Data Processing Addendum

01 Scope & roles

1.1   This DPA applies where Sintropyc processes personal data contained in Customer's authorised Targets, Content, Findings, Reports, or related instructions ("Customer Personal Data") to provide the Service.

1.2   Customer is the controller or a processor acting for another controller. Sintropyc is Customer's processor or subprocessor, as applicable. Each party will comply with the data-protection law applicable to its role.

1.3   Customer determines the lawfulness of its instructions, provides required notices, obtains required authorisations, and will not instruct Sintropyc to process data unlawfully. Sintropyc will promptly notify Customer if it reasonably believes an instruction infringes applicable data-protection law.

02 Documented instructions

2.1   Sintropyc will process Customer Personal Data only on Customer's documented instructions: to deliver, secure, troubleshoot, and support the authorised Service; comply with the Agreement; and as otherwise instructed in writing by Customer.

2.2   Sintropyc will not sell Customer Personal Data or use it for advertising, case studies, investor materials, product demonstrations, shared-model training, or improvement for other customers. Any optional use requires separate, specific, prior written consent outside this DPA.

2.3   If law requires processing outside Customer's instructions, Sintropyc will notify Customer before processing unless the law prohibits notice.

03 Personnel & confidentiality

Sintropyc limits access to authorised personnel who need Customer Personal Data to perform the Service. Those personnel are bound by confidentiality duties, receive appropriate security guidance, and lose access when it is no longer required.

04 Security measures

Sintropyc will maintain appropriate technical and organisational measures proportionate to the sensitivity of security-testing data, including the measures in Schedule 2. Sintropyc may update measures as technology changes, but will not materially reduce the overall level of protection during an active Order Form.

05 Assistance to Customer

Taking into account the nature of processing and information available, Sintropyc will reasonably assist Customer with data-subject requests, security obligations, data-protection impact assessments, prior consultations, and demonstrations of compliance. If a data subject contacts Sintropyc about Customer Personal Data, Sintropyc will refer the request to Customer and will not respond substantively unless Customer instructs it or law requires it.

06 Personal Data Breach

Sintropyc will notify Customer without undue delay after becoming aware of a confirmed Personal Data Breach affecting Customer Personal Data. Notice will include available information reasonably needed for Customer's legal obligations and will be supplemented as the investigation progresses. Notification is not an admission of fault. Sintropyc will take reasonable steps to contain, investigate, and remediate the incident.

07 Subprocessors

7.1   Customer gives general written authorisation for the subprocessors on the current Subprocessor List. Sintropyc remains responsible for each subprocessor's performance of its data-protection obligations and imposes written protections appropriate to the processing.

7.2   Sintropyc will provide at least 30 days' advance notice by email before a new subprocessor begins processing Customer Personal Data. Customer may object during that period on reasonable data-protection grounds. The parties will work in good faith on a commercially reasonable alternative; if none is available, Customer may terminate the affected Service without penalty and receive a pro-rata refund of prepaid unused fees.

08 International transfers

Sintropyc will not transfer Customer Personal Data across borders unless a lawful transfer mechanism applies. Where required, the 2021 European Commission Standard Contractual Clauses are incorporated using the controller-to-processor or processor-to-processor module as applicable, with the UK Addendum for restricted UK transfers. The Agreement and Schedules provide the Annex information; the competent supervisory authority and governing law will be selected as required by the applicable module and law.

09 Information & audits

Sintropyc will make available information reasonably necessary to demonstrate compliance with this DPA. No more than once annually, unless a confirmed incident or regulator requires otherwise, Customer may request a remote audit by an independent auditor bound by confidentiality. Audits must avoid access to other customers' data and unreasonable disruption. Customer bears its audit costs; Sintropyc bears the cost of remediation required for a material breach it caused.

10 Return & deletion

10.1   During the Agreement, Customer may request an export or deletion of Customer Personal Data. Following a verified request or termination, Sintropyc will delete Customer Personal Data from active systems within 30 days and from backups within 90 days, and will confirm completion on request.

10.2   At Customer's choice and where technically available, Sintropyc will return Customer Personal Data before deletion. Sintropyc may retain only data required by law or narrowly necessary to establish, exercise, or defend legal claims. Retained data will be isolated, protected, used only for that purpose, and deleted when the retention basis ends.

11 Priority & liability

If this DPA conflicts with the Agreement on processing Customer Personal Data, this DPA controls. The Standard Contractual Clauses control over both where they apply. Liability under this DPA is subject to the Agreement's liability provisions except to the extent applicable law prohibits that limitation.

12 Execution & contact

This DPA is accepted when Customer accepts the Terms or signs an Order Form that incorporates it. The Order Form must identify each party's full legal name, address, and contact details. Privacy and DPA requests may be sent to support@sintropyc.com.

A Processing details

Subject matter

AI-assisted, authorised security testing, reporting, support, and re-testing of Customer-designated Targets.

Duration

For the applicable Order Form plus the deletion periods in Section 10.

Nature

Collection, access, analysis, organisation, redaction, transmission, storage, retrieval, reporting, restriction, return, and deletion, only as needed for the Service.

Purpose

Deliver and secure the authorised Service, prove and report Findings, support remediation and re-testing, prevent abuse, and comply with Customer's documented instructions.

Data subjects

Customer personnel, authorised users, end users of authorised Targets, and other individuals whose data is lawfully present in Customer's test environment.

Data types

Account identifiers; network and device data; Target and scope data; application records encountered during testing; authentication artefacts; correspondence; Findings and Reports. Customer must not intentionally provide special-category data unless expressly agreed and necessary.

B Security measures

• Encrypted transport for Customer Personal Data in transit.
• Least-privilege access, unique accounts, access review, and prompt revocation.
• Scope controls, rate limits, timeouts, circuit breakers, and SSRF protections for testing activity.
• Redaction of raw secrets from Findings, Reports, and ordinary logs.
• Environment separation, dependency maintenance, vulnerability remediation, and secure change practices.
• Security logging, incident response, backup controls, and deletion procedures aligned with Section 10.
• Confidentiality obligations and security training for authorised personnel.
• Subprocessor review and contractual flow-down of relevant data-protection duties.