Ghostprobe Data Processing Agreement

Oct 28, 2026

1. Scope and roles

1.1This Data Processing Agreement ("DPA") forms part of the Ghostprobe Terms of Service ("Terms") between Vlasiu Alexandru Robert PFA, trading as Ghostprobe ("Ghostprobe", "we"), and the customer ("you"). Words defined in the Terms have the same meaning here.

1.2"Data Protection Law" means the UK GDPR, the Data Protection Act 2018, the EU GDPR (Regulation (EU) 2016/679) and any other data protection law that applies to the processing. "Personal data", "controller", "processor", "processing", "data subject" and "personal data breach" have the meanings given in that law.

1.3This DPA applies when we process personal data on your behalf to provide the services ("Customer Personal Data"). You are the controller and we are the processor. Annex 1 describes the processing.

1.4This DPA does not cover personal data we use as a controller, such as your staff's account and billing details. Our Privacy Policy covers that.

2. Your instructions

2.1We process Customer Personal Data only on your documented instructions, including for transfers outside the UK and EEA, unless the law requires otherwise. If it does, we will tell you first unless the law forbids it.

2.2The Terms, the Scope you confirm and your use of the services' settings are your instructions. Further instructions must be in writing and consistent with the Terms.

2.3We will tell you promptly if we think an instruction breaks Data Protection Law.

2.4You are responsible for having a lawful basis for the processing and for giving data subjects any notices the law requires.

3. Confidentiality

3.1We make sure everyone we allow to process Customer Personal Data is bound by a duty of confidentiality, by contract or by law.

4. Security

4.1We apply appropriate technical and organisational measures to protect Customer Personal Data, as required by Article 32 of the UK GDPR and EU GDPR. Annex 2 lists them.

4.2We may update these measures, as long as the overall level of protection does not go down.

5. Subprocessors

5.1You give us general written authorisation to use the subprocessors listed at ghostprobe.io/subprocessors (Annex 3).

5.2We will give you at least 30 days' notice by email before adding or replacing a subprocessor. You may object on reasonable data protection grounds within that period. If we cannot address your objection, you may end the affected services and we will refund any prepaid fees for services not yet delivered.

5.3We will bind each subprocessor by written contract to data protection terms at least as strict as this DPA. We remain liable to you for our subprocessors' performance of those terms.

5.4We will not allow any subprocessor to use Customer Personal Data to train AI models.

6. International transfers

6.1We are established in Romania and store Customer Personal Data in the European Union. Transfers from the UK to us are covered by the UK's adequacy regulations for EEA countries.

6.2If we or a subprocessor transfer Customer Personal Data to a country without an adequacy decision, we will put in place, before the transfer:

for data from the EEA, the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914, using the module that fits the parties' roles; and
for data from the UK, the International Data Transfer Addendum to those clauses issued by the ICO, or the ICO's International Data Transfer Agreement.

6.3Where a recipient is certified under the EU-US Data Privacy Framework (or its UK Extension), we may rely on that as well, but not instead of the safeguards in 6.2.

6.4We will carry out and record a transfer risk assessment where the law requires one.

7. Assistance

7.1If a data subject contacts us about Customer Personal Data, we will pass the request to you and will not respond except on your instructions. We will help you answer requests to exercise data subject rights, taking into account the nature of the processing.

7.2We will help you meet your obligations on security, breach notification, data protection impact assessments and prior consultation with a supervisory authority, taking into account the nature of the processing and the information available to us.

7.3We may charge reasonable costs for help that goes beyond what the services normally provide.

8. Personal data breaches

8.1We will tell you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data.

8.2We will give you the information you need to meet your own obligations, as far as we have it: what happened, the categories and rough number of people and records affected, likely consequences, and what we have done or plan to do. If we do not have all of it at first, we will send it in stages.

8.3Telling you about a breach is not an admission of fault.

9. Deletion and return

9.1We delete Customer Personal Data on the timelines in section 12 of the Terms. You can export your Dossiers from your Account at any time before deletion.

9.2At your written request when the services end, we will delete Customer Personal Data earlier, unless the law requires us to keep it.

9.3Copies in backups are deleted as backups expire, within 30 days, and are kept secure until then.

10. Audits

10.1We will make available the information you reasonably need to show that we meet Article 28 of the UK GDPR and EU GDPR.

10.2You, or an independent auditor you appoint who is not our competitor, may audit our compliance with this DPA once in any 12 months, and also after a personal data breach or if a supervisory authority requires it. You must give 30 days' notice, keep what you learn confidential, avoid disrupting our business, and pay your own costs.

10.3Where we hold a current independent audit report or certification that covers your request, we may provide it instead of an on-site audit, unless a supervisory authority requires more.

11. Liability, term and priority

11.1Each party's liability under this DPA is subject to the limits in section 17 of the Terms, except where the law does not allow it.

11.2This DPA lasts for as long as we process Customer Personal Data.

11.3If this DPA conflicts with the Terms on personal data, this DPA wins. If it conflicts with the Standard Contractual Clauses or the UK Addendum, those win.

11.4This DPA is governed by the law that governs the Terms, except that the Standard Contractual Clauses and UK Addendum are governed as they themselves state.

Annex 1: Details of processing

The processing covered by this DPA is as follows:

Subject matter:: Security testing of the Targets in your Scope
Duration:: The term of the Terms, plus the deletion periods in Terms section 12
Nature and purpose:: Automated and human-reviewed security testing, storing results and producing Dossiers
Data subjects:: Your staff and test users named in Test Credentials; your end users whose data is held on a Target or appears in Source Code
Categories of data:: Test account logins; names, emails and other identifiers stored in or returned by Targets; personal data in Source Code; IP addresses in test logs
Special category data:: Not intended. If a Target holds it, testing may expose it by accident; we access the minimum needed (Terms Schedule 1, S1.5)
Location:: Stored in the EU; processed by the subprocessors in Annex 3

Annex 2: Security measures

We apply the following technical and organisational measures:

Encryption:: TLS 1.2 or higher in transit; AES-256 at rest.
Test Credentials:: stored encrypted, used only by the testing engine, and masked in logs and Dossiers.
Access control:: least privilege, multi-factor authentication for all staff, access reviewed every quarter, production access logged.
Separation:: each customer's data is logically separated; each Job runs in its own isolated environment.
Scope lock:: testing traffic can only reach Targets that passed the ownership check.
Monitoring:: security and access logs kept for 12 months and reviewed for unusual activity.
Secure development:: code review, dependency scanning, and a security test of our own platform at least once a year.
Patching:: critical security patches applied within 14 days.
Backups:: encrypted and kept for 30 days.
Incident response:: a written plan, tested at least once a year.
People:: confidentiality agreements and security training for all staff when they join and every year.
Suppliers:: written data protection terms with every subprocessor; AI providers barred from training on customer data; our AI provider's servers are shared between its customers, with each customer's data kept separate.

Annex 3: Subprocessors

The subprocessors listed at ghostprobe.io/subprocessors on the date you accept the Terms, as updated under section 5.