Data processing agreement

1. Parties and purpose

This agreement is entered into between the Customer, as controller, and [PENDING: owner's name] (tax ID [PENDING: NIF], [PENDING: address]), trading as NextAura, as processor. It is incorporated into the Terms of service and governs the processing of personal data that the processor carries out on behalf of the controller when providing the Service, in accordance with article 28 of Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD). It prevails over the Terms of service on data protection matters.

2. Description of the processing (Annex I)

• Nature and purpose: monitoring and protection of the controller's devices and network: inventory, metrics and real-time status, detection of vulnerabilities and misconfigurations (with Wazuh), alerts and notices, remediations, scripts, web content blocking, firewall, discovery of devices on the network, remote access, reports, integrations configured by the controller, artificial intelligence analyses on minimised data and, if the controller turns it on, activity history.
• Duration: that of the service contract, plus the return and deletion period of this agreement.
• Data of devices and their users: device identifier and name, manufacturer and model, disk serial numbers, operating system, operating system accounts (account name, full name, type, whether it is an administrator and last sign-in), private and public IP addresses (the latter, that of the device's connection to the platform), MAC addresses, network interfaces, installed software and processes, resource usage metrics, protection status, open ports, system and security events, vulnerabilities and configuration results, and the output of executed scripts.
• Network data: for devices the agent discovers on the local network, their private address, MAC address, manufacturer, likely type, services and ports, and the name they announce, including mobile phones (which often contains the owner's name); never traffic or its content.
• Remote access: who opens each session, on which device, when, for what reason, its duration, the permissions used and the name and size of transferred files (never their content or that of the clipboard). The screen image is transmitted end-to-end encrypted between the device and the viewer and the platform does not store it; if the controller's policy allows it, the technician can record it in their browser, which is shown to the person using the device.
• Activity history, if turned on: foreground applications and their usage time, per operating system account, and domains resolved by the device's DNS filter; never full addresses, titles, content, keystrokes or screenshots.
• Data of the controller's dashboard users: name, email, role and activity in the dashboard.
• Categories of data subjects: staff, collaborators, students and other users of the controller's devices; dashboard users; owners of devices on the network.
• Special categories of data: the Service is not designed to process them and the controller must not deliberately enter them. Activity history excludes by default banking, health, trade union, religious, political party and password manager domains and applications, and the controller can add exclusions for the whole organisation or per device.

3. Controller's instructions

The processor will process the data only on the documented instructions of the controller, which are this agreement, the Terms of service and the configuration the controller makes in the dashboard and the API, including integrations with third-party services the controller turns on, which receive the data on its instructions and under its responsibility. If the processor considers that an instruction infringes data protection law, it will inform the controller immediately.

The controller also instructs the processor to obtain aggregated and anonymous statistics on the operation of the Service, which do not allow the controller or any person to be identified, in order to maintain and improve it. Customer Data is not used to train artificial intelligence models.

4. Controller's obligations

The controller warrants that it has a legal basis for the processing, that it has informed data subjects before processing their data and that it complies with articles 87 to 91 of the LOPDGDD and employment law. Where the processing requires it, in particular for activity history, it will carry out the impact assessment under article 35 GDPR, for which the processor will provide on request its own assessment of the feature's design.

5. Confidentiality and staff access

The processor ensures that the persons authorised to process the data have committed themselves to confidentiality or are under a statutory obligation of confidentiality, and that they only access the data when necessary to provide the Service.

The processor's authorised staff see basic technical data about devices (system, hardware, network and protection status; for software and accounts, only how many there are) to operate the platform. To see an organisation's details they need temporary, read-only access, with a stated reason, audited and with notice to the owner. They may send maintenance commands to a device (restart, update or clean up the disk) only to resolve an incident, with a stated reason and audited. They only connect to a device by remote access if the controller has not turned it off and the person using it accepts at that moment. They never access the activity history.

6. Security measures (Annex II)

The processor applies the technical and organisational measures of Annex II, appropriate to the risk, taking into account the state of the art and the costs (article 32 GDPR), and will review them periodically. It may replace them with others offering an equal or higher level of protection.

7. Sub-processors

The controller gives general authorisation to engage sub-processors, whose current list is in Annex III. The processor will inform the controller of any addition or replacement at least thirty days in advance; the controller may object on reasonable data protection grounds and, if not resolved, may terminate the service contract without penalty.

The processor will impose on each sub-processor, by contract, the same data protection obligations as in this agreement and will remain liable to the controller for their performance.

8. International transfers

The processor will not transfer data outside the European Economic Area except with appropriate safeguards under articles 44 to 49 GDPR. The controller authorises the transfer to the artificial intelligence provider in Annex III, in the United States, of only the minimised data described there, based on the EU-US Data Privacy Framework where the entity is certified and, in any case, on the European Commission's standard contractual clauses (Implementing Decision (EU) 2021/914), with encryption in transit and prior minimisation as supplementary measures.

9. Assistance to the controller

The processor will assist the controller, through appropriate technical and organisational measures, in responding to data subjects' requests (with the exports and deletion available in the dashboard and the API) and in complying with the obligations of articles 32 to 36 GDPR (security, breach notification, impact assessments and prior consultation). If it receives a request directly from a data subject, it will forward it without delay and will not respond unless instructed by the controller.

10. Security breaches

The processor will notify the controller without undue delay, and at the latest within forty-eight hours of becoming aware of it, of any personal data breach, with the information available: nature, categories and approximate number of data subjects and records concerned, likely consequences and measures taken or proposed, so that the controller can comply with articles 33 and 34 GDPR. It will then provide further information as it becomes available.

11. Retention, return and deletion

During the service, data is kept according to the retention of each feature and plan: metrics, 7 to 90 days; closed or muted alerts and resolved vulnerabilities and misconfigurations, 90 days to two years from closure depending on the plan (those still open are kept while they remain open); detection engine raw events, 90 days; activity history, at most 30 days on Business and 90 on Enterprise, and it is deleted when turned off, when moving to a plan that does not include it and when the device is retired; network devices, 90 days without being seen, except those the controller marks as known; PDF reports, 90 days; resolved support tickets, twelve months; dashboard users' sessions, twelve months after they end; remote session records, twelve months after they end; script and remediation output, 90 days, after which the text is deleted and the result, exit code and dates are kept. The inventory is replaced with each submission. The audit log and the other data of retired devices are kept while the organisation exists, unless the controller deletes them earlier.

When the service ends, the controller may export its data for thirty days (the owner, with the complete export in Settings). After that period, the processor will delete it, together with the accounts left without an organisation, files on disk and the detection engine agents, including backups in their ordinary rotation cycle, unless Union or Spanish law requires its retention, in which case it will keep it blocked and process it only for that purpose; the security audit log is kept blocked for up to three years. On request, it will certify the deletion.

12. Audit

The processor will make available to the controller the information necessary to demonstrate compliance with this agreement and will allow audits, including inspections, by the controller or an auditor appointed by it, with thirty days' notice, once a year except in the event of a security breach or a request from an authority, without compromising the security or confidentiality of other customers and at the controller's expense. This may be fulfilled with reports or certifications from independent third parties.

13. Liability, term and law

The parties' liability is governed by article 82 GDPR and the Terms of service. This agreement lasts as long as the processor processes data on behalf of the controller and is governed by Spanish law, with submission to the courts provided for in the Terms of service.

14. Annex II: technical and organisational measures

• Encryption of communications with TLS; mutual certificate authentication (mTLS) issued by an own certificate authority for communication between devices and the platform; remote access is end-to-end encrypted (WebRTC) between the device and the viewer.
• Authentication: passwords stored with scrypt; second factor (TOTP) with recovery codes, which the controller can require from its members and which is mandatory for all of the processor's staff; optional single sign-on (OIDC); sessions with HttpOnly, encrypted, SameSite cookies that the user can revoke; temporary lockout after failed sign-in attempts.
• Strict separation of three access systems (customers, staff and devices), with different entities, secrets and routes; all of a customer's data is filtered by its organisation; the detection engine (Wazuh) is not exposed to the Internet and is only queried by the API.
• Role-based access control (customers) and permission-based access control (staff); support access by the processor's staff is temporary, read-only, with a stated reason, expiry and notice to the customer; remote access by support requires acceptance by the person using the device and a signed identity seal that the agent verifies.
• Audit of sensitive actions (settings changes, commands and remediations, scripts, remote sessions, support access, activity history queries and exports).
• The agent validates what it receives from the server, saves the previous state of changes so that they can be reverted and only runs library scripts with a valid signature.
• Minimisation: activity history only stores applications and domains, with exclusions; data sent to artificial intelligence models is pseudonymised and minimised, and activity history is never sent; network discovery does not record traffic or content.
• Limited retention and automatic deletion according to plan and feature.
• Integration and configuration secrets stored encrypted and write-only; API keys stored only as a fingerprint; security headers and content security policy in the dashboard.
• Secure development: code review, dependency and licence analysis, signed images and automated tests in continuous integration.
• Daily encrypted backups, stored off the main server in the European Economic Area and with restoration tested periodically, and encryption at rest of the data volumes, with the hosting provider listed in Annex III.

15. Annex III: sub-processors

The processor uses the following sub-processors. The list will be updated before any change, in accordance with the sub-processors section.

• Hosting and infrastructure (virtual private server with the database, backups and detection engine): [PENDING: provider, data centre country (European Economic Area)]. Processes all data as physical support.
• Transactional email (notices, alerts, invoices, summaries): [PENDING: provider and location]. Processes the email addresses of dashboard users and the content of the emails.
• Payment gateway: Stripe Payments Europe Ltd. (Ireland), with group companies in the United States under the EU-US Data Privacy Framework and standard contractual clauses. Only the Customer's billing and payment data; card details are processed by the gateway itself as controller.
• Artificial intelligence models: Anthropic (Claude models, through its commercial API), in the United States, with the safeguards of the international transfers section. Only minimised and pseudonymised technical data, without user names, email addresses, full addresses, public IP addresses or MAC addresses; never activity history. Remediations written by AI only receive the CVE, the operating system and the language. Not used to train models.
• Security detection (Wazuh, open-source software self-hosted by the processor on the same hosting): no additional sub-processor.