Data Processing Addendum (DPA)

This Data Processing Addendum ("DPA") forms part of the agreement between PrivyNet Ltd ("PrivyNet", "Processor", "we", "our", "us") and the customer ("Customer", "Controller", "you", "your") for the provision of Infrastructure-as-a-Service (IaaS) and related services.

This DPA applies when:

• You use PrivyNet services to process personal data on behalf of your customers, users, or other third parties.

• PrivyNet processes personal data as a data processor acting on your documented instructions.

This DPA is designed to ensure compliance with:

• UK General Data Protection Regulation (UK GDPR)

• Data Protection Act 2018

• EU General Data Protection Regulation (EU GDPR) where applicable

• Other applicable data protection laws

In the event of conflict between this DPA and the Terms of Service, this DPA shall prevail with respect to data protection matters.

By using our services to process personal data, you agree to the terms of this DPA.

For the purposes of this DPA, the following definitions apply (in addition to those in the Terms of Service):

• "Personal Data": Any information relating to an identified or identifiable natural person ("Data Subject"), as defined in UK GDPR Article 4(1).

• "Controller": The natural or legal person which determines the purposes and means of the processing of Personal Data. For Customer Content, you are the Controller.

• "Processor": The natural or legal person which processes Personal Data on behalf of the Controller. For Customer Content, PrivyNet is the Processor.

• "Sub-Processor": Any third party engaged by PrivyNet to process Personal Data on behalf of the Customer.

• "Processing": Any operation performed on Personal Data, including collection, storage, use, disclosure, transmission, and deletion.

• "Customer Content" / "Customer Data": Any data, including Personal Data, that you transmit, store, or process using PrivyNet services.

• "Data Subject": An identified or identifiable natural person whose Personal Data is processed.

• "Personal Data Breach": A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data.

• "Standard Contractual Clauses" ("SCCs"): The contractual clauses approved by the European Commission or UK Government for international data transfers.

• "UK IDTA": The UK International Data Transfer Agreement or UK Addendum to the EU SCCs.

Controller Responsibilities (Customer):

As the Controller, you are responsible for:

• Determining the purposes and means of processing Personal Data.

• Ensuring you have a lawful basis for processing (e.g., consent, contract, legitimate interests).

• Providing appropriate notices to Data Subjects about the processing.

• Obtaining any necessary consents from Data Subjects.

• Ensuring the accuracy and quality of Personal Data.

• Responding to Data Subject requests (with our assistance as set out in Section 8).

• Conducting Data Protection Impact Assessments (DPIAs) where required.

• Notifying supervisory authorities and Data Subjects of Personal Data Breaches where required.

• Ensuring your use of our services complies with applicable data protection laws.

Processor Responsibilities (PrivyNet):

As the Processor, we are responsible for:

• Processing Personal Data only on your documented instructions (see Section 4).

• Ensuring personnel are bound by confidentiality obligations (see Section 5).

• Implementing appropriate technical and organisational security measures (see Section 6).

• Engaging Sub-Processors only with your authorisation and under written agreements (see Section 7).

• Assisting you with Data Subject requests and other compliance obligations (see Section 8).

• Notifying you of Personal Data Breaches without undue delay (see Section 9).

• Deleting or returning Personal Data upon termination (see Section 10).

• Making available information necessary to demonstrate compliance (see Section 11).

Documented Instructions:

PrivyNet will process Personal Data only on your documented instructions, unless required to do so by applicable law.

Your instructions to us include:

• The Terms of Service and this DPA.

• Your configuration of the services (e.g., selecting data centre regions, enabling features).

• Written instructions provided via email to privacy@privynet.co.uk.

• Instructions provided through the Customer Dashboard or API.

Scope of Processing:

The nature and purpose of processing is to provide the services described in the Terms of Service, including:

• Hosting and transmitting Customer Content through our VPN infrastructure.

• Storing configuration data and logs necessary for service operation.

• Providing access to the management dashboard and APIs.

Categories of Data Subjects may include:

• Your employees, contractors, and agents.

• Your customers and end users.

• Any individuals whose data you choose to process using our services.

Categories of Personal Data may include:

• Any Personal Data you transmit or store using our services.

• This is determined by you, as the Controller.

Duration of Processing:

We will process Personal Data for the duration of your service agreement and for any retention period specified in the Terms of Service or required by law.

Notification of Unlawful Instructions:

If we believe an instruction from you infringes applicable data protection law, we will promptly notify you. We may suspend processing until you confirm or modify the instruction.

Confidentiality Obligations:

PrivyNet ensures that all personnel authorised to process Personal Data:

• Are bound by contractual confidentiality obligations.

• Have received appropriate training on data protection requirements.

• Process Personal Data only as necessary to perform their duties.

• Are subject to disciplinary measures for breaches of confidentiality.

Access Limitations:

Access to Personal Data is limited to:

• Personnel who require access to provide the services.

• Personnel who require access for security, support, or compliance purposes.

• Authorised Sub-Processors (see Section 7).

Background Checks:

Where permitted by law and appropriate to the role, we conduct background checks on personnel with access to customer data and infrastructure.

Confidentiality Survival:

Confidentiality obligations survive the termination of employment or engagement.

Technical & Organisational Measures:

PrivyNet implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:

Encryption:

• Encryption of Personal Data in transit using TLS 1.2 or higher.

• Encryption of Personal Data at rest using AES-256 or equivalent.

• Secure key management practices.

Access Controls:

• Role-based access controls limiting access to Personal Data.

• Multi-factor authentication for administrative access.

• Regular access reviews and prompt revocation upon role changes.

Infrastructure Security:

• Hosting on Microsoft Azure with ISO 27001, SOC 2, and other certifications.

• Network segmentation and firewalls.

• Intrusion detection and prevention systems.

• Regular vulnerability scanning and penetration testing.

Operational Security:

• Secure software development practices.

• Change management procedures.

• Incident response procedures.

• Business continuity and disaster recovery plans.

Physical Security:

• Data centres with 24/7 security, biometric access, and environmental controls (provided by Microsoft Azure).

Monitoring & Logging:

• Security monitoring and alerting.

• Audit logging of administrative actions.

• Log retention for security and compliance purposes.

We regularly review and update our security measures to address evolving threats and maintain compliance with industry standards.

Authorisation to Use Sub-Processors:

You provide general authorisation for PrivyNet to engage Sub-Processors to assist in providing the services, subject to the requirements in this section.

Current Sub-Processors:

Our current Sub-Processors include:

• Microsoft Azure (Microsoft Corporation)

- Purpose: Cloud infrastructure, compute, storage, networking.

- Location: UK and EU data centres.

- DPA: Microsoft's Data Protection Addendum.

• Stripe (Stripe, Inc.)

- Purpose: Payment processing.

- Location: US, with EU/UK data processing.

- DPA: Stripe's Data Processing Agreement.

A current list of Sub-Processors is available upon request by emailing privacy@privynet.co.uk.

Sub-Processor Agreements:

We ensure that each Sub-Processor is bound by a written agreement that:

• Imposes data protection obligations no less protective than those in this DPA.

• Requires the Sub-Processor to process Personal Data only on documented instructions.

• Requires appropriate security measures.

Notification of Changes:

• We will notify you at least 30 days before adding or replacing a Sub-Processor.

• Notification will be sent to your account email or posted in the Customer Dashboard.

• You may object to a new Sub-Processor by notifying us within 14 days of our notification.

• If you object, we will work with you to find a resolution. If no resolution is possible, you may terminate the affected services without penalty.

Liability:

PrivyNet remains liable for the acts and omissions of our Sub-Processors to the same extent we would be liable for our own acts and omissions.

Data Subject Requests:

If we receive a request from a Data Subject regarding Personal Data you control, we will:

• Promptly notify you of the request (unless prohibited by law).

• Not respond directly to the Data Subject unless authorised by you or required by law.

• Provide reasonable assistance to help you respond to the request.

Your Obligations:

You are responsible for:

• Responding to Data Subject requests within the timeframes required by applicable law.

• Providing us with any instructions necessary to assist with requests.

• Ensuring you have appropriate mechanisms to receive and process requests.

Assistance We Provide:

Taking into account the nature of the processing, we will assist you by:

• Providing technical measures to enable you to respond to requests (e.g., data export tools).

• Providing information about Personal Data we process on your behalf.

• Implementing data corrections, deletions, or restrictions at your instruction.

• Providing confirmation of processing activities.

Data Subject Rights include:

• Right of access (Article 15)

• Right to rectification (Article 16)

• Right to erasure (Article 17)

• Right to restriction of processing (Article 18)

• Right to data portability (Article 20)

• Right to object (Article 21)

Costs:

We may charge reasonable fees for assistance that requires significant effort beyond standard service functionality. We will notify you of any fees in advance.

Breach Notification to Customer:

If PrivyNet becomes aware of a Personal Data Breach affecting Customer Content, we will:

• Notify you without undue delay and, where feasible, within 48 hours of becoming aware of the breach.

• Provide notification to your designated security contact or account email.

Information Provided:

Our notification will include, to the extent known:

• A description of the nature of the breach.

• Categories and approximate number of Data Subjects affected.

• Categories and approximate number of Personal Data records affected.

• Name and contact details of our data protection contact.

• Likely consequences of the breach.

• Measures taken or proposed to address the breach and mitigate adverse effects.

Ongoing Updates:

If full information is not available at the time of initial notification, we will provide updates as information becomes available.

Your Obligations:

As the Controller, you are responsible for:

• Assessing whether the breach requires notification to the supervisory authority (within 72 hours of becoming aware).

• Assessing whether the breach requires notification to affected Data Subjects.

• Making any required notifications.

• Documenting the breach in your records.

Our Assistance:

We will provide reasonable cooperation and assistance to help you:

• Investigate the breach.

• Fulfil your notification obligations.

• Mitigate adverse effects.

Limitations:

We are not responsible for breaches caused by:

• Your actions or omissions.

• Your failure to implement appropriate security measures.

• Unauthorised access resulting from credential compromise on your side.

Retention During Service Agreement:

We will retain Customer Content for the duration of your service agreement in accordance with your instructions and the Terms of Service.

Deletion Upon Termination:

Upon termination of your service agreement:

• Customer Content: We will delete Customer Content within 30 days of termination, unless:

- You request a data export before or at termination.

- We are required by law to retain the data.

- The data is subject to an ongoing legal hold or investigation.

• Configuration Data: We will delete your account configuration and settings within 30 days.

• Logs: Security and audit logs containing Personal Data will be retained in accordance with our standard retention schedule (typically 180 days) and then deleted.

• Backups: Personal Data in backups will be deleted when the backup expires according to our retention policy (typically 30–90 days).

Data Export:

• You may export your Customer Content at any time during your service agreement using the tools provided in the Customer Dashboard or API.

• Upon request at or before termination, we will provide a reasonable data export window (up to 30 days).

• Data export is provided in standard formats (e.g., JSON, CSV) where technically feasible.

Certification of Deletion:

Upon written request, we will provide confirmation that Customer Content has been deleted in accordance with this section, subject to any legal retention requirements.

Exceptions:

We may retain Personal Data where required by applicable law, regulation, or legal process, or where necessary for the establishment, exercise, or defence of legal claims.

Compliance Demonstration:

PrivyNet will make available to you, upon request, information necessary to demonstrate compliance with our obligations under this DPA and applicable data protection law.

Third-Party Audits & Certifications:

We undergo regular third-party audits and maintain certifications including:

• SOC 2 Type II (where applicable)

• ISO 27001 (via Microsoft Azure)

• Other industry-standard certifications

Audit reports and certification documentation are available upon request under NDA.

Customer Audits:

You have the right to conduct audits (or appoint a third-party auditor) to verify our compliance with this DPA, subject to the following conditions:

• Advance Notice: You must provide at least 30 days' written notice of your intention to audit.

• Scope: Audits are limited to activities relevant to the processing of your Personal Data.

• Frequency: No more than one audit per 12-month period, unless required by a supervisory authority or following a Personal Data Breach.

• Confidentiality: Auditors must be bound by confidentiality obligations and must not be competitors of PrivyNet.

• Minimise Disruption: Audits must be conducted during normal business hours and in a manner that minimises disruption to our operations.

• Costs: You are responsible for the costs of any audit you initiate. We may charge reasonable fees for time spent assisting with audits.

Alternatives to On-Site Audits:

In lieu of an on-site audit, you may:

• Review our SOC 2 report or other audit certifications.

• Submit a written questionnaire, which we will respond to within a reasonable timeframe.

• Rely on audits conducted by other customers (anonymised and aggregated).

Data Location:

Customer Content is primarily stored and processed in the United Kingdom and European Economic Area (EEA), using Microsoft Azure data centres in UK South, UK West, and West Europe regions.

Transfers Outside UK/EEA:

Some processing may involve transfers to countries outside the UK/EEA, including:

• Support and operational access by PrivyNet personnel.

• Sub-Processor processing (e.g., Stripe for payments).

• Infrastructure redundancy and disaster recovery.

Transfer Mechanisms:

Where Personal Data is transferred outside the UK/EEA, we rely on the following safeguards:

• UK International Data Transfer Agreement (UK IDTA): For transfers from the UK to third countries.

• UK Addendum to EU SCCs: Where the UK Addendum applies.

• EU Standard Contractual Clauses (SCCs): For transfers from the EEA to third countries.

• Adequacy Decisions: Where the UK Government or European Commission has determined that a country provides adequate protection.

• Binding Corporate Rules: Where applicable to Sub-Processors.

SCCs Incorporated:

Where required, the Standard Contractual Clauses (Module 2: Controller to Processor) are hereby incorporated by reference into this DPA. Details are available in Annex A.

Supplementary Measures:

We implement supplementary technical and organisational measures to protect Personal Data during international transfers, including:

• Encryption in transit and at rest.

• Access controls and logging.

• Contractual commitments from Sub-Processors.

Transfer Impact Assessments:

We have conducted transfer impact assessments for our Sub-Processors and determined that appropriate safeguards are in place.

Customer Responsibility:

As the Controller, you are responsible for conducting Data Protection Impact Assessments (DPIAs) where required by applicable law (e.g., UK GDPR Article 35).

Our Assistance:

Taking into account the nature of the processing and the information available to us, we will provide reasonable assistance to help you conduct DPIAs, including:

• Providing information about our processing activities, security measures, and Sub-Processors.

• Answering questions about our data protection practices.

• Providing documentation about our infrastructure and certifications.

When DPIAs May Be Required:

DPIAs may be required for processing that is likely to result in a high risk to Data Subjects, including:

• Systematic and extensive profiling with significant effects.

• Large-scale processing of special category data.

• Systematic monitoring of publicly accessible areas.

• Use of new technologies.

• Processing that could result in physical, material, or non-material harm.

Request for Assistance:

To request assistance with a DPIA, contact privacy@privynet.co.uk.

Costs:

We may charge reasonable fees for assistance that requires significant effort beyond providing standard documentation. We will notify you of any fees in advance.

Liability:

Each party's liability under this DPA is subject to the limitations of liability set out in the Terms of Service.

Specific Liabilities:

• PrivyNet is liable for damages caused by processing that does not comply with this DPA or applicable data protection law, to the extent we are at fault.

• You are liable for damages caused by your instructions, your breach of applicable data protection law, or your failure to comply with your Controller obligations.

Allocation of Liability:

Where both parties are responsible for damage caused to a Data Subject:

• The party that is fully responsible for the damage may be required to compensate the Data Subject in full.

• That party may then seek contribution from the other party for the portion of liability attributable to them.

Indemnification:

You agree to indemnify and hold harmless PrivyNet from and against any claims, damages, losses, and expenses (including reasonable legal fees) arising from:

• Your breach of this DPA or applicable data protection law.

• Your processing instructions that cause us to violate applicable law.

• Claims by Data Subjects arising from your processing activities.

• Regulatory fines or penalties imposed on us due to your actions or omissions.

No Limitation for Certain Matters:

Nothing in this DPA limits liability for:

• Death or personal injury caused by negligence.

• Fraud or fraudulent misrepresentation.

• Any liability that cannot be excluded or limited under applicable law.

Term:

This DPA is effective from the date you first use our services to process Personal Data and continues for the duration of your service agreement.

Survival:

The following provisions survive termination of this DPA:

• Section 5 (Confidentiality) – survives indefinitely.

• Section 9 (Breach Notification) – survives for 12 months.

• Section 10 (Data Retention & Deletion) – survives until obligations are fulfilled.

• Section 11 (Audit) – survives for 12 months.

• Section 14 (Liability & Indemnification) – survives indefinitely.

• Any provisions necessary to interpret or enforce this DPA.

Effect of Termination:

Upon termination:

• We will cease processing Personal Data on your behalf (except as required by law).

• We will delete or return Personal Data as described in Section 10.

• You remain responsible for any Personal Data you have exported or retained.

Relationship to Terms of Service:

Termination of the Terms of Service automatically terminates this DPA. Termination of this DPA does not automatically terminate the Terms of Service.

Updates:

We may update this DPA from time to time to reflect changes in our practices, legal requirements, or regulatory guidance.

Notification:

• Material Changes: We will provide at least 30 days' advance notice of material changes via email to your account contact and/or via the Customer Dashboard.

• Minor Changes: For clarifications or non-material updates, we may update the DPA without individual notice.

Objection:

If you do not agree to material changes, you may terminate the affected services before the changes take effect by notifying us in writing.

Current Version:

The current version of this DPA is always available on our website. The "Last Updated" date indicates when it was last revised.

Continued Use:

Continued use of our services after changes take effect constitutes acceptance of the revised DPA.

Governing Law:

This DPA is governed by and construed in accordance with the laws of England and Wales.

Jurisdiction:

The courts of England and Wales shall have exclusive jurisdiction to settle any dispute arising out of or in connection with this DPA.

Relationship to Data Protection Law:

Nothing in this DPA reduces our obligations under applicable data protection law. Where this DPA conflicts with applicable data protection law, the requirements of applicable law shall prevail.

Regulatory Authority:

For UK data protection matters, the relevant supervisory authority is the Information Commissioner's Office (ICO).

• Website: https://ico.org.uk/

• Helpline: 0303 123 1113

Data Protection Contact:

For questions, requests, or concerns regarding this DPA or our data protection practices:

• Email: privacy@privynet.co.uk

• Subject Line: "DPA Enquiry" or "Data Protection Request"

Sub-Processor Notifications:

• Email: privacy@privynet.co.uk

• Subject Line: "Sub-Processor Objection" (for objections to new Sub-Processors)

Data Subject Requests:

• Email: privacy@privynet.co.uk

• Subject Line: "Data Subject Request Assistance"

Breach Notifications:

• Email: security@privynet.co.uk

• Subject Line: "Security Incident" or "Data Breach"

Audit Requests:

• Email: privacy@privynet.co.uk

• Subject Line: "Audit Request"

General Legal:

• Email: legal@privynet.co.uk

Response Times:

• Routine enquiries: Within 5 business days.

• Data Subject request assistance: Within 5 business days.

• Breach notifications: Without undue delay, within 48 hours where feasible.

• Sub-Processor objections: Within 14 days.