Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between Intelsieve, LLC ("Intelsieve", "Processor", "we", "our", or "us") and the entity or individual accepting this DPA ("Customer", "Controller", "you", or "your") for the provision of threat intelligence services (the "Services") as described in our Terms of Service (the "Agreement").

This DPA applies where and to the extent that Intelsieve processes Personal Data on behalf of the Customer in the course of providing the Services.

1. Definitions

• "Applicable Data Protection Law" means all laws and regulations applicable to the processing of Personal Data under the Agreement, including (where applicable) the GDPR, UK GDPR, CCPA/CPRA, and other applicable data protection legislation.
• "Data Subject" means an identified or identifiable natural person whose Personal Data is processed.
• "GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation).
• "Personal Data" means any information relating to an identified or identifiable natural person that is processed by Intelsieve on behalf of the Customer in connection with the Services.
• "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data.
• "Processing" means any operation performed on Personal Data, including collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure, dissemination, restriction, erasure, or destruction.
• "Standard Contractual Clauses" or "SCCs" means the standard contractual clauses for the transfer of personal data to third countries approved by the European Commission Decision (EU) 2021/914.
• "Sub-processor" means a third party engaged by Intelsieve to process Personal Data on behalf of the Customer.

2. Scope and Roles

2.1 Relationship of the Parties

For the purposes of Applicable Data Protection Law, the role of each party depends on the category of data concerned.

Customer-provided data. In respect of account data, authentication data, usage data, billing data, monitoring configuration, and other Personal Data that you provide to us or that we generate on your behalf, including Personal Data relating to your employees and authorized users, and to the extent that we process such data on your documented instructions in the course of providing the Services:

• Customer is the Controller: You determine the purposes and means of processing Personal Data
• Intelsieve is the Processor: We process Personal Data on your behalf and in accordance with your documented instructions

Threat intelligence data. In respect of threat intelligence data that we independently source, including credentials and related data we collect using our own collection infrastructure from sources that circulate openly among threat actors and security researchers:

• Intelsieve is the Controller: We determine the purposes and means of collecting and processing that data, and our processing of it is described in our Privacy Policy
• Customer is a separate and independent Controller: Where we make threat intelligence data available to you through the Services, we do so as a controller-to-controller disclosure, and you determine your own purposes and means for any further processing of that data

Each party is independently responsible for its own compliance with Applicable Data Protection Law in respect of its own processing of threat intelligence data. Neither party processes threat intelligence data as the other party's Processor, and this DPA does not apply to our collection and maintenance of threat intelligence data.

Data processed in more than one role. Where we process data in a category listed in Section 2.3 for our own purposes as Controller — including account administration, billing, security, service improvement, and compliance with our own legal obligations — that processing falls outside this DPA and is governed by our Privacy Policy.

2.2 Categories of Data Subjects

Personal Data processed under this DPA may relate to the following categories of Data Subjects:

• Customer's employees and authorized users of the Services
• Individuals whose data appears in threat intelligence results (e.g., individuals whose credentials appear in breach databases)

2.3 Types of Personal Data

The categories listed above are those we process as Processor under this DPA. Data in the same categories that we process as Controller is addressed in Section 2.1 and in our Privacy Policy.

2.4 Duration of Processing

Processing will continue for the duration of the Agreement plus any retention periods specified in our Privacy Policy or required by law.

3. Obligations of Intelsieve as Processor

3.1 Instructions

We will process Personal Data only in accordance with your documented instructions, including with respect to transfers of Personal Data to a third country, unless required to do so by applicable law. If such a legal requirement applies, we will inform you of that legal requirement before processing, unless the law prohibits such information on important grounds of public interest.

3.2 Confidentiality

We ensure that all persons authorized to process Personal Data are subject to binding confidentiality obligations, whether contractual or statutory.

3.3 Security Measures

We implement and maintain appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption: AES-256 at rest, TLS 1.3 in transit
• Access controls: Role-based access control (RBAC), multi-factor authentication for administrative access
• Data isolation: Multi-tenant row-level data isolation
• Monitoring: Continuous monitoring and logging of access to Personal Data
• Incident response: Documented incident response procedures
• Employee training: Regular data protection training for all staff with access to Personal Data
• Regular testing: Periodic security assessments and penetration testing
• Backup and recovery: Regular backups with tested recovery procedures

3.4 Sub-processors

We will not engage a new Sub-processor without providing you with at least 30 days prior written notice, including the Sub-processor's name, location, and the processing activities to be performed. You may object to a new Sub-processor within 14 days of notification. If you object on reasonable data protection grounds and we cannot accommodate your objection, either party may terminate the affected Services.

Emergency replacements. In circumstances requiring an immediate Sub-processor replacement to maintain service availability or address a critical security vulnerability, we may make such replacement without advance notice, provided that: (i) we notify you as soon as reasonably practicable (and in any event within 5 business days); (ii) the replacement Sub-processor provides equivalent or greater data protection; and (iii) we update Annex III within 30 days. Emergency replacements do not trigger your termination right under this section, but your right to object and terminate remains available prospectively.

Current Sub-processors are listed in Annex III of this DPA.

We impose data protection obligations on each Sub-processor that are no less protective than those in this DPA. We remain fully liable for the acts and omissions of our Sub-processors.

3.5 Data Subject Rights

We will promptly assist you in responding to requests from Data Subjects to exercise their rights under Applicable Data Protection Law (access, rectification, erasure, restriction, portability, objection). We will notify you promptly if we receive a request directly from a Data Subject, and will not respond to the request without your authorization unless required by law.

3.6 Data Protection Impact Assessments

We will provide reasonable assistance to you in conducting Data Protection Impact Assessments (DPIAs) and prior consultations with supervisory authorities, where required by Applicable Data Protection Law.

3.7 Deletion and Return of Data

Upon termination of the Agreement, at your choice, we will:

(a) Return all Personal Data to you in a commonly used, machine-readable format (JSON); or

(b) Delete all Personal Data within 30 days, except where retention is required by applicable law.

We will certify deletion upon your request.

4. Personal Data Breach Notification

4.1 Notification Timeline

We will notify you of a Personal Data Breach without undue delay, and in any event within 48 hours of becoming aware of the breach.

4.2 Content of Notification

The notification will include, to the extent available:

• A description of the nature of the breach, including (where possible) the categories and approximate number of Data Subjects concerned
• The name and contact details of our data protection contact
• A description of the likely consequences of the breach
• A description of the measures taken or proposed to address the breach, including measures to mitigate its possible adverse effects

4.3 Cooperation

We will cooperate with you and provide reasonable assistance in investigating and remediating the breach, including in your communications with supervisory authorities and affected Data Subjects.

5. International Data Transfers

5.1 Data Residency

Customer Data and the Personal Data processed by the Intelsieve platform are hosted on dedicated servers located in the European Economic Area (Germany and Finland). We do not offer a United States data residency option, and data residency is not selectable at account setup. Certain sub-processors listed in Annex III — including our payment, authentication, and content delivery providers — process limited Personal Data outside the EEA; those transfers are governed by Section 5.2.

5.2 Transfer Mechanisms

For transfers of Personal Data from the EEA, UK, or Switzerland to countries that do not benefit from an adequacy decision:

• We rely on the Standard Contractual Clauses (SCCs) approved by European Commission Decision (EU) 2021/914. The applicable Module depends on the role each party holds for the data concerned, as set out in Section 2.1:
  • For Customer-provided data, where Customer is the Controller and Intelsieve is the Processor, we rely on Module Two (Controller to Processor)
  • For threat intelligence data, where Intelsieve is the Controller and Customer receives that data as a separate and independent Controller, we rely on Module One (Controller to Controller)
• For UK transfers, we apply the UK International Data Transfer Addendum to the SCCs
• For Swiss transfers, we rely on the SCCs as recognized by the Swiss Federal Data Protection and Information Commissioner

5.3 Transfer Impact Assessments

We conduct Transfer Impact Assessments for international data transfers and implement supplementary measures as necessary to ensure adequate protection of Personal Data.

6. Audit Rights

6.1 Information and Audit

We will make available to you all information necessary to demonstrate compliance with this DPA. You (or your mandated auditor) may conduct audits and inspections, including inspections of our facilities and systems, to verify compliance with this DPA, subject to the following conditions:

• Audits must be conducted during normal business hours with at least 30 days' advance written notice
• Audits must not unreasonably interfere with our business operations
• You will bear the costs of any audit
• Audit findings are treated as confidential information

6.2 Third-Party Certifications

We will provide copies of relevant compliance certifications and audit reports (such as may be available) upon request, subject to confidentiality obligations. Where available, these certifications may satisfy your audit rights.

7. Liability

Each party's liability under this DPA is subject to the limitations and exclusions of liability set out in the Agreement (Terms of Service). Nothing in this DPA limits either party's liability for breaches of confidentiality obligations, for Personal Data Breaches caused by that party's gross negligence or willful misconduct, or to the extent such limitation is not permitted by Applicable Data Protection Law.

8. Term and Termination

This DPA commences on the date the Customer accepts it (or the date the Agreement takes effect, whichever is earlier) and remains in effect for the duration of the Agreement. Obligations related to the security and confidentiality of Personal Data survive termination.

9. Governing Law

This DPA shall be governed by and construed in accordance with the laws that govern the Agreement (State of Wyoming), except to the extent that Applicable Data Protection Law requires the application of the law of another jurisdiction.

10. Conflict

In the event of any conflict between this DPA and the Agreement, this DPA shall prevail with respect to the processing of Personal Data.

Annex I: Details of Processing

This Annex describes processing carried out by Intelsieve as Processor on the Customer's documented instructions. Processing that Intelsieve carries out as Controller, as described in Section 2.1, is outside the scope of this Annex and is described in our Privacy Policy.

Annex II: Technical and Organizational Measures

Annex III: List of Sub-processors

Our hosting provider is identified above by category rather than by name. The identity of that provider is available to any Customer on request from dpo@intelsieve.com, and we will identify it to a Customer before that Customer is required to authorise it as a sub-processor.

Analytics, query processing, caching, and session management are performed on infrastructure operated by Intelsieve on the hosting described above, and are not delegated to any third-party sub-processor.

This list is current as of the effective date. Changes will be communicated with at least 30 days' prior notice.

Contact

For DPA-related inquiries:

• Data protection: dpo@intelsieve.com
• Legal: legal@intelsieve.com
• Privacy: privacy@intelsieve.com