Data Processing Agreement

1. Definitions

2. Subject Matter and Duration

This DPA governs the processing of Personal Data by the Processor in connection with the provision of the Services.

Nature and purpose of processing

• Analysis of network traffic metadata to detect cybersecurity threats
• Generation of compliance reports (NIS2 Art. 23, GDPR Art. 33)
• Storage of alert data and audit logs for the duration of the subscription
• Transmission of threat-intelligence data to the detection engine

Duration

Processing begins upon activation of the NetSenX subscription and continues until termination. Upon termination, Personal Data is retained for a maximum of 90 days, after which it is permanently deleted, unless legal obligations require longer retention.

3. Categories of Personal Data and Data Subjects

Categories of data subjects:employees, contractors, and other authorised users of the Controller’s networks; the Controller’s administrative users of the NetSenX dashboard.

Zero Payload Policy: The NetSenX agent never captures, buffers, stores, or transmits packet payloads. Only flow-level metadata is processed — equivalent to telephone billing records (call duration, numbers) rather than call recordings.

4. Obligations of the Processor

The Processor shall:

• Process Personal Data only on documented instructions from the Controller, unless required by EU or member-state law.
• Ensure that persons authorised to process Personal Data have committed to confidentiality.
• Implement appropriate technical and organisational measures (TOMs) per GDPR Art. 32 (see Section 7).
• Not engage Sub-processors without prior authorisation from the Controller (general authorisation granted per Section 6).
• Assist the Controller in responding to data-subject requests (Art. 15–22) within 72 hours of notification.
• Notify the Controller of any Personal Data breach within 24 hours of becoming aware of it, in line with Section 9.
• Delete or return all Personal Data on termination of services at the Controller’s choice (Section 13).
• Make available all information necessary to demonstrate compliance with GDPR Art. 28.
• Not transfer Personal Data outside the European Economic Area without adequate safeguards.

5. Obligations of the Controller

The Controller shall:

• Ensure a valid legal basis exists for processing Personal Data through the Services.
• Provide necessary privacy notices to data subjects whose data is processed via NetSenX.
• Ensure that processing complies with applicable data-protection laws in the Controller’s jurisdiction.
• Not instruct the Processor to process Personal Data in a manner that would violate applicable law.
• Promptly notify the Processor of any changes to applicable data-protection requirements that affect the Services.
• Be responsible for the security of credentials (API keys, user passwords) used to access the Services.

6. Sub-processors

The Controller grants general authorisation for the Processor to engage the following Sub-processors. The Processor will notify the Controller at least 14 days in advance of any changes to this list, giving the Controller the opportunity to object.

7. Technical and Organisational Measures (GDPR Art. 32)

8. Assistance with Data-Subject Rights

The Processor provides the following tools to assist the Controller in fulfilling data-subject rights:

The Processor will respond to Controller requests within 72 hours and provide the requested data or action within 30 days.

9. Personal Data Breach Notification

In the event of a Personal Data breach, the Processor shall:

• Notify the Controller without undue delay and in any event within 24 hours of becoming aware of the breach.
• Provide, at minimum: nature of the breach, categories and approximate number of data subjects affected, likely consequences, and measures taken or proposed.
• Provide a dedicated incident report (GDPR Art. 33 format) within 72 hours of the initial notification.
• Cooperate fully with the Controller’s notifications to supervisory authorities.

The Controller remains solely responsible for notifying the competent supervisory authority within 72 hours of becoming aware of a breach (GDPR Art. 33). NetSenX provides the technical documentation and report templates to facilitate this obligation.

10. International Data Transfers

All Personal Data processed under this DPA remains within the European Economic Area (EEA). Where a Sub-processor is headquartered outside the EEA (e.g., US-incorporated entities), processing is governed by Standard Contractual Clauses pursuant to GDPR Art. 46(2)(c) and, where applicable, supplementary measures per EDPB Recommendations 01/2020.

11. Audits and Inspections

The Controller has the right to conduct audits and inspections of the Processor’s data-processing activities, subject to the following conditions:

• Minimum 14 days’ written notice before any audit
• Conducted during business hours, minimising disruption
• Maximum one audit per 12-month period, unless there is reasonable cause for additional audits
• Audit costs borne by the Controller unless deficiencies are found attributable to the Processor
• Third-party audit reports (e.g., SOC 2 Type II) may be provided in lieu of direct audit access, at the Processor’s discretion

12. Liability

The Processor’s liability under this DPA is limited as set out in the NetSenX Terms of Service. Each party is liable for damages caused by processing that infringes this DPA or applicable data-protection law, in accordance with GDPR Art. 82.

13. Termination and Data Return

On termination of the Services agreement, the Processor shall, at the Controller’s choice:

• Return: provide a complete export of all Personal Data in JSON format within 30 days, or
• Delete: permanently delete all Personal Data within 90 days of termination.

Deletion is confirmed in writing. Backup copies are purged on the next scheduled backup cycle following the deletion date.

14. Contact and Governing Law

Enterprise customers requiring a signed DPA may request execution by emailing dpo@netsenx.com.