force on the date stated in the Order, or otherwise when both Parties have approved the Order, and runs for an initial twelve (12) months unless the Order states otherwise. It then renews automatically for twelve (12) months at a time unless terminated in writing no later than sixty (60) days before the end of the current period.

The ordinary notice period under this clause does not apply to termination on account of a price change under clause 18.

20. Early termination

A Party may terminate the Agreement with immediate effect if the other Party materially breaches the Agreement and does not remedy the breach within thirty (30) days of a written request, or is declared bankrupt, enters liquidation or can otherwise be assumed to be insolvent.

The Supplier may immediately restrict access to the extent required in the event of serious misuse or an acute security risk.

21. End of the Agreement and export

When the Agreement ends, the Customer’s right to use the Service ends.

During the term of the Agreement and until the Agreement ends, the Customer may request an export of such Customer Data as is available through the Service’s export functions. Return of personal data and available original reports, and the subsequent deletion of Customer Data, take place under Appendix 4, clause 15.

Information that must be retained by law may be stored for the period required by applicable law. Personal data in backups and in technical security and system logs is handled under Appendix 4, clause 15.

22. Confidentiality

A Party may not disclose confidential information without the other Party’s consent. Confidential information includes Customer Data, security information, technical information, business information and individually agreed commercial terms.

Confidentiality does not apply to information that is publicly known without breach of the Agreement, that the receiving Party can show it already knew, or that must be disclosed by law or by a binding decision of an authority or court. The confidentiality obligation survives the end of the Agreement.

23. Warranties and nature of the Service

The Supplier shall perform its obligations with reasonable care and skill. The Customer understands that the Service is analysis, monitoring and decision support, and that the Supplier does not warrant that all security threats, errors or anomalies will be detected or that external reports and data sources are complete or correct.

Alerts, risk indications and recommendations are decision support and do not warrant that an incident or risk does or does not exist. The Service does not in itself guarantee regulatory compliance.

24. Liability and limitation of liability

A Party is liable for direct loss caused by breach of contract, negligence or intent. Neither Party is liable for indirect loss, such as loss of profit, loss of production, loss of business opportunity, loss of goodwill or other consequential loss. A Party’s total liability under the Agreement during a period of twelve (12) months is limited to an amount equal to the fees that the Customer has paid or is to pay for the Service during the same period. The limitations of liability above do not apply in cases of intent or gross negligence, or to the extent that liability cannot lawfully be limited. For the processing of personal data, the allocation of liability under applicable data protection law and Appendix 4 – Data processing agreement also applies.

25. Force majeure

A Party is released from liability for failure to perform an obligation caused by circumstances beyond its reasonable control, such as war, government action, widespread disruption to society, natural events, labour disputes, major internet or telecommunications outages, or an exceptional cyberattack. The affected Party shall inform the other Party as soon as reasonably possible.

26. Changes to the Service

The Supplier may continuously change and develop the Service. Features may be added, changed or removed provided that this does not materially impair the agreed core functionality. Material changes shall be announced within a reasonable time.

27. Changes to the Terms

The Supplier may change the Terms when justified by law, regulatory requirements, security, technical development or changes to the Service. A change is made by publishing a new version of the Terms with a version number and date. Material changes shall be announced to the Customer within a reasonable time and normally take effect from the next contract period, unless earlier effect is required by law or for security reasons.

The current version and all previous versions of the Terms are available at dmarcvision.eu. Until a new version has taken effect for the Customer, the version stated in the Order applies.

28. Assignment

The Customer may not assign the Agreement without the Supplier’s written approval. The Supplier may assign the Agreement within its group of companies or in connection with a transfer of the Service or the business, provided that the Customer’s contractual rights are not materially impaired.

29. Notices

Formal notices shall be given in writing to the contact details stated in the Order or later notified by the Parties to each other. The Customer is responsible for keeping contact and invoicing details up to date.

30. Entire agreement

The Agreement constitutes the Parties’ entire agreement on the matters it covers and supersedes previous oral and written undertakings on the same matters, unless expressly agreed otherwise.

31. Order of precedence

In the event of conflict, the documents apply in the following order: (1) the Order, (2) this main agreement, (3) Appendix 1 – Service description, (4) Appendix 2 – Prices and subscriptions, (5) Appendix 3 – SLA and support, (6) Appendix 4 – Data processing agreement, (7) Appendix 5 – Information security and sub-processors. For matters specifically concerning the processing of personal data, Appendix 4 takes precedence.

32. Governing law and disputes

The Agreement shall be interpreted and applied in accordance with Swedish law.

Disputes arising from the Agreement shall first be resolved through negotiation between the Parties.

A Party wishing to start negotiations shall notify the other Party in writing and briefly describe the nature of the dispute and the basis of its claim. The Parties shall then, without undue delay, appoint representatives with authority to try to resolve the dispute.

Negotiations shall begin no later than ten (10) working days after the written notice has been received.

If the Parties have not reached a solution within thirty (30) days of receipt of the notice of dispute, or within such other time as the Parties agree in writing, either Party may refer the dispute to the Swedish general courts with the Gothenburg District Court (Göteborgs tingsrätt) as the court of first instance.

33. Conclusion of the Agreement

The Agreement is concluded when both Parties have signed or approved the Order in writing. Signature and approval may be electronic and in separate counterparts.

1. Purpose

DMARC Vision is a cloud-based SaaS service for overview, analysis and monitoring of an organisation’s email and domain security. The Service combines an overview, drill-down, alerts and integrations so that the Customer does not have to watch a separate portal manually.

2. Core features

• Receipt, normalisation and analysis of DMARC aggregate reports (RUA).
• Receipt and analysis of SMTP TLS Reporting (TLS-RPT).
• Support for DMARC failure/forensic reports (RUF) when the feature is enabled.
• Overview of sending sources, SPF and DKIM results, and DMARC alignment.
• Monitoring of relevant DNS and policy data for registered domains.
• Alerts on selected changes, anomalies or security indicators.
• History, reporting and drill-down to relevant report and source data.
• Export, API and integrations according to the subscription and the Order.

3. Domain and DNS monitoring

• DMARC policy and reporting addresses.
• SPF records and changes to them.
• DKIM-related checks where the selector or configuration is known or available.
• MX, MTA-STS, TLS-RPT, BIMI and other email-related DNS checks that the Supplier supports from time to time.
• Policy or configuration drift between measurements.

4. Alerts and notifications

The available alert types are continuously developed and may include changed DMARC policy, new or unusual senders, authentication failures, policy and DNS drift, reporting gaps and other relevant indicators. Alerts are delivered in the portal and, depending on the subscription, by email, webhook, Teams, Slack or other integrations.

5. RUF

RUF reports may contain personal data, technical header data and message information and are therefore handled in a separate processing and storage flow, with restricted access and a shorter retention period than aggregate report data.

Original reports are not made available in the Service’s customer portal and are not part of the regular analysis view. The original report is stored separately in protected object storage and is accessible only through specially access-controlled handling.

• RUF is disabled by default. The Service receives RUF only for the domains or subdomains for which the Customer has expressly enabled the feature by configuring a RUF address that points to the Service.
• RUF can be enabled or disabled separately per domain or subdomain. For example, the Customer may choose to receive RUF for a particular subdomain without enabling RUF for the parent domain.
• The Customer may at any time stop receiving RUF for a particular domain or subdomain by removing or changing the relevant RUF configuration.
• In processing for regular analysis, only the data in the RUF report that is needed for the Service’s analysis and reporting is extracted. Only this extracted and, where applicable, pseudonymised metadata is used in the regular Service.
• In the stored RUF metadata, the following data is pseudonymised with keyed HMAC-SHA256:
  • the local part of the address in the original message’s From,
  • the local part of the envelope sender from Return-Path, with Original-Mail-From as the fallback source,
  • the local parts of email addresses in Reply-To,
  • the local parts of recipient addresses in To and Cc,
  • the entire value of Subject,
  • the entire value of Message-ID, and
  • the entire value of Original-Envelope-ID.
• A separate HMAC key is used for each customer company. The key material used to generate or derive the HMAC key is customer-specific and separated between customers. This makes it possible to recognise recurring identifiers within the same customer environment without corresponding identifiers being correlated between different customers.
• Domain names and the reported source IP address are stored in readable form in the RUF metadata.
• Original-Rcpt-To is not stored in the metadata and is removed instead of being pseudonymised.
• The pseudonymisation applies only to the metadata extracted from the RUF report. Any message text or other content in the original report is not stored as part of the regular analysis data, but may remain in the original report.
• The original report is stored separately from the regular analysis data as restricted evidence, protected by encryption and strict access control, for fourteen (14) days from receipt. It is then deleted automatically.
• During the retention period, an authorised customer representative may request the original report through support. The report is delivered by email as an encrypted archive file with AES-256 encryption. The password is provided separately through the Service’s support function.
• The Customer is responsible for ensuring that enabling and using RUF is lawful for the Customer’s processing.

6. Data location

The Service is operated and its data stored in the AWS region eu-north-1 (Stockholm, Sweden). Customer Data is stored and processed within the EU/EEA, with the exceptions set out in clause 10 of the main agreement. Sub-processors and processing locations are listed in Appendix 5.

7. Retention periods

8. Data export at the end of the Agreement

On request, the Customer may, within the period set out in clause 21 of the main agreement, export Customer Data supported by the Service’s export features. The Supplier is not obliged to recreate data already deleted according to the agreed retention period.

9. Limitations

• The Service is not an email gateway and does not in itself block email traffic.
• The Service is not a guarantee against spoofing, phishing or other attacks.
• Results depend on reports and data from external senders, receivers, DNS and other data sources.
• Some features require the Customer to configure DNS, reporting addresses, API permissions or other integrations.

10. Customer technical responsibilities

• Configure the necessary DNS records and reporting addresses according to the Supplier’s instructions.
• Ensure that the Customer may monitor the domains it connects.
• Manage the Customer’s internal email, identity and DNS environment.
• Assess and carry out recommended changes in the Customer’s own environment.

1. Subscription and price

The Customer’s subscription level, annual fee and plan limits are stated in the Order. The Supplier’s current price list is on the pricing page at dmarcvision.eu. All prices are in Swedish kronor (SEK) excluding VAT.

Plan limits cover the number of sending top-level domains, analysed message volume, users and retention period. Sending subdomains are included under their connected top-level domain and do not count as separate top-level domains. Parked, defensive or non-sending domains are monitored under fair use and do not count as sending domains.

2. Overuse and fair use

If the Customer’s use persistently exceeds the agreed volume or scope, the Supplier shall first contact the Customer to adjust the subscription. The Supplier shall not charge retroactively for overuse without support in the Order or a separate agreement.

3. Additional services

4. Payment terms

• Annual invoicing in advance unless the Order states otherwise.
• Payment terms: 30 days.
• All prices exclude VAT.
• Price changes are handled under clause 18 of the main agreement.

1. Scope

This appendix governs availability, incident prioritisation and support for the Service. Individual terms may be set out in the Order and then take precedence.

2. Support level and service hours

The support level follows the Customer’s subscription: Standard for Starter, Priority for Business and Enterprise for Enterprise, unless the Order states otherwise.

Security incidents are reported to support@dmarcvision.eu at every level, and for Enterprise also through an agreed channel.

3. Priority classes

4. First response targets

Times are counted within service hours. A working day is a Swedish working day, excluding public holidays.

5. Availability target

The availability target is 99.5% per calendar month for the portal and core API functions controlled by the Supplier. A different target may be set in the Order.

Availability is calculated as: (total measured time – unavailable time) / total measured time × 100. The calculation excludes the exceptions in section 6.

6. SLA exceptions

• Planned maintenance announced under section 9.
• Emergency security maintenance reasonably required to protect the Service or Customer Data.
• Faults in the Customer’s systems, DNS, email environment, identity provider or internet connection.
• Faults or outages at external services or data providers beyond the Supplier’s reasonable control.
• Force majeure.
• Suspension resulting from the Customer’s breach of contract or request.

7. Service credits

Service credits apply only if expressly stated in the Order. If service credits are agreed without another model, the following applies.

8. Limit on service credits

A service credit, if agreed, is the Customer’s sole financial compensation for insufficient availability and may never exceed 20% of the monthly fee for the month concerned. With annual invoicing, the monthly fee is one twelfth of the annual fee.

9. Planned maintenance

Where practicable, the Supplier shall schedule disruptive maintenance outside service hours and notify the Customer at least 48 hours in advance when the impact is expected to be significant.

10. Security incidents

Suspected or confirmed security incidents are prioritised by risk and impact. Personal data breaches are handled under Appendix 4 and are not governed solely by the ordinary support times above.

1. Parties and roles

This data processing agreement (the “DPA”) is entered into between the Customer as controller (the “Controller”) and Nansec Software AB as processor (the “Processor”) and forms an integral part of the Agreement.

The DPA applies only to the extent that the Processor processes personal data on the Controller’s behalf. The Parties’ roles are determined by the actual circumstances and applicable data protection law.

2. Subject matter and duration

The subject matter of the processing is the provision of DMARC Vision and thereby receiving, storing, structuring, analysing, presenting, protecting, exporting and deleting personal data to the extent required for the Service.

The processing continues for the term of the Agreement and for the subsequent period required for export, deletion, backup cycles or legal obligations under this DPA.

3. Nature and purpose

The processing is carried out to deliver features for email and domain security analysis, reporting, monitoring, alerts, support, troubleshooting and secure operation. The Processor may not process personal data for its own purposes.

As part of the Service, the Processor may anonymise data for statistics and capacity planning under clause 8 of the main agreement. Information that has been anonymised is not personal data and is not covered by this DPA.

4. Types of personal data

Depending on the Customer’s configuration and use of the Service, the processing may include:

• IP addresses, domain names and email addresses,
• identifiers and technical data related to email authentication,
• technical header, report and log data,
• user account and contact details, including user identity, assigned role and permission level in the Service,
• authentication metadata and time of login,
• technical log data related to use, operation, access control and security in the Service, and
• where applicable, in RUF reports, parts of message information or other personal data that appears in the report.

The processing is limited to the personal data necessary to provide, administer, monitor, troubleshoot and protect the Service and to carry out the processing that follows from the Customer’s use and configuration of the Service.

5. Categories of data subjects

Data subjects may include the Customer’s users and administrators, employees and contractors, senders and recipients of email, and other persons whose data appears in reports or technical logs processed on the Customer’s behalf.

6. Documented instructions

The Processor may process personal data only on documented instructions from the Controller, including the Agreement, the Customer’s configuration, and written instructions consistent with the agreed Service.

If the Processor is required by EU or Swedish law to process personal data otherwise, the Controller shall be informed before the processing, unless such information is prohibited by law.

If the Processor considers that an instruction infringes the GDPR or other applicable data protection law, the Controller shall be informed without undue delay.

7. Confidentiality

The Processor shall ensure that persons authorised to process personal data have committed to confidentiality or are under an appropriate statutory obligation of confidentiality, and have access only to the extent needed for their tasks.

8. Security

The Processor shall take appropriate technical and organisational measures under Article 32 GDPR, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing, and the risks to the rights and freedoms of data subjects. The main measures are set out in Appendix 5.

9. Sub-processors

The Controller gives the Processor a general prior written authorisation to engage sub-processors. Current sub-processors are listed in Appendix 5.

The Processor shall inform the Controller of planned additions or replacements of sub-processors at least thirty (30) days before the new or replacement sub-processor begins processing personal data on the Controller’s behalf.

The information shall contain such information as is reasonably needed for the Controller to assess the change, including:

• the identity of the sub-processor,
• which service or processing the sub-processor provides,
• which types of personal data the sub-processor may process,
• in which country or countries the processing takes place, and
• where applicable, which mechanism is used for transferring personal data to a third country.

Within fifteen (15) days of receiving the information, the Controller may object to the new or replacement sub-processor.

An objection shall be specific and reasoned, based on circumstances relating to data protection, information security, applicable data protection law or other relevant risks attributable to the processing by the sub-processor concerned. An objection based solely on general preferences, commercial considerations or a general dislike of the sub-processor shall not in itself constitute reasonable grounds.

If the Controller makes a reasoned objection, the Parties shall promptly try to find a reasonable solution that removes the grounds for the objection.

The Processor may, where practically and commercially reasonable, for example refrain from using the sub-processor concerned for the Controller’s processing or offer an alternative technical or organisational solution.

If the Parties cannot find a reasonable solution before the new or replacement sub-processor is to begin processing personal data, and the Processor cannot reasonably provide the Service without the sub-processor concerned, the Controller is entitled to terminate the part of the Service affected by the change.

If the affected part of the Service cannot reasonably be separated from the rest of the Service, the Controller is entitled to terminate the Agreement in its entirety.

In the event of such termination, the termination shall take effect no later than when the new or replacement sub-processor begins the processing covered by the objection, unless the Parties agree otherwise.

If the Controller has paid subscription fees in advance, the Processor shall refund the proportionate part of the prepaid fee that relates to the period after the termination takes effect. No further compensation or remuneration is payable solely on account of such termination.

The Processor shall, by written agreement, impose on the sub-processor data protection obligations that, in relevant respects, provide at least the same protection as follows from this DPA.

The Processor is liable to the Controller for the sub-processor’s performance of its data protection obligations to the extent provided by the GDPR.

10. Transfers to third countries

The Processor processes personal data within the EU/EEA, with the exceptions set out in clause 10 of the main agreement and Appendix 5. Personal data may otherwise be transferred to or made accessible from a third country only if the requirements of Chapter V GDPR are met and an appropriate transfer mechanism and, where required, supplementary measures are used.

11. Data subject rights

Taking into account the nature of the processing, the Processor shall, through appropriate technical and organisational measures and insofar as possible, assist the Controller in responding to requests to exercise data subject rights under Chapter III GDPR. If the Processor receives such a request concerning Customer Data directly, it shall normally refer it to the Customer without answering the substance itself, unless the Customer has instructed otherwise.

12. Assistance under Articles 32–36

Taking into account the nature of the processing and the information available to the Processor, the Processor shall reasonably assist the Customer with obligations concerning security, personal data breaches, impact assessments and prior consultation under Articles 32–36 GDPR. Particularly extensive assistance beyond the normal Service and the Processor’s statutory obligations may be charged at the agreed consulting rate if reasonable and agreed in advance.

13. Personal data breaches

The Processor shall notify the Controller without undue delay after becoming aware of a personal data breach affecting personal data processed on the Controller’s behalf.

An initial notification shall be provided even if the breach has not yet been fully investigated.

The notification shall, to the extent information is available, describe the nature of the breach, the categories of data and data subjects concerned, the likely consequences, and the measures taken or proposed. Information may be provided in stages if not everything is known at the first notification.

14. Audits and information

The Processor shall make available the information reasonably required to demonstrate compliance with Article 28 and this DPA, and shall allow for and contribute to audits or inspections by the Customer or an independent auditor appointed by the Customer.

An audit shall normally be preceded by at least 30 days’ written notice, take place during normal working hours, be limited to the relevant scope, and be carried out in a way that does not unreasonably disrupt operations or jeopardise the confidentiality or security of other customers. The Customer bears its own audit costs. The Processor may charge reasonable compensation for extensive assistance beyond normal compliance documentation, unless the audit reveals a material breach by the Processor.

15. Deletion and return

When the processing ends, the Processor shall, at the Controller’s choice, delete or return the personal data processed on the Controller’s behalf, unless continued storage is required by law.

During the term of the Agreement, the Controller may export such data for which the Service provides an export function, for example audit logs and alerts.

If the Controller chooses return, available original reports in RUA and TLS-RPT format and, where applicable, RUF format may be provided through the Processor’s support function, provided that the reports are still within the applicable retention period. They may be provided as an archive file or in another reasonable and technically usable format and, where justified, encrypted.

The Processor is not obliged to provide copies of the Service’s internal databases, internal data structures or other internal system information, provided that the personal data covered by the return can be provided in another reasonable and technically usable way.

When the Service ends, the Customer’s data is deleted from the active service, including data in the Service’s databases. Data stored separately, for example in object storage, shall be deleted no later than thirty (30) days after the Agreement ends, unless continued storage is required by law.

Technical security and system logs that contain personal data and are necessary to maintain the security of the Service, investigate security incidents, verify access or meet documentation requirements may be retained for up to six (6) months from the time the data was recorded. During the retention period, such log data may be processed only for these purposes and shall then be deleted in accordance with the Service’s ordinary deletion routines.

Personal data in backups may remain until the ordinary backup cycle has expired, provided that the data is protected, is not returned to active processing except for a necessary restore, and is then again subject to deletion.

16. Liability and precedence

Liability is governed by the GDPR and the Agreement to the extent permitted by law. In the event of conflict between this DPA and other contractual terms concerning the processing of personal data, this DPA takes precedence.

17. Summary of processing instructions

1. Security principles

• Least privilege and need-based access.
• Separation of customer data through logical multi-tenant controls and a permission model.
• Encrypted transport for web, API and other supported interfaces.
• Encryption of stored data where appropriate given the risk and data type.
• Logging of relevant administrative and security-related events.
• Vulnerability and patch management for components controlled by the Supplier.
• Backup and restore capability for relevant production data.
• An incident handling process and restricted access to the production environment.

2. Identity and access

• Role-based access control (RBAC) for the Customer’s and the Supplier’s permissions.
• Separate administrative and customer-facing permission boundaries where the architecture supports it.
• Strong authentication for privileged access.
• Regular review of privileged permissions.

3. Encryption and keys

• TLS is used for web communication and APIs where the protocol supports it.
• Storage services are configured with encryption at rest where appropriate.
• Keys and secrets are managed in a dedicated service or a secure secrets system.
• Original RUF reports are stored encrypted and released only as an encrypted archive file under Appendix 1, section 5.

4. Logging and monitoring

• Application and infrastructure logs are used for operations, security, troubleshooting and traceability.
• Alerting and monitoring are used for relevant error, security and capacity events.
• Logs are protected against unauthorised access and have a defined retention period under Appendix 1, section 7.

5. Vulnerabilities and secure development

• Code review and automated tests are used in the development process to an appropriate extent.
• Dependencies and known vulnerabilities are tracked with automated or manual tools.
• Development, test and production environments are separated from each other.
• Production data is not used in development or test environments.
• Changes to production go through a controlled release process.
• Critical or time-sensitive security updates may be deployed to production without prior notice when the Supplier considers this reasonably necessary to limit a vulnerability, security risk or ongoing incident.

6. Backup, continuity and recovery

Backup and restore procedures are adapted to the Service’s data types. Recovery time and recovery point objectives (RTO and RPO) are not guaranteed unless expressly stated in the Order or Appendix 3.

7. RUF-specific controls

• Short retention of original reports compared with aggregate report data.
• Restricted access to RUF content.
• Pseudonymisation with keyed HMAC-SHA256 before storage for regular analysis.
• Encryption of stored original reports.
• The Customer can choose not to use, or can disable, RUF functionality.

8. Sub-processors

A company is listed as a sub-processor only if it processes personal data on the Customer’s behalf.

9. Process for new sub-processors

1. The Supplier carries out a data protection and security assessment of the planned sub-processor before processing begins.
2. The Supplier enters into the processing, data protection and other agreements required for the sub-processor to be bound by relevant data protection and security requirements.
3. The Customer is informed at least thirty (30) days before a new or replacement sub-processor begins processing personal data on the Customer’s behalf. The information shall describe the identity of the sub-processor, the nature of the processing, the personal data that may be processed, where the processing takes place and, where applicable, the applicable mechanism for third-country transfers.
4. Within fifteen (15) days of receiving the information, the Customer may make a specific and reasoned objection relating to data protection, information security or applicable law. What constitutes a reasoned objection is set out in more detail in Appendix 4, section 9.
5. In the event of a reasoned objection, the Parties shall promptly try to find a reasonable solution. The Supplier may, for example, where practically and commercially reasonable, refrain from using the sub-processor concerned for the Customer’s processing or offer an alternative technical or organisational solution.
6. While a reasoned objection is being handled, the new or replacement sub-processor shall not begin the processing of the Customer’s personal data covered by the objection, unless the Parties agree otherwise in writing.
7. If the Parties cannot find a reasonable solution and the Supplier cannot reasonably provide the affected part of the Service without the sub-processor concerned, the Customer is entitled to terminate the part of the Service affected by the change. If the affected part cannot reasonably be separated from the rest of the Service, the Customer is entitled to terminate the Agreement in its entirety.
8. Such termination shall not entail any additional termination fee or other special cost for the Customer. If the Customer has paid subscription fees in advance, the Supplier shall refund the proportionate part of the prepaid fee that relates to the period after the termination takes effect. No further compensation or remuneration is payable solely on account of such termination.

10. Contact details

1. Permitted use

• Use the tools only for domains and email that you have the right to test.
• Do not try to overload the tools, bypass their limits or gain unauthorised access to them.
• Do not send messages with sensitive content to the Email Security Check.

2. No warranties

The tools are provided free of charge and as is. Results are decision support and may be incomplete; a check that could not be completed is reported as not determined. The Supplier may change, limit or close the tools without prior notice.

3. Liability

To the extent permitted by law, the Supplier is not liable for loss arising from use of the free tools, except in cases of intent or gross negligence.

4. Personal data

How data in the tools is processed is described in the privacy policy.