Data Processing Agreement

Download DPA (PDF)

1. When You Need a DPA

If you deploy CyberGuardian on endpoints used by employees, contractors or other individuals, a DPA is legally required. If you use CyberGuardian solely on your own personal devices, no DPA is necessary — we act as data controller in that case and our Privacy Policy applies.

2. What the Agreement Covers

• The categories of personal data processed by the agent and the purposes of processing
• Our obligation to process data only on your documented instructions
• The technical and organisational security measures we apply under Article 32 GDPR
• Personal data breach notification within 48 hours of becoming aware
• The sub-processors we engage and your right to object to changes
• Your audit rights and our assistance with data subject requests
• Return or deletion of your data upon termination of the service

3. Sub-processors

We engage the following sub-processors. All platform data is hosted within the European Union.

• Railway Corp. — cloud infrastructure and application hosting (EU West — Amsterdam)
• Vercel Inc. — website hosting and contact form delivery
• Resend — transactional email delivery
• Stripe, Inc. — payment processing (billing data only)

We will inform you at least 30 days in advance of any intended addition or replacement of a sub-processor.

4. Your Responsibilities as Controller

Where the agent is deployed on employee endpoints, you are responsible for informing those individuals of the monitoring, establishing a lawful basis for it under applicable national employment law, and completing any works council consultation or impact assessment required in your jurisdiction.

5. How to Execute the Agreement

Download the DPA, complete the Controller details in Clause 1, sign it, and send the signed copy to us. We will counter-sign and return it to you.

Contact: support@cyberguardian.bg

If your organisation requires its own DPA template or amendments to ours, contact us and we will review it.