Data Processing Addendum

01When this applies

This Addendum forms part of the Terms of Service between you (the "Controller") and Kiara TechX LLP (the "Processor") and applies wherever we process personal data on your behalf in connection with PixyScan.

Where it conflicts with the Terms of Service on the subject of data protection, this Addendum takes precedence. Terms used here have the meanings given in the GDPR.

02What we process, and why

Subject matter: providing the PixyScan crawling, auditing and monitoring service. Duration: for as long as your account is open, plus the retention window on your plan.

• Categories of data subject - your personnel who hold accounts, and any individuals whose personal data appears in the publicly served HTML of the sites you ask us to crawl.
• Categories of personal data - names, email addresses, hashed passwords, IP addresses, and whatever personal data your own pages contain.
• Special category data - not requested, not required, and not knowingly processed. Do not scan a site whose public HTML contains it without satisfying yourself that doing so is lawful.

03Our obligations

We will:

• Process personal data only on your documented instructions, including on international transfers, unless required otherwise by law - in which case we will tell you first unless the law forbids it.
• Ensure everyone authorised to process the data is bound by confidentiality.
• Implement appropriate technical and organisational security measures, as set out in the Privacy Policy.
• Assist you, so far as reasonably possible, with data subject requests, impact assessments and consultations with supervisory authorities.
• Delete or return personal data at the end of the service, unless the law requires us to keep it.
• Make available the information reasonably needed to demonstrate compliance, and allow audits on reasonable notice and at reasonable frequency.

04Subprocessors

You give general authorisation for us to appoint subprocessors. The current list is published on the subprocessors page, and we will post changes there before a new subprocessor begins processing. Each is bound by data protection terms no less protective than these.

You may object to a new subprocessor on reasonable data protection grounds; if we cannot resolve the objection, you may terminate the affected part of the service.

05Personal data breaches

We will notify you without undue delay, and in any event within 72 hours of becoming aware of a personal data breach affecting your data, with the information reasonably available at the time and updates as we learn more.

06International transfers

Customer data is hosted in the European Union (Frankfurt, Germany). Where personal data is transferred outside the EEA or the UK - including to our team in India - that transfer is made under the European Commission's Standard Contractual Clauses, together with the UK Addendum where the UK GDPR applies.

07Requesting a signed copy

If your organisation needs a countersigned DPA, email [email protected] with your entity details and we will send one.