Data Processing Agreement
PLEASE READ THIS AGREEMENT CAREFULLY
Last Modified: 5 October 2026
This Data Processing Agreement (the "DPA") forms part of the agreement between the Customer and the Keepnet contracting entity (the "Agreement") and governs the Processing of Personal Data that Keepnet carries out on the Customer's behalf when providing the Services. It applies to Processing subject to UK GDPR, EU GDPR, the Swiss Federal Act on Data Protection (FADP) and applicable US state privacy laws. Capitalised terms not defined here have the meaning given in the Agreement. If there is a conflict, this DPA prevails over the Agreement on data protection, and the Standard Contractual Clauses prevail over this DPA on restricted transfers.
1. Definitions
1.1 "Applicable Data Protection Laws" means all data protection and privacy laws that apply to the Processing, including UK GDPR and the Data Protection Act 2018, EU GDPR (Regulation 2016/679), the Swiss FADP, and US state privacy laws such as the CCPA.
1.2 "Controller", "Processor", "Data Subject", "Personal Data", "Processing", "Special Category Data" and "Personal Data Breach" have the meanings given in Applicable Data Protection Laws.
1.3 "Customer Data" means Personal Data that Keepnet Processes on the Customer's behalf under the Agreement.
1.4 "Permitted Affiliate" means an entity that controls, is controlled by, or is under common control with the Customer, that is permitted to use the Services under the Agreement and on whose behalf the Customer enters into this DPA.
1.5 "Sub-Processor" means any third party, or Keepnet affiliate, engaged by Keepnet to Process Customer Data.
1.6 "Standard Contractual Clauses" or "SCCs" means the clauses approved by EU Commission Decision (EU) 2021/914. "UK Addendum" means the International Data Transfer Addendum to the EU SCCs issued by the UK ICO, currently found at https://ico.org.uk/media2/migrated/4019539/international-data-transfer-addendum.pdf. "DPF" means the EU-US Data Privacy Framework; the "UK-US Data Bridge" is its UK Extension, and the "Swiss-US DPF" its Swiss counterpart.
1.7 "Restricted Transfer" means a transfer of Personal Data to a country not covered by an adequacy decision (or equivalent) under the relevant Applicable Data Protection Law. "Supervisory Authority" means the competent regulator, including the UK ICO, an EEA supervisory authority and the Swiss FDPIC.
2. Roles and scope of Processing
2.1 For Customer Data, the Customer is the Controller (or a processor acting for a third-party controller) and Keepnet is the Processor (or sub-processor). Each party complies with its obligations under Applicable Data Protection Laws.
2.2 Keepnet Processes Customer Data only on the Customer's documented instructions, including the Agreement, this DPA, the configuration of the Services and Annex 1, unless required otherwise by law, in which case Keepnet informs the Customer first unless the law prohibits it.
2.3 Under US state privacy laws, Keepnet acts as a Service Provider (or equivalent) and clause 15 applies.
2.4 Keepnet acts as an independent Controller for the limited Personal Data it Processes for its own business operations, such as account administration and billing; that Processing is governed by Keepnet's own privacy notice and not by this DPA, and the providers Keepnet uses for it are not Sub-Processors of Customer Data under Annex 3.
3. Customer obligations
3.1 The Customer warrants that it has a lawful basis and has given all required notices and obtained all required consents for the Processing, and that its instructions comply with Applicable Data Protection Laws.
3.2 The Customer is responsible for the accuracy, quality and legality of Customer Data and for the secure use of the Services, including managing its users and access.
4. Keepnet's obligations
Keepnet will:
Process Customer Data only on the Customer's documented instructions;
ensure that personnel authorised to Process Customer Data are bound by confidentiality;
implement and maintain the technical and organisational measures set out in Annex 2, in line with clause 6;
engage Sub-Processors only in line with clause 7;
assist the Customer with Data Subject requests (clause 8) and with security, breach notification, DPIAs and prior consultation (clauses 9 and 10);
not use Customer Data to train AI or machine-learning models (clause 12);
delete or return Customer Data on termination (clause 13); and
make available the information needed to demonstrate compliance and allow audits (clause 14).
5. Confidentiality
5.1 Keepnet keeps Customer Data confidential and limits access to personnel who need it to provide the Services, each under a duty of confidentiality.
6. Security
6.1 Keepnet implements appropriate technical and organisational measures to protect Customer Data against a Personal Data Breach, taking account of the state of the art, the costs, and the nature and risk of the Processing. The current measures are set out in Annex 2 and are aligned with Keepnet's ISO/IEC 27001 certified information security management system.
6.2 Keepnet tests, assesses and evaluates the effectiveness of these measures on a regular basis, including penetration testing and its vulnerability disclosure and bug bounty program.
7. Sub-Processors
7.1 The Customer gives a general authorisation for Keepnet to engage Sub-Processors to provide the Services. The current Sub-Processors are listed in Annex 3.
7.2 Keepnet will give the Customer at least 30 days' notice before authorising a new or replacement Sub-Processor (by updating Annex 3 on this page and by email to the Customer's account contact). During that period the Customer may object on reasonable grounds relating to data protection.
7.3 If the parties cannot resolve an objection, the Customer may suspend or terminate the affected part of the Services without penalty, as its sole remedy, keeping any fees already due.
7.4 Keepnet imposes data-protection obligations on each Sub-Processor that are no less protective than those in this DPA and remains responsible for each Sub-Processor's performance.
8. Data Subject rights
8.1 The Services provide controls that let the Customer access, correct, delete, restrict and export Customer Data. Where the Customer cannot do so through the Services, Keepnet provides reasonable assistance, at the Customer's cost, to respond to Data Subject requests.
8.2 If a request is made directly to Keepnet, Keepnet promptly informs the Customer and directs the Data Subject to the Customer; Keepnet does not respond on the substance except on the Customer's instruction or where required by law.
9. Personal Data Breach
9.1 Keepnet notifies the Customer without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting Customer Data, with the information available at the time and further detail as it becomes known.
9.2 Keepnet provides reasonable assistance to enable the Customer to meet its notification duties to Supervisory Authorities and Data Subjects. Keepnet records all Personal Data Breaches.
10. Data protection impact assessments
10.1 Taking account of the nature of the Processing and the information available to it, Keepnet provides reasonable assistance to the Customer with data protection impact assessments and any prior consultation with a Supervisory Authority.
11. International data transfers
11.1 Keepnet does not make a Restricted Transfer of Customer Data except under an appropriate safeguard as set out in this clause and in Annex 4. Annex 3 lists the recipients, their locations and the transfer mechanism relied on for each.
11.2 EU/EEA. Where the EU GDPR applies, the EU SCCs are incorporated (Module Two where the Customer is a controller, Module Three where the Customer is a processor), completed as set out in Annex 4; or Keepnet relies on an adequacy decision, including the EU-US DPF where the US importer is certified.
11.3 United Kingdom. Where the UK GDPR applies, Keepnet relies on the UK-US Data Bridge where the US importer is certified under it, as the transfer mechanism; otherwise the UK Addendum to the EU SCCs applies as set out in Annex 4. The EU and the UK are mutually covered by their respective adequacy decisions.
11.4 Switzerland. Where the Swiss FADP applies, the EU SCCs apply with the Swiss amendments (the FDPIC as supervisory authority, references to the GDPR read as the FADP, and protection extended to Swiss residents), or Keepnet relies on the Swiss-US DPF where the US importer is certified.
11.5 United States. For transfers to the United States, Keepnet relies on the EU-US DPF (for EU data), the UK-US Data Bridge (for UK data) and the Swiss-US DPF (for Swiss data) where the US importer is certified under the relevant framework; otherwise the EU SCCs and the UK Addendum apply.
11.6 Transfer risk assessments. Keepnet carries out and documents a transfer risk assessment for Restricted Transfers made under the SCCs or the UK Addendum, and applies supplementary measures such as encryption where appropriate.
12. Artificial intelligence and model training
12.1 Keepnet will not use Customer Data, including Personal Data, to train, fine-tune or improve any artificial intelligence or machine-learning model, whether its own or a third party's.
12.2 Where Keepnet uses AI Sub-Processors to provide the Services (listed in Annex 3 and in Keepnet's AI Transparency notice), those Sub-Processors are contractually prohibited from using Customer Data to train their models. Customer Data is retained by AI Sub-Processors only as needed to provide the feature, as described in the AI Transparency notice. Where AI drafts a support reply, Keepnet personnel review it before it is sent. Intercom Fin may answer support questions automatically, and the Customer can ask for a Keepnet team member at any time.
13. Deletion and return of Customer Data
13.1 On termination or expiry of the Services, Keepnet deletes or returns Customer Data (at the Customer's choice) within 90 days, unless a shorter period is agreed or a longer period is required by law. The Customer may request deletion or return by emailing privacy@keepnetlabs.com.
13.2 Back-up copies are isolated from further Processing and deleted within Keepnet's normal back-up cycle. Where law requires Keepnet to retain Customer Data, it securely isolates and protects it and deletes it when the requirement ends. Retention of Customer Data is governed by the Agreement, this clause and Keepnet's Data Retention and Disposal Procedure.
14. Audits and demonstration of compliance
14.1 Keepnet makes available the information reasonably necessary to demonstrate compliance with this DPA, including its ISO/IEC 27001 certificate and report and penetration-testing summaries, and contributes to audits.
14.2 The Customer may audit, or appoint an independent auditor to audit, no more than once per calendar year (and more often where it reasonably suspects non-compliance or following a Personal Data Breach), on reasonable notice, during business hours, without unreasonably disrupting Keepnet's operations and subject to confidentiality.
15. US state privacy laws
15.1 When Processing Personal Data subject to the CCPA or other US state privacy laws, Keepnet acts as a Service Provider (or equivalent) and will not: sell or share the Personal Data; retain, use or disclose it other than to provide the Services or as permitted by law; retain, use or disclose it outside the direct business relationship between the parties; or combine it with personal information from other sources, except as permitted by law. Keepnet will notify the Customer if it determines it can no longer meet these obligations, and the Customer may, on notice, take reasonable steps to stop and remediate any unauthorised use.
16. Liability
16.1 Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Agreement. Nothing in this DPA limits any liability that cannot be limited under Applicable Data Protection Laws, including a Data Subject's rights.
17. General and governing law
17.1 The Keepnet entity that contracts with the Customer, and the governing law of the Agreement, are set out in the Jurisdiction Specific Terms or the Order Form.
17.2 This DPA takes effect when it is incorporated into the Agreement and continues for as long as Keepnet Processes Customer Data. Keepnet may update it to reflect changes in law or the Services, with notice, provided the changes do not materially reduce the protection of Customer Data.
17.3 For transfers, the governing law and forum of the SCCs are as stated in Annex 4.
Annex 1 - Details of the Processing
Data exporter
The Customer, and its Permitted Affiliates, acting as Controller or as processor for a third-party controller. Contact details and signature: as set out in the Agreement / Order Form.
Data importer
Keepnet Labs Ltd, 124 City Road, London, England, EC1V 2NX, United Kingdom (company number 11047987); or Keepnet, Inc., 8 The Green, Suite B, Dover, Kent County, DE 19901, USA. Acting as Processor or sub-processor.
Competent supervisory authority (SCC Clause 13)
The supervisory authority of the EEA member state of the data exporter or its EU representative; for UK transfers, the UK ICO; for Switzerland, the FDPIC.
Subject matter
Provision of the Keepnet human-risk and security-awareness Services, including phishing, vishing, smishing and quishing simulation, awareness training, threat intelligence and incident response.
Duration
For the term of the Agreement and until deletion or return of Customer Data under clause 13.
Nature and purpose
Processing to provide, operate, secure and support the Services on the Customer's instructions.
Categories of Data Subjects
The Customer's staff, contractors and other users enrolled in the Services; and third parties whose Personal Data may appear in emails reported by users.
Categories of Personal Data
Identity (name); contact (email address; telephone number, required for vishing and smishing); job title and department; online identifiers (IP address, session and usage logs); simulation interaction data (opens, clicks, submissions, reporting); training participation and results; voice recordings and transcripts of simulated calls; voice samples used for voice generation; and the content of user-reported emails (which may contain third-party Personal Data).
Special Category Data
Not intended. The Customer must not submit Special Category Data except where the Services expressly provide for it. Where the Services use voice samples for voice generation, Keepnet applies appropriate additional safeguards.
Frequency
Continuous, for the term of the Agreement.
Retention
As set out in the Agreement, clause 13 and Keepnet's Data Retention and Disposal Procedure.
Annex 2 - Technical and organisational measures
Keepnet maintains, and keeps current, measures including:
Access control: role-based and least-privilege access; multi-factor authentication; just-in-time privileged access; regular review of privileged and administrative access; background checks where permitted by law.
Encryption: TLS in transit for all logins and hosted sites; encryption at rest; key management.
Network and application security: web application firewall; static code analysis; at least annual penetration testing; and a published vulnerability disclosure policy and bug bounty program.
Logging and monitoring: logging of authentication and application activity; alerting on anomalous or malicious activity; incident tracking.
Availability and resilience: high-availability infrastructure with contractual uptime targets; redundant power, network and cooling; backups replicated across availability zones and to a paired region within the same geography as the hosting region; regularly tested disaster recovery.
Organisational: security policies and training; supplier security management; secure development; change management; and an ISO/IEC 27001 certified management system.
Annex 3 - Sub-Processors
Microsoft Ireland Operations Limited (Azure; Microsoft 365)
Hosting and infrastructure; productivity
UK, Netherlands (West Europe), US, Canada, UAE, as set out in the Regional Data Hosting Policy
EEA/UK/Canada adequacy; EU SCCs + UK Addendum; DPF for US
Microsoft (Azure OpenAI Service)
AI features (AI Sub-Processor); data not shared with OpenAI
West Europe, East US
EU SCCs + UK Addendum; DPF for US leg
Amazon Web Services EMEA SARL
Hosting for the Türkiye region; content delivery (CloudFront), object storage and message queuing
UK, Ireland, Germany, US, Türkiye
EEA/UK adequacy where applicable; EU SCCs + UK Addendum + transfer risk assessment
Cloudflare, Inc.
CDN and security; AI gateway routing; Workers AI (open-weight models)
US and global edge
EU SCCs + UK Addendum; DPF
Google LLC
reCAPTCHA / login protection
US, EU, UK
EU SCCs + UK Addendum; DPF
Twilio Inc. (SendGrid; Twilio)
Email; calling and SMS
US
EU SCCs + UK Addendum; DPF
Telesign Corporation; Infobip Limited
Calling and SMS
US / EU
EU SCCs + UK Addendum
ElevenLabs, Inc.
AI voice generation for vishing simulations (AI Sub-Processor)
EU, US
DPF (incl. UK Extension); EU SCCs + UK Addendum
Anthropic, PBC
AI-assisted support drafting (AI Sub-Processor)
US
EU SCCs + UK Addendum
Intercom R&D Unlimited Company (Fin)
Customer support, including AI-assisted support (AI Sub-Processor)
Ireland, US
DPF (incl. UK Extension); EU SCCs + UK Addendum
IBM X-Force; VMRay; FortiSandbox; Google Safe Browsing
Malware and URL threat analysis
IBM X-Force (US); VMRay (Germany); FortiSandbox (US); Google Safe Browsing (US)
EU SCCs + UK Addendum; DPF where applicable
Functional Software, Inc. (Sentry)
Error monitoring
US
EU SCCs + UK Addendum
Keepnet affiliates
Service, support and development
Keepnet Labs Ltd (UK); Keepnet, Inc. (US)
Intra-group SCCs / UK Addendum
Annex 4 - Transfer mechanisms
A. EU SCCs. The EU SCCs (Decision (EU) 2021/914) are incorporated. Module Two applies where the Customer is a controller and Module Three where the Customer is a processor. Clause 7 (docking) applies. Clause 9: Option 2 (general written authorisation) applies, with the 30-day notice period in clause 7.2 of this DPA. Clause 11: the independent dispute-resolution option is not selected. Clause 13 (competent supervisory authority): as stated in Annex 1. Clause 17 governing law and Clause 18 forum: the Republic of Ireland. Annexes I, II and III of the SCCs are populated by Annex 1, Annex 2 and Annex 3 of this DPA.
B. UK Addendum. The UK Addendum to the EU SCCs applies to transfers subject to UK GDPR. Table 1 is populated by Annex 1; Tables 2 and 3 by the SCCs and Annexes above; Table 4 (ending the Addendum): the importer may end it. The UK-US Data Bridge is relied on where the US importer is certified.
C. Switzerland. For transfers subject to the Swiss FADP, the EU SCCs apply with the Swiss amendments in clause 11.4, or the Swiss-US DPF where the US importer is certified.
Last updated