Data Processing Addendum
This Data Processing Addendum ("DPA") forms part of the agreement between the customer ("Customer") and [legal entity name] ("ThreatWarder") for the ThreatWarder Service and applies where ThreatWarder processes personal data on the Customer's behalf.
1. Roles
For personal data contained in cases, evidence and account records that the Customer provides or instructs us to collect, the Customer is the controller and ThreatWarder is the processor. For personal data we collect from public sources during monitoring, the parties' roles are described in Annex 1.
2. Processing details
- Subject matter: detection and documentation of online abuse of the Customer's brands and content, and submission of takedown requests.
- Duration: the term of the agreement plus the retention period in section 7.
- Nature and purpose: collection, storage, analysis and transmission of data to third parties for the purpose of removing abusive content.
- Data subjects: Customer personnel; individuals who publish or are referenced in abusive content; individuals who operate infrastructure used for abuse.
- Categories of data: names, contact details, account identifiers, domain registration data, content of web pages and posts, IP addresses and technical identifiers.
3. Instructions
ThreatWarder processes personal data only on the Customer's documented instructions, which include the agreement, the Customer's configuration of the Service and any written instructions. We will inform the Customer if an instruction appears to infringe data protection law.
4. Confidentiality and security
Personnel with access to personal data are bound by confidentiality. ThreatWarder implements the technical and organisational measures described in Annex 2, including encryption in transit and at rest, access control, logging and incident response.
5. Subprocessors
The Customer authorises the subprocessors listed in Annex 3. We will give [30 days'] notice of changes, during which the Customer may object on reasonable grounds. ThreatWarder remains responsible for its subprocessors' performance.
6. International transfers
Where personal data is transferred outside the EEA or the United Kingdom, the parties rely on the EU Standard Contractual Clauses (Module 2 and, where applicable, Module 3) and the UK International Data Transfer Addendum, which are incorporated by reference, or another lawful transfer mechanism.
7. Retention and deletion
Evidence and case data are retained for the term of the agreement plus [12 months] to support legal proceedings, unless the Customer instructs earlier deletion. On expiry of that period, or on the Customer's instruction, personal data is deleted or returned within [30 days], except where retention is required by law.
8. Assistance
ThreatWarder will assist the Customer, taking into account the nature of the processing, in responding to data subject requests, carrying out data protection impact assessments and consulting supervisory authorities.
9. Personal data breaches
ThreatWarder will notify the Customer without undue delay, and in any event within [48 hours], after becoming aware of a personal data breach affecting Customer personal data, and will provide the information reasonably required for the Customer to meet its own notification obligations.
10. Audit
ThreatWarder will make available the information necessary to demonstrate compliance with this DPA, including audit reports under NDA, and will allow audits by the Customer or an agreed independent auditor no more than once per year on reasonable notice, unless required by a supervisory authority.
Annex 1: Monitoring data
[Describe the parties' roles for personal data collected from public sources during monitoring, the lawful basis relied on and the safeguards applied.]
Annex 2: Security measures
[Summarise the measures described in the Trust center.]
Annex 3: Subprocessors
[List each subprocessor, the service it provides and its location.]