Data Processing Agreement

This Data Processing Agreement (DPA) is effective and applies to the processing of personal data BUGB performs on behalf of customers. It supplements the Terms and Conditions. Existing signed data-processing agreements continue to govern where they apply.

The proposed parties are BUGB Technologies Private Limited (BUGB) and the Customer identified in the applicable service agreement or Ordering Document (Agreement). This DPA would cover personal data BUGB processes on the Customer’s behalf in providing the agreed services (Customer Personal Data). Applicable Data Protection Law means the data-protection laws that apply to that processing, as confirmed for the relevant engagement.

The Customer acts as controller and BUGB as processor. Where the Customer is itself a processor for another controller, BUGB acts as its sub-processor, and the Customer must have authority to give instructions and appoint BUGB. The Customer determines the lawful purposes and means of processing and is responsible for required notices, permissions, and the lawfulness of its instructions.

Processing for BUGB’s own independently determined purposes, such as its account administration and billing, requires a separate assessment of its role and is described in the Privacy Policy. This DPA would not authorize BUGB to repurpose Customer Personal Data for independent purposes.

The subject matter is the delivery of the Customer’s selected cybersecurity services, including Bravos and CXG (cert-x-gen) where included in the Agreement. The purpose is to perform authorized security analysis and testing, produce findings and remediation suggestions, and provide related support on the Customer’s instructions.

The nature of processing may include receiving, accessing, organizing, analyzing, transmitting, storing, retrieving, and deleting Customer Personal Data embedded in prompts, source code, repositories, target responses, logs, findings, and support material. Processing occurs for the service term and any agreed return or deletion period, subject to Section 8.

Data categories may include names, work contact details, usernames, online identifiers, IP addresses, device and activity information, and personal data incidentally contained in code, test evidence, logs, or support requests. Data subjects may include Customer personnel, contractors, clients, end users, and other individuals whose information is present in authorized testing material.

The final processing schedule must specify the services, operations, frequency, duration, data categories, data subjects, and processing locations for each engagement. Special-category data, criminal-offence data, and other highly sensitive information are outside the proposed scope unless expressly agreed with appropriate safeguards. The Customer should minimize and redact unnecessary personal data and secrets before submission.

BUGB would process Customer Personal Data only on the Customer’s documented instructions, including instructions concerning transfers, unless applicable law requires otherwise. The Agreement, agreed configuration, and written service requests would record those instructions. If legally required to process otherwise, BUGB would inform the Customer beforehand unless the law prohibits that notice.

BUGB would promptly inform the Customer if it considers an instruction to infringe Applicable Data Protection Law, and suspend the affected processing while the parties resolve it. Access would be limited to authorized personnel who need the data to provide the services and who are bound by contractual or statutory confidentiality obligations.

BUGB would not sell Customer Personal Data or use it to train general-purpose models for its own purposes under this DPA. Any proposed additional purpose would require separate legal assessment and a valid legal basis; the Customer’s service instructions alone would not authorize it.

BUGB would use sub-processors only with the Customer’s prior specific or general written authorization. Before processing begins, an agreed register would identify each sub-processor’s legal name, function, processing locations, and relevant transfer safeguards, including any LLM providers receiving Customer Personal Data.

For general authorization, BUGB would give advance written notice of intended additions or replacements and a meaningful opportunity to object on data-protection grounds before the change. The final DPA must set the notice period, objection process, and remedy if no reasonable alternative is available, including termination of the affected service where appropriate.

BUGB would assess sub-processors, bind them to equivalent data-protection obligations, and remain responsible to the Customer for their performance of those obligations. Provider terms would not reduce BUGB’s obligations under the finalized DPA.

AI features can transmit prompts, code, and target data to model providers. Before authorizing that processing, the parties must confirm provider retention, abuse monitoring, training use, deletion, and regional settings, including any customer-supplied-key arrangements. No providers or zero-retention configurations are approved by this DPA.

BUGB would implement and maintain technical and organizational measures appropriate to the risk and required by Applicable Data Protection Law. A final security schedule must describe the measures actually applicable to the service and its sub-processors, with evidence reviewed before approval.

The proposed schedule should address access control and least privilege; confidentiality and staff training; encryption in transit and at rest where appropriate; separation of customer environments; secure development and vulnerability management; logging and monitoring; incident response; backup, restoration, and resilience; and periodic testing of control effectiveness.

Changes would preserve an appropriate level of protection for the processing. These proposed measures do not claim any certification, audit result, data-residency guarantee, or product capability that has not been verified.

Taking into account the nature of processing, BUGB would assist the Customer through appropriate technical and organizational measures in responding to requests to access, correct, delete, restrict, port, or object to the processing of Customer Personal Data. BUGB would promptly forward requests it receives and would not respond on the Customer’s behalf without instructions unless legally required.

Taking into account the information available to it, BUGB would also assist with security obligations, personal-data-breach assessments and notifications, data protection impact assessments, and consultations with supervisory authorities. The final DPA should define operational contacts and response arrangements that allow the Customer to meet statutory deadlines.

A personal data breach means a security breach leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data. BUGB would notify the Customer without undue delay after becoming aware of such a breach and would take appropriate steps to contain, investigate, and mitigate it.

The notice would include available details of the breach, the affected data and individuals, likely consequences, mitigation measures, and a contact for follow-up. Information may be provided in phases as it becomes available, without delaying the initial notice. BUGB would cooperate with the Customer’s response and provide relevant updates.

The Customer would remain responsible for its regulatory and data-subject notifications; BUGB would not issue those on its behalf without instructions unless required by law. Counsel must confirm any additional contractual notification deadline and escalation procedure before adoption.

At the end of the relevant services, BUGB would, at the Customer’s choice, return or securely delete Customer Personal Data and delete remaining copies, unless applicable law requires retention. The final DPA must specify export formats, the period for making that choice, and completion deadlines, including sub-processor deletion.

Where law requires retention, BUGB would identify the requirement where legally permitted, protect retained data, and limit its use to that requirement. Any residual backup copies would be isolated from ordinary use, remain protected, and be deleted on the agreed backup-expiry schedule. BUGB would provide confirmation of completion on request.

Processing locations and remote access, including transfers to model providers and other sub-processors, must be documented before processing begins. BUGB would transfer Customer Personal Data internationally only on documented instructions and with a valid mechanism and safeguards required by Applicable Data Protection Law.

Where required, the parties would execute the applicable transfer instruments, complete their annexes, assess destination-country risks, and implement necessary supplementary measures. Counsel must determine whether EU Standard Contractual Clauses, a UK Addendum or International Data Transfer Agreement, or other mechanisms apply, and select the correct modules, parties, competent authority, law, and courts.

This DPA does not execute or incorporate any transfer clauses, certify an adequacy basis, or authorize a particular destination. Mandatory transfer protections would take priority over conflicting commercial terms in the final agreement.

BUGB would make available information reasonably necessary to demonstrate compliance with the finalized DPA and allow and contribute to audits and inspections by the Customer or its appointed independent auditor. Practical arrangements should protect confidential information and other customers’ data without preventing legally required oversight.

The parties must agree reasonable notice, scope, frequency, evidence-sharing, and cost arrangements, with exceptions where incidents or legal requirements call for urgent access. BUGB would maintain required processing records and cooperate with competent supervisory authorities.

Confirm applicable jurisdictions and laws, the contracting entities and processing roles, governing law and dispute forum, and how the DPA relates to the Terms, any signed enterprise agreement, liability provisions, and mandatory transfer clauses. The proposed priority is that the final DPA controls conflicts concerning Customer Personal Data, subject to mandatory law and transfer instruments; this DPA changes no existing contract.

Confirm the actual processing and security schedules; provider and sub-processor register; locations, training and retention settings; authorization and objection periods; breach contacts and deadlines; export, deletion, and backup timelines; audit arrangements; and any required EU or UK transfer instruments and assessments.

Decide how a finalized DPA is offered and executed for self-serve and enterprise customers, and review the existing Terms’ language about anonymized reporting and service improvement against these proposed processing limits. Account-side acceptance changes and an enterprise MSA rewrite are separate follow-ups.