Legal
Data Processing Addendum
Last updated: 7 September 2026
CyfroSec offers a Data Processing Addendum (“DPA”) for customers where CyfroSec processes personal data on the customer’s behalf in connection with the services.
The DPA is incorporated into and forms part of the CyfroSec Software License and Services Agreement and addresses, as applicable:
- the subject matter, duration, nature and purposes of processing;
- categories of personal data and data subjects;
- documented customer instructions;
- confidentiality and access restrictions;
- technical and organisational measures;
- subprocessors and data locations;
- assistance with data-subject requests, security incidents, data-protection impact assessments and regulatory consultations;
- audit and compliance information;
- return and deletion of Customer Personal Data; and
- international-transfer safeguards, including the European Commission’s Standard Contractual Clauses where required.
CyfroSec ordinarily acts as processor for Customer Personal Data submitted to or generated through the services on the customer’s behalf. CyfroSec acts as an independent controller for business-contact, billing, account-administration, service-security and compliance information where CyfroSec determines the purposes and means of processing.
To request, review or execute the current DPA, contact legal@cyfrosec.com or privacy@cyfrosec.com. The applicable DPA should be incorporated into the customer’s Order Form or agreement before production processing of Customer Personal Data where Article 28 GDPR or another applicable law requires a processing agreement.
The current material subprocessor list is available at https://www.cyfrosec.com/subprocessors/. The customer-specific service scope, hosting region and any additional security requirements are stated in the applicable Order Form.