Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the SOVA Terms of Service between Steelborn LLC and the Customer. It applies whenever Steelborn processes personal data on the Customer's behalf to provide SOVA.

1. Parties, roles and scope

• Customer means the organisation that has accepted the Terms of Service for a SOVA trial or subscription. The Customer is the controller of the personal data described in Annex 1 ("Customer Personal Data"). Where the Customer itself acts as a processor for another controller, Steelborn acts as its sub-processor, and the Customer is responsible for passing on the relevant information and instructions.
• Steelborn means Steelborn LLC, a limited liability company organised under the laws of the State of Wyoming, USA, with its principal office at 30 N Gould St, Ste N, Sheridan, WY 82801, USA. Steelborn is the processor of Customer Personal Data. Steelborn's representative in the European Union under Article 27 GDPR is Prighter EU Rep GmbH, Schellinggasse 3, 1010 Vienna, Austria.
• Data Protection Law means all laws on the protection of personal data that apply to the processing, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and the UK Data Protection Act 2018, the Swiss Federal Act on Data Protection ("FADP") and Türkiye's Law No. 6698 on the Protection of Personal Data ("KVKK"). Terms such as "controller", "processor", "personal data", "processing", "data subject" and "personal data breach" have the meanings given in the GDPR.
• This DPA covers Customer Personal Data only. Steelborn's own processing as a controller, for example of business contacts and billing data, is described in our Privacy Policy.
• On the processing of personal data, this DPA prevails over the Terms of Service. Where the Standard Contractual Clauses referred to in section 10 apply, they prevail over this DPA.

2. Details of the processing

The subject matter, nature, purpose and duration of the processing, the categories of data subjects and personal data, and the retention periods are set out in Annex 1. Steelborn processes Customer Personal Data for as long as it provides SOVA to the Customer and until the data is deleted under section 11.

3. Customer instructions

• Steelborn processes Customer Personal Data only on the Customer's documented instructions. The Terms of Service, this DPA and the Customer's configuration and use of SOVA, including the retention period it selects, are the Customer's complete instructions. Further instructions require written agreement.
• Steelborn will inform the Customer without delay if, in its opinion, an instruction infringes Data Protection Law.
• If the law requires Steelborn to process Customer Personal Data otherwise than on the Customer's instructions, Steelborn will inform the Customer before processing, unless the law prohibits this.

4. Customer responsibilities

The Customer is responsible for the lawfulness of the processing it instructs. In particular, the Customer:

• determines the legal basis for the processing and informs its employees, contractors, guests and other users about it as required by law;
• carries out a data protection impact assessment and consults employee representatives where the law requires it. SOVA includes automated analysis of network behaviour (see Annex 1), which the Customer should consider in that assessment;
• configures SOVA, its access policies and its retention period in line with its own obligations; and
• avoids putting special categories of personal data, such as health information, into user names, device names, notes or other free-text fields.

5. Confidentiality of personnel

Steelborn ensures that every person it authorises to process Customer Personal Data is bound by an appropriate obligation of confidentiality, and that access is limited to those who need it to provide, secure or support SOVA.

6. Security

Steelborn implements and maintains the technical and organisational measures described in Annex 2. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, these measures are designed to ensure a level of security appropriate to the risk. Steelborn may update the measures as technology develops, provided that the overall level of protection is not reduced.

7. Sub-processors

• The Customer gives Steelborn general authorisation to engage sub-processors. The sub-processors are described in Annex 3, and the current list is available to the Customer on request.
• Steelborn will notify the Customer at least 30 days before it adds or replaces a sub-processor, by email or in the SOVA console, and will update its list of sub-processors.
• The Customer may object to the change on reasonable data protection grounds within that period. The parties will discuss the objection in good faith. If they cannot resolve it, the Customer may terminate the affected subscription before the change takes effect and receive a refund of any fees it has prepaid for the period after termination.
• Steelborn imposes data protection obligations on each sub-processor that are, in substance, no less protective than those in this DPA, and remains responsible to the Customer for the performance of its sub-processors' obligations.

8. Data subject requests and assistance

• The SOVA console lets the Customer's administrators find, export and erase the data held about a specific person or endpoint. Where the Customer needs further help to respond to a data subject request, Steelborn will provide reasonable assistance.
• If Steelborn receives a request directly from a data subject about Customer Personal Data, it will forward the request to the Customer without undue delay and will not respond to it itself, other than to refer the data subject to the Customer.
• Steelborn will provide reasonable assistance, taking into account the nature of the processing and the information available to it, with the Customer's obligations on security, breach notification, data protection impact assessments and prior consultation with supervisory authorities. This DPA and its annexes are the primary information Steelborn makes available for this purpose.

9. Personal data breaches

• Steelborn will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data.
• The notification will describe, as far as is known at the time, the nature of the breach, the categories and approximate numbers of data subjects and records concerned, the likely consequences, the measures taken or proposed to address the breach and reduce its effects, and a contact point for further information. Where not all information is available at once, Steelborn will provide it in phases without undue delay.
• Steelborn will take reasonable steps to contain and investigate the breach and to reduce its possible adverse effects. A notification is not an acknowledgement of fault or liability.

10. International transfers

• Customer Personal Data stored in the SOVA cloud is hosted in the European Union, in Germany.
• Customer Personal Data is processed automatically in the SOVA cloud. Steelborn's support tools show service information, such as appliance and licence status, not Customer Personal Data. A small number of named administrators can access the servers to operate and secure SOVA, and support engineers can see technical logs and the support packages the Customer chooses to send. Steelborn is established in the United States; where such personnel work from outside the European Economic Area ("EEA"), the safeguards below apply. Some sub-processors may also process data outside the EEA.
• EEA. To the extent that the processing involves a transfer of personal data subject to the GDPR to Steelborn in a country without an adequacy decision, the standard contractual clauses approved by Commission Implementing Decision (EU) 2021/914 ("SCCs") are incorporated into this DPA by reference: Module Two (controller to processor) where the Customer is a controller, and Module Three (processor to processor) where the Customer is a processor. For the SCCs: Clause 7 (docking clause) applies; under Clause 9, Option 2 (general written authorisation) applies, with the notice period set out in section 7 of this DPA; the optional wording in Clause 11 does not apply; the competent supervisory authority under Clause 13 is determined in accordance with that clause; under Clauses 17 and 18, the SCCs are governed by the law of Ireland and disputes are resolved by the courts of Ireland. Annexes I to III of the SCCs are completed with the information in Annexes 1 to 3 of this DPA, with the Customer as data exporter and Steelborn as data importer.
• United Kingdom. For transfers subject to the UK GDPR, the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner (version B1.0) applies. Tables 1 to 3 of the Addendum are completed with the information in this DPA, and either party may end the Addendum as set out in its Section 19.
• Switzerland. For transfers subject to the FADP, the SCCs apply with the necessary adaptations: the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority, references to the GDPR are read as references to the FADP, and data subjects in Switzerland may enforce their rights in Switzerland.
• Türkiye. Where the KVKK applies to a transfer of Customer Personal Data abroad, the parties will sign the standard contract published by the Turkish Personal Data Protection Authority, and the party responsible under the KVKK will notify the Authority within the period required by law. Steelborn will provide the contract on request.
• Steelborn ensures that onward transfers to sub-processors outside the EEA, the United Kingdom or Switzerland are covered by an adequacy decision, the EU-U.S. Data Privacy Framework and its UK and Swiss extensions where the recipient is certified, or standard contractual clauses.

11. Return and deletion

• During the subscription, the Customer can export reports and records from the SOVA console and can ask Steelborn for an export of Customer Personal Data.
• When the subscription or trial ends, Customer Personal Data is permanently deleted from the SOVA cloud, including from backups, 30 days after the end date, unless the law requires Steelborn to keep it. Steelborn will confirm the deletion in writing on request.
• Data stored on the SOVA Appliance remains under the Customer's control, on hardware that the Customer operates. The Customer can delete it by reinstalling or decommissioning the appliance.
• Support packages that the Customer sends to Steelborn are deleted within 30 days after the related support request is closed.

12. Information and audits

• Steelborn makes available to the Customer the information necessary to demonstrate compliance with this DPA and Article 28 GDPR. This includes this DPA and its annexes, and answers to a reasonable security questionnaire once in any 12-month period.
• Where this information is not sufficient, or where a supervisory authority requires it, the Customer may carry out an audit, itself or through an independent auditor that is bound by confidentiality and is not a competitor of Steelborn. The Customer must give at least 30 days' written notice, and the audit takes place during normal business hours, no more than once in any 12-month period, at the Customer's cost, and without access to other customers' data or to information that would compromise the security of SOVA.

13. Liability

Each party's liability arising out of or in connection with this DPA is subject to the limitations and exclusions of liability in the Terms of Service, except where Data Protection Law does not allow such limitation. Nothing in this DPA limits the rights of data subjects under the SCCs or Data Protection Law.

14. Term and changes

• This DPA applies for as long as Steelborn processes Customer Personal Data, and its obligations continue until that data has been deleted under section 11.
• Steelborn may update this DPA. It will give the Customer at least 30 days' notice of material changes, in the same way as for changes to the Terms of Service. Changes required by law may take effect sooner. An update will not reduce the overall level of protection for Customer Personal Data.

15. Contact

For questions about this DPA, data protection requests and breach-related communication, contact:

Annex 1: Description of the processing

Data subjects. The Customer's employees, contractors, guests and other people whose devices or accounts connect to networks protected by SOVA, and the Customer's console users.

Categories of personal data.

• Network access records: user and device identifiers, such as user names and MAC and IP addresses; network location, such as switch port or wireless network; and the time, result and policy of access decisions and sessions.
• Device information: information that identifies the type, operating system and software of devices that connect to the network.
• Directory information: group memberships used in access policies, if the Customer connects its directory.
• Security analytics: behavioural profiles, risk indications, alerts and summaries derived from the data above.
• Console users: name, email address, role, and sign-in and activity records.
• Support data: information in support packages that the Customer chooses to send to Steelborn.

Special categories of data. None are intended. See section 4.

Data that stays on the Customer's network. The following data is never sent to the SOVA cloud:

• passwords of network users and secrets of network devices;
• the content of network traffic, including the websites and services that users visit; and
• raw log files, which stay on the SOVA Appliance and are deleted automatically.

Nature of the processing. Collection on the Customer's network, transmission to and storage in the SOVA cloud, automated analysis to provide security insights, reporting to the Customer, and deletion. Access decisions follow the policies defined by the Customer; security insights do not block access on their own.

Purpose. Providing network access control, endpoint visibility, security insights and support to the Customer as described in the Terms of Service.

Frequency. Continuous for the duration of the trial or subscription.

Retention. The periods below are maximums; some records are kept for shorter periods.

Annex 2: Technical and organisational measures

• Hosting. The SOVA cloud and its data are hosted in a data centre in Germany (EU).
• Encryption. Data is encrypted in transit. Backups and appliance storage are encrypted. Support packages are encrypted when they are created; only Steelborn support can open them.
• Access control. Access is role-based and follows the principle of least privilege. Multi-factor authentication is required for console accounts. Steelborn staff access is limited to what is needed to operate, secure and support SOVA, and is recorded.
• Separation. Each customer's data is logically separated from other customers' data.
• Secure operation. Software updates are delivered through a protected update process, and systems are monitored for security and availability.
• Data minimisation and retention. Only the data needed for the service is processed, and data is deleted automatically according to the retention periods in Annex 1.
• Logging. Administrative actions are recorded in an audit trail.
• Availability and continuity. Network access decisions are made on the SOVA Appliance in the Customer's network, so a temporary interruption of the SOVA cloud does not interrupt network access. Regular encrypted backups and recovery procedures protect against data loss. Service levels are set out in the Service Level Agreement.
• Incidents. Personal data breaches are handled and notified as described in section 9.
• Personnel. Personnel are bound by confidentiality, and access is removed when it is no longer needed.

Annex 3: Sub-processors

Steelborn engages a limited number of carefully selected sub-processors for hosting in Germany (EU), network edge and security services, encrypted backup storage in the EU, and support communication. The current list of sub-processors, with the purpose and location of each, is available to the Customer on request at [email protected].

Changes to the sub-processors are notified as described in section 7.