Data Processing Addendum

1. Scope and roles

This DPA applies where RansomLeak processes personal data on behalf of the customer in providing the Service. For that personal data the customer is the controller (or a processor acting for its own controller) and RansomLeak is the processor (or subprocessor).

It is designed to meet Article 28 of the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, and the Swiss Federal Act on Data Protection (FADP), together "Data Protection Law". Terms such as "personal data", "processing", "controller", "processor" and "personal data breach" have the meaning given in the GDPR.

RansomLeak acts as an independent controller only for account, billing and business-contact data and for its public website, as described in our Privacy Policy. That data is outside this DPA.

2. Details of processing (Annex I)

Subject matter:

Providing the RansomLeak security awareness training platform and related services under the Agreement.

Duration:

The term of the Agreement, plus the deletion period in section 9.

Nature and purpose:

Hosting, storage, user provisioning, delivery of training, phishing and other simulations, reporting, risk scoring, support and the other functions the customer enables in the Service.

Data subjects:

The customer's employees, contractors and other people the customer invites to or provisions into the Service, and its administrators.

Categories of data:

Identity and contact data (name, work email, optional phone number), organizational data (department, manager, role, location, employment status), account and authentication data, training activity and results, simulation interactions, risk scores, and technical data such as IP address and browser details. If the customer installs the browser extension, the security events it reports.

Special categories:

None by default. If a customer administrator enables deepfake drills, the voice samples the administrator uploads are processed to generate simulation audio. The customer is responsible for obtaining the consent of the people whose voices are used.

3. Processor obligations

• Process personal data only on the customer's documented instructions. The Agreement, this DPA and the customer's configuration of the Service are those instructions. RansomLeak will tell the customer if it believes an instruction infringes Data Protection Law.
• Ensure everyone authorised to process the personal data is bound by confidentiality.
• Implement the technical and organisational measures required by Article 32 GDPR, summarised in Annex II below and described in full on our Security & Compliance page.
• Not sell personal data, and not use it for advertising or for any purpose other than providing the Service.

4. Subprocessors

The customer gives RansomLeak general authorisation to engage subprocessors. The current list is published at ransomleak.com/subprocessors.

RansomLeak binds each subprocessor by written contract to data protection obligations at least as protective as this DPA, and remains liable to the customer for its subprocessors.

RansomLeak gives at least 30 days notice before adding or replacing a subprocessor. The customer may object on reasonable data protection grounds within that period. The parties will try in good faith to resolve the objection; if they cannot, the customer may terminate the affected part of the Service and receive a pro-rata refund of prepaid fees for it.

5. Assistance

• Data subject requests: the Service lets administrators view, export, correct and delete user data. RansomLeak forwards any request it receives directly to the customer and helps with requests the customer cannot handle in the Service.
• RansomLeak provides reasonable help with data protection impact assessments and prior consultations with supervisory authorities, taking into account the nature of the processing and the information available to it.

6. Personal data breaches

RansomLeak notifies the customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting customer personal data. The notice describes, as far as then known, the nature of the breach, the categories and approximate number of people and records affected, the likely consequences, and the measures taken or proposed. RansomLeak supplements the notice as more information becomes available.

7. Audits

RansomLeak makes available the information needed to demonstrate compliance with this DPA. The customer agrees to rely first on RansomLeak's security documentation, third-party reports and certifications, and responses to security questionnaires.

Where that is not enough, or a supervisory authority requires it, the customer may conduct an audit, including an on-site inspection, at most once a year, with at least 30 days written notice, during business hours, under confidentiality, and at its own cost.

8. International transfers

• Each customer chooses its hosting region when its tenant is created. Personal data of customers hosted in the EU region (AWS eu-west-1, Ireland) is stored and processed in the European Economic Area.
• Where personal data is transferred outside the EEA, the UK or Switzerland, including to US-hosted tenants or US subprocessors, the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914 apply: Module 2 (controller to processor) and Module 3 (processor to processor), with Clause 7 included, option 2 of Clause 9 (general authorisation, 30 days), the optional wording in Clause 11 omitted, and Clauses 17 and 18 governed by and decided in Estonia.
• For UK transfers, the UK Information Commissioner's International Data Transfer Addendum supplements those clauses. For Swiss transfers, references to the GDPR are read as references to the FADP and the competent authority is the Swiss FDPIC.
• Where a recipient is certified under the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions), that certification may be relied on instead.

9. Deletion and return

During the term, administrators can export their data from the Service. Within 30 days after the Agreement ends, RansomLeak deletes customer personal data from the Service, unless the law requires it to be kept. Encrypted backups are overwritten on their normal rotation and are not restored in the meantime except to recover the Service.

10. Liability

Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Agreement, except where Data Protection Law does not allow them to be limited.

11. Precedence and governing law

If there is a conflict, the Standard Contractual Clauses prevail over this DPA, and this DPA prevails over the rest of the Agreement for the processing of personal data. This DPA is governed by the law that governs the Agreement.

Annex II: Technical and organisational measures

• Encryption in transit (TLS 1.2 and above) and at rest (AES-256)
• Logical tenant isolation, with a separate database schema per customer
• Single sign-on, multi-factor authentication and role-based access for administrators
• Least-privilege, logged access for RansomLeak staff, with audited support access only at the customer’s request
• Network isolation, threat detection and continuous monitoring on AWS
• Encrypted backups, tested recovery and documented incident response
• Secure development practices: peer code review, CodeQL static analysis and dependency vulnerability scanning on every change, and a published vulnerability disclosure process

Details are kept current on our Security & Compliance page.