Data processing agreement

1. Parties and status of this DPA

This data processing agreement (the DPA) is between Kandaro, a company registered in the Netherlands (Kandaro), and the organisation that has accepted the Terms of service (the Customer). Our details:

Company

Kandaro

Address

[Street and number], [Postal code] [City], The Netherlands

Chamber of Commerce (KvK)

[KvK number]

VAT number

[VAT number]

This DPA is the processing agreement required by article 28 of the GDPR. It forms part of the Agreement and applies automatically to every Customer from the moment the Customer accepts the Terms, without a separate signature. It applies for as long as Kandaro processes Customer Personal Data.

2. Definitions

Words defined in the Terms, such as Agreement, Service, Customer Data, Console, Sensor, Connector, User and Admin, have the same meaning in this DPA. In addition:

• GDPR: Regulation (EU) 2016/679, the General Data Protection Regulation, and the laws that implement or supplement it, including the Dutch GDPR Implementation Act (Uitvoeringswet AVG).
• Customer Personal Data: personal data in the Customer Data that Kandaro processes on behalf of the Customer, as described in Annex 1.
• Subprocessor: a third party that Kandaro engages to process Customer Personal Data.
• SCCs: the standard contractual clauses for transfers of personal data to third countries adopted by the European Commission in Implementing Decision (EU) 2021/914.
• EEA: the European Economic Area.
• Controller, processor, data subject, personal data, processing and personal data breach have the meaning given in the GDPR.

3. Roles of the parties

3.1 Controller and processor

For Customer Personal Data, the Customer is the controller and Kandaro is the processor. The Customer decides why and how the Service monitors its networks and tools: where Sensors run, which Connectors are connected, which response actions are approved and who has access.

3.2 Where the Customer is itself a processor

Where the Customer uses the Service on behalf of its own clients, for example as a managed service provider, the Customer is a processor and Kandaro is its subprocessor. The Customer then confirms that its controller has authorised Kandaro's engagement, including the Subprocessors in Annex 3, and that the Customer's instructions match those of its controller. The Customer remains Kandaro's only point of contact: Kandaro takes instructions from, and gives notices to, the Customer, which passes them on to its controller.

3.3 Kandaro as controller

Kandaro is the controller, and this DPA does not apply, where it processes personal data for its own purposes: managing Users' accounts and sign-in security, billing, sales and support relationships, securing the Service, and the aggregated and de-identified service metrics described in section 11.3 of the Terms. That processing is described in the privacy policy.

4. Subject matter, nature and duration

Kandaro processes Customer Personal Data only to provide the Service to the Customer. Annex 1 describes the processing for each product: the categories of data subjects and personal data, the purposes, and how long data is kept. The processing is continuous for as long as the Customer uses the Service, and ends when Customer Personal Data has been deleted under clause 12.

5. Instructions

5.1 Documented instructions

Kandaro processes Customer Personal Data only on the Customer's documented instructions. The Customer's complete instructions at the start of the Agreement are:

1. the Agreement, including this DPA;
2. the Customer's use and configuration of the Service through the Console and the API, such as installing Sensors, connecting Connectors and alert channels, approving response actions, switching on the automatic block rule and exporting data; and
3. other written instructions that the parties agree.

An instruction that goes beyond the Service as described in the Agreement needs Kandaro's agreement, and Kandaro may charge reasonable costs for it. If Kandaro cannot reasonably follow a lawful instruction, it tells the Customer, and the Customer may end the affected Subscription.

5.2 Processing required by law

Kandaro processes Customer Personal Data otherwise only where EU or EU Member State law requires it. In that case Kandaro tells the Customer about that legal requirement before processing, unless the law prohibits this on important grounds of public interest.

5.3 Instructions that infringe the GDPR

Kandaro tells the Customer without delay if, in its opinion, an instruction infringes the GDPR or other EU or Member State data protection law. Kandaro may suspend following that instruction until the Customer confirms or changes it. Kandaro does not have to check every instruction for legality, and its notice is not legal advice.

6. Confidentiality

Kandaro gives access to Customer Personal Data only to staff and contractors who need it to provide, secure or support the Service. Each of them is bound by a contractual or statutory duty of confidentiality that continues after their work for Kandaro ends, and is instructed on how to handle personal data. Kandaro does not disclose Customer Personal Data to third parties, except to Subprocessors under clause 8, on the Customer's instructions, or where the law requires it under clause 5.2.

7. Security

Kandaro implements the technical and organisational measures in Annex 2 to ensure a level of security appropriate to the risk, as required by article 32 of the GDPR. In doing so Kandaro takes into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing, including the fact that Customer Personal Data includes data written by attackers.

Security develops, and Kandaro may change the measures in Annex 2, provided the overall level of security does not decrease. The Customer is responsible for the security of what is under its own control: its networks and systems, the hosts on which it runs Sensors, its Users' credentials, and the access it grants to Connectors.

8. Subprocessors

8.1 General written authorisation

The Customer gives Kandaro general written authorisation to engage Subprocessors. The Subprocessors that Kandaro uses are listed in Annex 3 and on the subprocessors page, with what each one does and where it processes data. The Customer authorises the Subprocessors listed there when it accepts the Terms.

8.2 Notice of changes

Kandaro tells the Customer's Admins by email at least 30 days before it adds or replaces a Subprocessor, and updates the subprocessors page at the same time.

8.3 Right to object

The Customer may object to a new or replacement Subprocessor on reasonable grounds relating to data protection, by telling Kandaro in writing within that 30-day period. The parties then discuss the objection in good faith. If they cannot resolve it before the change takes effect, the Customer may end the Subscriptions for the Service affected by the change, with effect from the date of the change, by written notice. Kandaro then refunds the Fees the Customer has prepaid for the period after the end. Ending the affected Subscriptions is the Customer's only remedy for an unresolved objection.

8.4 Obligations passed on

Kandaro engages each Subprocessor under a written contract that imposes data protection obligations at least as protective as those in this DPA, in particular sufficient guarantees that the Subprocessor implements appropriate technical and organisational measures. Kandaro chooses Subprocessors with care and checks their measures before engaging them.

8.5 Liability for Subprocessors

Kandaro remains fully liable to the Customer for the performance of each Subprocessor's obligations, as for its own, subject to clause 15.

8.6 The Customer's own tools are not Subprocessors

Tools and services that the Customer connects to the Service, such as its endpoint security, identity provider, firewall, log platform, ticketing or chat tools, and threat intelligence services used with the Customer's own account, are not Subprocessors of Kandaro. Kandaro exchanges data with them on the Customer's instructions, and the Customer's own agreements with those providers govern what they do with it.

9. International transfers

All Customer Data is hosted in the Netherlands, on servers Kandaro runs itself. Kandaro and its Subprocessors transfer Customer Personal Data to a country outside the EEA only if that country has an adequacy decision under article 45 of the GDPR, or the transfer is covered by appropriate safeguards under article 46 of the GDPR, such as the SCCs, together with any additional measures the transfer requires. Annex 3 states for each Subprocessor where it processes data and, where relevant, how the transfer is covered.

Where the SCCs are needed for a transfer between the Customer and Kandaro, they are incorporated into this DPA by reference: Module 2 where the Customer is a controller, Module 3 where the Customer is a processor, and Module 4 where the Customer is established outside the EEA and Kandaro returns Customer Data to it. For the SCCs: the docking clause (clause 7) applies; under clause 9, option 2 (general written authorisation) applies, with the notice period in clause 8.2; the optional wording in clause 11 does not apply; under clauses 17 and 18, the law of the Netherlands and the courts of the Netherlands apply; and the annexes to the SCCs are completed with the annexes to this DPA. If the SCCs conflict with this DPA, the SCCs prevail.

10. Assistance to the Customer

10.1 Requests from data subjects

Taking into account the nature of the processing, Kandaro helps the Customer respond to requests from data subjects who exercise their rights under chapter III of the GDPR. The Console lets the Customer find, export and remove data, for example by exporting incidents, events and cases as JSON and by removing Users. Where the Customer cannot do something itself, Kandaro helps on request through the contact form (topic “Privacy or data request”).

If a data subject contacts Kandaro directly about Customer Personal Data, Kandaro does not answer the request itself. It refers the data subject to the Customer where it can identify the Customer, and tells the Customer without undue delay.

10.2 Impact assessments and prior consultation

Taking into account the nature of the processing and the information available to it, Kandaro gives the Customer reasonable help with its data protection impact assessments under article 35 of the GDPR and with any prior consultation of a supervisory authority under article 36, in the first place by providing this DPA, the security page and the information in clause 13.

10.3 Costs

Help through the Console, and the documents Kandaro publishes, are included in the Fees. For other help that takes significant time, Kandaro may charge reasonable costs, agreed in advance, unless the help is needed because Kandaro breached this DPA.

11. Personal data breaches

11.1 Notice to the Customer

Kandaro notifies the Customer without undue delay, and at the latest 48 hours after becoming aware of it, of a personal data breach affecting Customer Personal Data. Kandaro sends the notice by email to the Customer's Admins. As far as it is then known, the notice describes:

• the nature of the breach, including where possible the categories and approximate number of data subjects and of personal data records concerned;
• the name and contact details of a contact point at Kandaro;
• the likely consequences of the breach; and
• the measures Kandaro has taken or proposes to take to address the breach, including to limit its possible adverse effects.

Where not all information is available at once, Kandaro provides it in phases as it becomes available, without further undue delay.

11.2 After the notice

Kandaro takes reasonable steps to contain the breach and limit its consequences, keeps the Customer informed, and helps the Customer meet its own obligations to notify the supervisory authority and data subjects under articles 33 and 34 of the GDPR. Kandaro does not notify authorities or data subjects about a breach of Customer Personal Data on the Customer's behalf, unless the Customer asks it to or the law requires it. A notice under this clause is not an admission of fault or liability.

11.3 Incidents the Service detects

An attack, intrusion or other incident in the Customer's own networks or tools that the Service detects and reports is not a personal data breach by Kandaro. Reporting it is part of the Service. The Customer decides whether it is a breach that the Customer must notify.

12. Deletion and return at the end

12.1 Export

During the Agreement, and for 30 days after it ends, the Customer's Admins can export their incidents and events, and cases, as JSON from the Console. This is how Kandaro returns Customer Personal Data. On request Kandaro helps the Customer with other data it cannot export itself.

12.2 Deletion

When the Customer asks us to delete its organisation, or after that 30-day export period, Kandaro deletes Customer Personal Data within 30 days. Copies in our backups are deleted when those backups age out, at the latest 35 days later. Until then they stay encrypted and are used only to restore the Service after a failure. On request, Kandaro confirms the deletion in writing.

12.3 What Kandaro may keep

Kandaro may keep, and then only for the purpose stated:

• personal data that EU or Member State law requires it to keep, for as long as required;
• entries in its tamper-evident audit log, which cannot be removed one by one without breaking the record of what happened in the Service. Kandaro keeps them as controller, for up to 12 months after the Agreement ends, only to secure the Service, to prove what happened and to establish or defend legal claims, and protects them under Annex 2; and
• aggregated and de-identified information under section 11.3 of the Terms, which is not personal data.

Retention periods during the Agreement are set out in Annex 1. The Customer can shorten them by deleting data where the Console allows it.

13. Audits and information

13.1 Information

Kandaro makes available to the Customer the information needed to show that it meets article 28 of the GDPR and this DPA. It does so in the first place through this DPA, its Annexes, the security page, the disclosure policy, summaries of independent tests and assessments where they exist, and written answers to the Customer's reasonable security and privacy questionnaires, once a year or after a personal data breach.

13.2 Audits

If that information is not enough to show compliance, or a supervisory authority requires it, the Customer may audit Kandaro's compliance with this DPA, including by an inspection on site, under these conditions:

• at most once a year, unless a supervisory authority requires more, or after a personal data breach affecting Customer Personal Data;
• with at least 30 days' written notice, and with an audit plan setting out the scope, timing and duration, agreed in advance;
• by the Customer or by an independent auditor it appoints who is not a competitor of Kandaro, and who is bound by a duty of confidentiality to Kandaro;
• during business hours, without unreasonably disrupting Kandaro's operations, and without access to the data of other customers or to information whose disclosure would put the security of the Service or of other customers at risk; and
• at the Customer's own cost.

Audit findings are confidential information under section 14.1 of the Terms. The Customer gives Kandaro a copy of the audit report. Kandaro remedies any shortcoming in its compliance with this DPA that the audit shows within a reasonable time, at its own cost. Nothing in this clause limits an audit or inspection by a supervisory authority.

14. The Customer's obligations

The Customer is responsible for, and confirms that:

• it has a valid legal basis under the GDPR for the processing it instructs, including for the monitoring the Service carries out and for sending Customer Personal Data to Kandaro;
• its instructions comply with the GDPR and other applicable law, and it has the right to give Kandaro the access each Sensor and Connector needs;
• it informs its employees and other users of its systems about the monitoring, as the GDPR requires, and obtains the consent of its works council where the law requires it, for example under article 27 of the Dutch Works Councils Act (Wet op de ondernemingsraden), as set out in the acceptable use policy;
• it does not deliberately send special categories of personal data or data about criminal convictions to the Service. Kandaro does not intend to process such data. Where it appears by chance in content that attackers send to a decoy or in alerts from the Customer's tools, Kandaro protects it like other Customer Personal Data; and
• it carries out any data protection impact assessment the processing requires and keeps its own records of processing.

15. Liability

Each party's liability arising from or related to this DPA is subject to section 15 of the Terms. The limit of liability there applies to all claims under the Agreement together, including this DPA, and not separately. Nothing in this DPA limits either party's liability towards data subjects under article 82 of the GDPR, or any liability that cannot be limited by law.

16. Order of precedence, changes and governing law

16.1 Precedence

If this DPA conflicts with the Terms or with any policy referred to in them, this DPA prevails on everything related to the processing and protection of personal data, as section 3 of the Terms provides. Where the SCCs apply, they prevail over this DPA.

16.2 Changes

Kandaro may change this DPA in the same way as the Terms, under section 18 of the Terms, by telling the Customer's Admins at least 30 days ahead. A change may not reduce the protection of Customer Personal Data, unless the law requires it. Changes to Annex 3 follow clause 8.

16.3 Governing law and disputes

This DPA is governed by Dutch law. Disputes go to the court set out in section 20 of the Terms.

16.4 Contact

Questions about this DPA, and requests under it, go through the contact form with the privacy topic. To report a security problem, follow the disclosure policy.

Annex 1. Description of the processing

This annex applies to all processing below:

• Controller: the Customer (or, under clause 3.2, the Customer's client). Processor: Kandaro.
• Categories of data subjects: employees, contractors and other users of the Customer's systems, including Users of the Service; attackers and intruders; and other people whose names, accounts or identifiers appear in logs, alerts or captured traffic.
• Special categories of personal data: not intended. See clause 14.
• Frequency: continuous, for as long as the Customer uses the Service.
• Nature of the processing: receiving, storing, organising, analysing, enriching, explaining, displaying, sending notifications about, exporting and deleting data, and, for Kandaro SOC, carrying out approved response actions.

For each part of the Service:

Annex 2. Technical and organisational measures

Kandaro protects Customer Personal Data with the measures below. The security page explains them in more detail. We do not publish which algorithms or software we use; security teams can ask for that information under a confidentiality agreement.

Annex 3. Subprocessors

The Customer authorises the Subprocessors below under clause 8: the third parties that process Customer Data. Third parties that only process data for which Kandaro is itself the controller, such as payments and our website, are not Subprocessors under this DPA. The full list, with the data each one receives and how any transfer outside the EEA is covered, is always on the subprocessors page.