Data processing addendum

1. Roles

This data processing addendum (DPA) forms part of the agreement between Keelpost Studio LLC (Keelpost, we, us, processor) and the client named in the statement of work (SOW) (client, controller). It applies whenever Keelpost processes personal data on the client's behalf in connection with the services.

The client decides the purposes and means of processing. Keelpost processes personal data only on documented instructions, as required by law, or as set out in this DPA. For data processed for our own purposes, such as website inquiries, billing and account records, we are a controller under the privacy policy, and this DPA does not apply. Where the client is a processor for another controller, it confirms that it has authority to appoint Keelpost and to give the instructions in the SOW.

2. Scope and purpose of processing

The subject matter is the services in the SOW: security assessments, penetration tests, care plans and software builds. The nature of processing is collection, recording, storage, retrieval, analysis, disclosure in reports, and deletion.

The purpose is to deliver the services, produce findings and reports, support the client's systems, and meet legal obligations. Keelpost does not process client personal data for advertising, resale, profiling that produces legal or similarly significant effects, or to train general-purpose AI models, and does not sell it. If an instruction is unclear or, in our reasonable view, infringes data protection law, we tell the client and may pause the affected processing until it is confirmed in writing.

3. Categories of data and data subjects

The categories depend on the engagement, and the data subjects are client personnel, end users whose data appears in the systems under test, and client contacts. In practice the categories are:

• Contact details: names, work emails, usernames and user IDs of client staff and end users.
• Authentication and audit data: login timestamps, IP addresses, session records and role assignments.
• Application content captured as evidence: screenshots, HTTP requests and responses, database excerpts, file listings and error messages.
• Vulnerability and configuration data: findings, hostnames, software versions and configuration extracts.
• Support correspondence: emails, tickets and call notes.
• Billing contacts: invoice recipients, company addresses and purchase order references.

We do not knowingly process special category data. Where the SOW does not require it, the client should keep it out of systems and evidence made available to us; if we encounter it, we minimize it, exclude it from reports and tell the client.

4. Duration

Processing lasts for the term of the main agreement and ends when the last service is delivered and the retention period for the deliverable has expired, unless a SOW states a different period. The return and deletion obligations in section 11 continue after processing ends. Where the law requires us to keep records, such as invoices, tax filings and signed contracts, we keep them for 7 years as a controller; those records are limited to what the law requires and are not used for any other purpose.

5. Processor obligations

Instructions

We process personal data only on the client's documented instructions, including transfers, unless required by law. If the law requires processing beyond those instructions, we tell the client unless the law prohibits it, and we document the requirement.

Confidentiality

Access is limited to personnel who need it. Everyone with access is under a written confidentiality obligation that survives their engagement, and we brief personnel on these obligations before access is granted.

Security

We apply the measures in Annex B and review them at least annually. Measures may change, provided the overall level of protection does not decrease materially.

Assistance

We assist with data subject requests, data protection impact assessments and prior consultations with supervisory authorities, taking into account the nature of the processing and the information available to us. We forward any request we receive directly to the client without responding to it unless the law requires otherwise. Work beyond the scope of the services is agreed and charged in writing first.

Breach notification

After becoming aware of a personal data breach affecting client data, we notify the client without undue delay and within 48 hours where feasible. The notice describes what happened, the data and data subjects affected, the likely consequences, and the measures taken or proposed. We provide updates as the investigation develops and cooperate with the client's own notifications. We do not notify the client's customers or regulators on its behalf unless it instructs us in writing and we agree the scope. We are not a 24/7 security operations center; the 48-hour target runs from the moment we become aware, and we act on alerts as soon as they are seen.

Deletion or return

At the end of processing we return or delete personal data as the client chooses, subject to the retention in section 4 and the procedure in section 11. We confirm deletion in writing on request.

6. Subprocessors and notice of changes

The client gives general written authorization for us to engage subprocessors for the processing described in Annex A. Our current subprocessors are listed in Annex C.

We give at least 30 days' written notice before adding or replacing a subprocessor that processes client personal data, so the client can object. We impose data protection obligations on each subprocessor that are no less protective than this DPA, and we remain liable for their performance.

If the client objects on reasonable data protection grounds, we will try to resolve it. If we cannot, the client may terminate the affected services on written notice and receive a refund of prepaid fees for the unexpired period. An emergency replacement, such as a failing infrastructure provider, may be made before notice where necessary to keep services secure, with notice as soon as practicable.

7. International transfers

Personal data may be transferred to and processed in the United States and the European Union, including data received from the United Kingdom. Where personal data protected by the GDPR or UK GDPR is transferred outside the EEA or the UK, we rely on:

• Standard Contractual Clauses (SCCs): the 2021/914 modules, Module Two (controller to processor) or Module Three (processor to processor), with the client as exporter and Keelpost as importer.
• UK International Data Transfer Agreement (UK IDTA): or the UK Addendum to the SCCs, for restricted transfers from the UK.
• Transfer impact assessment: documented before a new route is used, reviewed annually and when the law or a provider changes.
• Supplementary measures: encryption in transit, access control, minimization and a documented process for challenging government access requests.

Where the SCCs or the UK IDTA apply, they prevail over this DPA if they conflict. We tell the client if we can no longer meet the transfer obligations, and stop the affected transfer or put alternative safeguards in place.

8. Security measures

Annex B describes the technical and organizational measures in place at the date of this DPA. In summary:

• Access control: unique named accounts, least privilege, quarterly review and removal within 1 business day of a role change.
• Encryption in transit: TLS 1.2 or higher, and 1.3 where supported, with HSTS on public endpoints. Client data and backups are encrypted at rest by our providers.
• Multi-factor authentication (MFA): required on email, code hosting, cloud consoles and the password vault. No shared accounts.
• Logging: authentication and administrative events are logged centrally for at least 90 days and reviewed during support hours.
• Secure disposal: accounts and test data are removed at close, media is sanitized, and a written record is available on request.

We do not hold ISO 27001 or SOC 2 certification, and Annex B describes what we do rather than a certificate. We review the measures annually and after any material incident.

9. Audit rights

Once per 12 months, and after a material breach affecting client data, the client may audit our compliance with this DPA on reasonable notice. The default is a written questionnaire and supporting evidence, answered within 30 days. We answer security questionnaires under NDA, and a current summary of the measures in Annex B is available on request. Repeated audits of the same scope in the same period may be refused.

An on-site audit is available only where required by law, by a supervisory authority or by a binding order. It is limited to the systems and records relevant to the services, conducted during support hours, at the client's cost and under confidentiality. We do not provide access to another client's data or to information that would compromise another client's security.

10. Incident handling

An incident is any event that has compromised, or is reasonably likely to compromise, the confidentiality, integrity or availability of client personal data. Suspected incidents are triaged the same way as confirmed ones.

• Contain: restrict access, rotate credentials and isolate affected systems.
• Assess: identify the data, data subjects and likely consequences, and decide whether the incident is notifiable.
• Notify: inform the client under section 5 and cooperate with its regulator and data subject notifications.
• Remediate: fix the cause, add a control or check, and record the change.
• Review: provide a written post-incident review for incidents affecting client data.

We keep an incident log and preserve evidence. We do not notify the client's regulators or customers on its behalf unless instructed in writing and agreed in scope. Our support hours are 09:00–18:00 GMT+8, Monday to Friday, and we are not a 24/7 security operations center.

11. Return and deletion of data

Within 30 days of the end of processing, we return client personal data in a commonly used format (CSV, JSON or the original format) or delete it, as the client chooses in writing. If the client does not choose within 30 days, we delete it.

We delete copies in backups as the backup cycle overwrites them, and in any event within 90 days, unless the law requires retention. Residual copies are access-restricted until then. We provide written confirmation of deletion on request. We may keep invoice and contract records for 7 years where tax and accounting law requires it; those records are limited and are not used for the services.

12. Liability

Each party's liability under this DPA is subject to the limitations in the main agreement, including the cap at fees paid in the preceding 12 months. Nothing in this DPA limits a data subject's rights under data protection law, or a party's liability where the law does not allow limitation. Where the SCCs or the UK IDTA apply, their liability provisions govern the transfer to the extent they conflict with this DPA. We are not liable for a breach caused by the client's instructions, the client's systems, or a third party outside our control, except to the extent the law provides otherwise.

13. How this DPA interacts with the main agreement

This DPA supplements the main agreement and does not replace it. It applies from the later of signature of the main agreement and the start of processing, and continues while we process client personal data. If this DPA conflicts with the main agreement on personal data, this DPA prevails. If it conflicts with the SCCs or the UK IDTA, those instruments prevail to the extent of the conflict. The main agreement, which is governed by the laws of the State of Delaware, USA, governs fees, intellectual property, liability and termination.

If any provision is held invalid, the rest remains in force and the invalid provision is replaced by one that achieves the same protection to the extent permitted. Amendments must be in writing and signed by both parties. A SOW may add processing details but cannot reduce the protections in this DPA unless both parties sign a specific written amendment that names this DPA.

Annex A — Processing details

Annex B — Technical and organizational measures

Annex C — Subprocessors

Each listed subprocessor is bound by data protection terms and processes personal data only on our instructions, except where the law requires otherwise. We give 30 days' notice before adding or replacing a subprocessor, except for an emergency substitution under section 6. Locations are primary processing regions; support access may originate elsewhere under section 7.

Questions about this DPA: xcsfx@icloud.com. Related documents: Privacy policy · Terms of service. This DPA is a template and must be reviewed by qualified counsel before publication.