Data Processing Agreement.

DATA PROCESSING AGREEMENT (DPA)

pursuant to Article 28 GDPR

Version: TBC | Processor or Subprocessor: Robo Shadow Ltd

Parties

Scope and Applicability

This DPA forms part of the Customer’s agreement with Robo Shadow Ltd (RoboShadow) and governs its processing of Personal Data as Processor or Subprocessor for the Customer or relevant Controller in providing the Platform and related support services.

• “Customer” means the person, business or organisation identified during account registration and on whose behalf the Terms of Use are accepted, or which otherwise enters into an agreement with RoboShadow for the Services. This includes direct customers, managed service providers, resellers, distributors, consultants, systems integrators and other service providers.
• “Controller” means the organisation determining the purposes and means of processing. RoboShadow acts as Processor where the Customer is Controller, and Subprocessor where the Customer processes data for another Controller. Actual processing activities determine these roles. References to RoboShadow as Processor and to subprocessors include its Subprocessor role and further subprocessors, where applicable.

This DPA covers free and paid services, including any period of Customer Personal Data retention. It takes effect when incorporated into the Customer’s accepted agreement, including the Terms of Use, or signed separately. It is available online and on request; no separate signature is needed where incorporated.

For processing of Customer Personal Data, this DPA prevails over conflicting Privacy Policy or agreement terms, subject to the Liability section below.

The Privacy Policy covers RoboShadow’s independent Controller processing, including customer relationship management, business administration, billing and marketing. This processing falls outside this DPA and does not authorise independent reuse of Customer Personal Data processed for a Controller.

Personal Data and security-related data processed may include:

• user names and email addresses;
• security monitoring data;
• vulnerability scan results;
• system, endpoint, asset, and infrastructure data;
• log and event data, including authentication, access, administrative, and security event records;
• customer contact, support, billing, and subscription metadata where required to provide the services.

Data Subjects may include:

• customer employees;
• administrators and authorised users;
• customer representatives and business contacts;
• contractors, consultants, or external users;
• other individuals whose Personal Data is submitted to or processed through the Platform by or on behalf of the Customer.

RoboShadow does not intentionally collect or process special category data or Personal Data beyond what is necessary to provide, secure, support, administer and bill for the services. Customer submissions or authorised remote access may involve other Personal Data, including special category data; the Customer must ensure that processing is authorised and lawful.

Integrations and the remote access app do not give RoboShadow personnel access to browse connected systems, read their files or messages, or view remote session content. RoboShadow processes technical, security and operational data from authorised integrations, and connection and activity logs needed for the services. Separately submitted information, such as support requests, remains subject to this DPA where processed on the Customer’s behalf.

Nature, Purpose and Risk Classification

Processing includes hosting, storage, analysis, security, transmission, asset discovery, vulnerability scanning, monitoring, security analytics, support, facilitating authorised remote access, AI-assisted analysis and customer service operations, account and billing administration, and related service operations.

Processing supports the RoboShadow services, including:

• detection and prioritisation of vulnerabilities;
• protection and monitoring of IT systems;
• prevention, investigation, and remediation of Cyber Security threats;
• generation of security, compliance, and operational reports;
• customer account, support, and billing administration.

Risk classification: elevated confidentiality risk from potential exposure of sensitive customer security, system configuration and critical infrastructure information. RoboShadow applies proportionate enhanced controls.

The Customer instructs RoboShadow to use Customer Personal Data, where reasonably necessary, to improve and refine the Platform and Services within the RoboShadow-controlled AWS environment. For this purpose, data is shared only with AWS as hosting and infrastructure provider and is not used to train AI models. A

Customer acting as Processor confirms the Controller authorises this instruction. Broader product development uses aggregated or anonymised insights that no longer identify individuals or Customers. Troubleshooting and support may use approved AI services and other subprocessors under this DPA.

AI Features and Use of AI

RoboShadow may use approved AI services for Platform analysis, support investigations and customer communications, using only reasonably necessary account information, support communications, Customer Personal Data, logs and Platform outputs.

• Service safeguards: Customer Personal Data may be sent only through approved business AI services or APIs. We use zero data retention unless the AI provider does not permit it. In that case, we use the shortest retention available and delete or request deletion as soon as the provider’s terms and technical, legal or security requirements allow. These safeguards apply to every AI provider listed in Annex 1.
• Customer instructions: By accepting this DPA, the Customer instructs RoboShadow to carry out this AI processing on its behalf, subject to this DPA’s purposes, safeguards and subprocessor authorisation process. A Customer acting as Processor must have the Controller’s authorisation.
• No model training: Neither RoboShadow nor its providers may train AI models on Customer Personal Data in AI inputs or outputs. RoboShadow shall use business terms and settings enforcing this, and shall not opt in to training or feedback-sharing programmes involving that data.
• AI outputs: Outputs are advisory and should be reviewed and validated before use.

Instructions

RoboShadow shall process Personal Data, including international transfers, only on the Customer’s documented instructions, including its Platform use, the applicable agreement, Terms of Use and this DPA. It will notify the Customer if it considers an instruction infringes Applicable Data Protection Law. This means all data protection and privacy laws applicable to processing under this DPA, including the EU GDPR (Regulation 2016/679), UK GDPR, UK Data Protection Act 2018 and applicable national laws, including the German Federal Data Protection Act (BDSG).

Customer Responsibilities

A Customer acting as Controller confirms its lawful basis and required notices to Data Subjects, and remains responsible for the purposes and means of processing. A Customer acting as Processor confirms the Controller authorises its appointment of RoboShadow, instructions and subprocessors, consistently with its obligations to that Controller. The Customer must ensure its Platform use and submitted data comply with Applicable Data Protection Law.

Obligations of the Processor

RoboShadow shall:

• process Personal Data only for agreed purposes and in accordance with documented instructions;
• ensure that personnel authorised to process Personal Data are subject to confidentiality obligations;
• enforce least privilege access and role-based access control;
• provide personnel with appropriate security and data protection training;
• maintain formal security policies and procedures aligned to SOC 2 and Cyber Essentials Plus controls;
• implement appropriate technical and organisational measures to protect Personal Data against unauthorised or unlawful processing, accidental loss, destruction, or damage;
• not knowingly engage in processing that would violate Applicable Data Protection Law.
  

RoboShadow maintains SOC 2 Type II and Cyber Essentials Plus assurance. Relevant audit reports, certifications, security summaries, and appropriate policy extracts may be provided on request, subject to confidentiality, applicable restrictions, security considerations, and reasonable scoping.

Data Transfers

Primary processing occurs in AWS EU regions, currently Ireland, unless otherwise agreed. Global subprocessor infrastructure or support may involve transfers outside the UK or EEA. RoboShadow requires appropriate safeguards under Applicable Data Protection Law, including certification under the EU-US Data Privacy Framework and its UK Extension (the UK-US data bridge), standard contractual clauses, the UK international data transfer addendum or agreement, or equivalent safeguards, and applicable vendor commitments.

Subprocessors that may involve transfers outside the UK or EEA are identified in Annex 1.

Subprocessors and Further Subprocessors

The Customer authorises RoboShadow to engage subprocessors for service delivery. RoboShadow shall impose this DPA’s applicable data protection obligations through written terms providing equivalent protection, maintain an up-to-date subprocessor list and remain responsible for subprocessors’ acts and omissions as required by Applicable Data Protection Law. RoboShadow will give prior written notice of new or replacement subprocessors, targeting 30 days and allowing sufficient time to object before they process Customer Personal Data. The Customer may object on reasonable data protection grounds. If an objection cannot reasonably be resolved, the Customer may terminate the affected services insofar as they depend on that subprocessor.

Audit and Compliance

On request, RoboShadow will provide relevant audit reports, certifications, policies, security summaries and evidence without undue delay where appropriate.

RoboShadow shall provide all information needed to demonstrate Article 28 compliance and allow and contribute to Customer or appointed-auditor audits and inspections. Where the Customer is Processor, this includes assistance for the Controller’s audit rights, coordinated through the Customer. The safeguards below do not prevent audits or inspections required by Applicable Data Protection Law.

Audits will normally be supported remotely through documentation, reports, certifications, virtual meetings, control walkthroughs and evidence review.

Direct access to production systems, customer environments or AWS data centres is not permitted. AWS controls are evidenced through available AWS assurance reports and relevant subprocessor documentation.

Onsite audits are usually not needed, but if required must be justified, proportionate and limited to relevant RoboShadow-controlled locations, personnel, processes and records. They are permitted where legally required, requested by a supervisory authority, needed for a security incident investigation or justified by serious, substantiated security or compliance concerns. Appropriate confidentiality, security, scheduling and operational controls apply; audits must not compromise RoboShadow systems, operations or other customer data.

Incident Notification

RoboShadow will notify the Customer without undue delay after becoming aware of a Personal Data breach affecting Customer Personal Data, with a target of under 48 hours. Notification will include, where available:

• the nature of the incident;
• affected data or systems;
• known or likely impact;
• containment and remediation actions;
• further information required by the Customer to meet its legal obligations.

Data Subject Rights, DPIAs and Regulatory Cooperation

Taking account of the nature of processing and information available, RoboShadow will assist the Customer and, through it, the relevant Controller with Applicable Data Protection Law obligations, including through appropriate technical and organisational measures. This includes reasonable support for:

• Data Subject rights requests, including access, correction, deletion, restriction, objection, and portability where applicable;
• data protection impact assessments (DPIAs) relating to the Customer’s use of the RoboShadow services;
• legally required prior consultation or cooperation with supervisory authorities concerning processing on the Customer’s behalf;
• security of processing and notifications of Personal Data breaches to supervisory authorities and Data Subjects, where required.

RoboShadow will promptly forward Data Subject requests concerning Customer Personal Data to the Customer, unless legally prohibited.

Data Retention and Deletion

Personal Data is retained only as necessary for the services, legal or contractual obligations, security, audit and operational requirements, or as otherwise instructed by the Customer.

• Return or deletion: On termination, RoboShadow will delete or return Customer Personal Data at the Customer’s choice, reflecting the Controller’s choice where the Customer is Processor, and delete copies unless legally required to retain them.
• Production data: Customer data is deleted from Platform production systems within 30 days of account deletion, service termination or an approved deletion request, unless retention is legally required.
• Backup retention: Customer Personal Data may remain in existing encrypted database backups after production deletion. Backups remain in standard storage for 30 days, then move to long-term archive storage, with total retention of up to seven years from creation before deletion under the documented backup lifecycle.
• Backup access: Backups are segregated from production, access-restricted and used only for disaster recovery, business continuity, security or approved incident response, not routine service delivery.
• Deleted data in backups: Customer Personal Data deleted from production but remaining in backups is put beyond use. After the 30-day standard storage period, it is held only in encrypted, deep (glacier-class) archive storage and kept apart from live systems. It is not accessed, processed or restored except for disaster recovery, and it is deleted when the backup cycle expires.
• Logs: Security and operational logs, including access, authentication, administrative, cloud, endpoint and security event logs, are retained for up to 12 months unless longer retention is required for legal, contractual, security or audit purposes. Customer Personal Data in logs remains subject to documented instructions and the termination, return and deletion obligations above, unless retention is legally required.

Confidentiality

RoboShadow protects Customer Personal Data against unauthorised access, disclosure, alteration or loss. Personnel with access must comply with confidentiality, acceptable use, access control and data handling obligations.

Liability

The applicable agreement’s liability provisions govern this DPA unless Applicable Data Protection Law requires otherwise. RoboShadow remains responsible for its own DPA breaches and its subprocessors to the extent required by that law.

Neither party’s liability is excluded or limited where Applicable Data Protection Law prohibits this, including under Article 82 GDPR where applicable.

Termination

The Customer may terminate the relevant services or this DPA under the applicable agreement if RoboShadow materially breaches its data protection obligations and fails to remedy this within a reasonable period, or if Applicable Data Protection Law requires termination.

Annex 1 - Subprocessors and Further Subprocessors

RoboShadow uses or may use the following subprocessors. Before processing Customer Personal Data, each must undergo security review and be subject to contractual obligations appropriate to its service.

Providers are subprocessors only when processing Customer Personal Data on RoboShadow’s behalf under this DPA; the designation excludes their independent Controller activities.

Annex 2 - Summary of Technical and Organisational Measures

Signatures

Complete this section only where the parties choose to sign a copy of this DPA.