Data Processing Agreement

Last updated: 2026-05-08

This Data Processing Agreement ("DPA") forms part of the Master Services Agreement ("MSA") or Terms of Service between Silux Connect ("Silux", "Processor") and the customer ("Controller"). It governs the processing of personal data on the Controller's behalf in connection with Silux Connect (the "Service").

This DPA applies to the extent the UK GDPR, the EU GDPR, the Swiss FADP, the CCPA, the LGPD, or another comparable data-protection law applies to the processing.

1. Definitions

Capitalised terms not defined here have the meaning given in the MSA. "Personal Data", "Controller", "Processor", "Sub-processor", "Data Subject", "Processing", and "Supervisory Authority" have the meanings ascribed in Article 4 GDPR. "Personal Information", "Sale", and "Service Provider" have the meanings in the CCPA.

2. Subject matter, nature, purpose, and duration

• Subject matter: Processing of Personal Data by Processor as necessary to provide Silux Connect under the MSA.
• Nature: Hosting, storage, retrieval, transmission, automated decision-making in security analytics, AI assistance, encryption, and erasure.
• Purpose: Delivery of remote support, device management, patch management, MDM, AI assistance, audit logging, billing, and customer support.
• Duration: For the term of the MSA plus the wind-down period in §11.
• Data Subjects: Controller's employees, contractors, end users, customers, and other individuals about whom Personal Data is provided to the Service.
• Categories of Personal Data: Identifiers (name, email, IP), professional information (role, organisation), device information (hostname, OS, hardware identifiers), session metadata, screen recordings (when enabled), files transferred during sessions, audit-log entries, support correspondence, and any other data Controller chooses to submit.
• Sensitive categories: Only as Controller chooses. PHI requires execution of a BAA (see /hipaa).

3. Roles and responsibilities

The Controller decides the purposes and means of Processing. Processor processes Personal Data only on documented instructions from the Controller, including for international transfers, unless required by Union or Member-State law to which Processor is subject. In that case, Processor will inform the Controller of that legal requirement before Processing, unless the law prohibits such information on important grounds of public interest.

Controller represents that it has provided all required notices and obtained all required consents (or has another lawful basis) to authorise the Processing.

4. Confidentiality of Processor personnel

Processor ensures that personnel authorised to process Personal Data are subject to written confidentiality obligations or are under appropriate statutory obligations of confidentiality, and have received training appropriate to their role.

5. Security (Art. 32 GDPR)

Processor implements appropriate technical and organisational measures, including those summarised in Annex B (Technical and Organisational Measures), to ensure a level of security appropriate to the risk. The measures include:

• AES-256-GCM encryption at rest with envelope encryption (per-tenant KEK wrapping per-resource DEK), TLS 1.3 in transit with AEAD ciphers and ECDHE forward secrecy.
• End-to-end encryption between agent and operator with per-session unique keys; the Silux Relay sees ciphertext only.
• Pseudonymisation of telemetry and metric streams.
• Resilience: multi-AZ deployment, hot standby, immutable encrypted backups, tested restore procedures.
• Regular testing: continuous SAST, weekly DAST, annual third-party penetration testing, quarterly red-team-style exercises.
• Vulnerability management with documented SLAs (Critical 7 days, High 30 days, Medium 90 days).
• Identity and access management: SSO, MFA mandatory for admin roles, JIT elevation for SUPER_ADMIN, two-person rule for destructive operations.

6. Sub-processors

Controller authorises Processor to engage the Sub-processors listed at /subprocessors. Processor will give Controller at least 30 days' prior notice of any new Sub-processor by updating that page and emailing the security contact on file. You can subscribe to changes via the page's RSS feed.

Controller may object on reasonable data-protection grounds within the 30-day notice window by emailing dpo@siluxconnect.com. The parties will work in good faith to address the objection. If they cannot agree, Controller may terminate the affected portion of the Service for material breach with a pro-rata refund.

Processor remains liable to Controller for the acts and omissions of its Sub-processors as if Processor performed the obligations itself.

7. Data-subject rights assistance

Processor will, taking into account the nature of the Processing, assist Controller by appropriate technical and organisational measures, insofar as possible, to fulfil Controller's obligation to respond to requests for the exercise of Data-Subject rights under Articles 15-22 GDPR. The Service provides self-service export and deletion APIs documented at docs.siluxconnect.com.

8. Personal-data breach notification

Processor will notify Controller without undue delay, and within 72 hours after becoming aware of a Personal-Data Breach, providing the information required by Art. 33(3) GDPR to the extent then known, supplemented as the investigation proceeds. Notice is delivered to the security contact on file and via the in-product notification centre.

Processor will reasonably cooperate with Controller in investigation and notification activities.

9. Data Protection Impact Assessments

Processor will provide reasonable assistance to Controller in carrying out Data Protection Impact Assessments (Art. 35) and prior consultations with Supervisory Authorities (Art. 36), including by providing the relevant subset of Annex B and the trust portal evidence.

10. International transfers

Where Processor or its Sub-processors transfer Personal Data outside the UK / EEA / Switzerland to a country without an adequacy decision, the parties incorporate, by reference and as applicable:

• The European Commission's Standard Contractual Clauses 2021/914, Module 2 (controller-to-processor) where Controller is in the EEA, with Processor as data importer.
• The European Commission's Standard Contractual Clauses 2021/914, Module 3 (processor-to-processor) where Controller is itself a processor.
• The UK ICO's International Data Transfer Addendum (issued under s.119A DPA 2018) for UK transfers.
• The Swiss-equivalent SCCs adopted by the FDPIC for Swiss transfers.

The SCCs are completed as set out in Annex C. Supplementary measures applied by Processor are described in Annex B.

11. Return or deletion at end of Service

On termination of the MSA, Controller may, within 30 days of termination, request export of Personal Data in a structured, commonly-used, machine-readable format. After 30 days (or sooner if Controller so requests), Processor will delete all Personal Data in its production systems within 30 days. Backups containing residual copies expire on the rolling 35-day cycle and are not separately purged. Where law requires retention beyond these timelines, Processor will keep Personal Data confidential and use it solely for the legally-required purpose.

12. Audit

Processor will make available to Controller all information reasonably necessary to demonstrate compliance with this DPA. Controller may, on at least 30 days' written notice and not more than once per calendar year (more frequently if required by a Supervisory Authority or following a Personal-Data Breach), conduct an audit during normal business hours and in a manner that does not unreasonably disrupt Processor's operations.

Processor satisfies the audit obligation primarily by making available, under NDA, the most recent SOC 2 Type II report, ISO 27001 certificate (when issued), pen-test executive summary, and the trust portal evidence pack. On-premises audits are reserved for cause and are conducted at Controller's expense by an independent auditor reasonably acceptable to Processor.

13. CCPA-specific terms

For Personal Information subject to the CCPA, Processor acts as a Service Provider. Processor will not (a) sell or share Personal Information; (b) retain, use, or disclose Personal Information for any purpose other than the business purpose specified in the MSA; (c) retain, use, or disclose Personal Information outside the direct business relationship with Controller; or (d) combine Personal Information with personal information received from another source, except as permitted by 11 CCR §7050(b).

14. Liability

Liability under this DPA is governed by the limitations in the MSA. Nothing in this DPA limits a Data Subject's rights under applicable law.

15. Conflict

In the event of a conflict between this DPA and the MSA, this DPA prevails for matters of data protection.

16. Governing law

This DPA is governed by the law of England and Wales. The Standard Contractual Clauses themselves are governed as set out in Clause 17 of those Clauses.

---

Annex A — Subject-matter details

• Categories of Data Subjects: Controller's employees, contractors, end users, customers, prospects.
• Categories of Personal Data: Identifiers, professional information, device information, session metadata, optional recordings, optional file transfers, audit-log entries, support correspondence.
• Sensitive categories: Only as Controller submits; PHI subject to a separate BAA.
• Frequency of Processing: Continuous during the Service term.
• Retention period: As set out in the MSA / Privacy Policy and Controller's tenant-level configuration.

Annex B — Technical and organisational measures

See the Trust Center at /security for the full TOMs document. Summary:

Domain	Measure
Encryption	AES-256-GCM at rest, TLS 1.3 in transit, end-to-end encrypted relay, customer-managed KMS option.
Identity	SSO, MFA-by-default for admin roles, WebAuthn supported, JIT elevation, two-person rule.
Access control	Five-role RBAC, tenant boundary enforced server-side on every query, audit log of role changes.
Network	WAF, DDoS protection, IP allow-listing, mTLS in cluster, deny-egress by default.
Monitoring	24x7 SIEM, anomaly detection, audit log, EventLog with append-only semantics.
Resilience	Multi-AZ deployment, hot standby, immutable encrypted backups, tested DR.
SDLC	Signed commits, SLSA L3 provenance, cosign-signed images, mandatory peer review, gated deploys.
Vulnerability mgmt	Continuous SAST, weekly DAST, annual external pen test, quarterly red-team, public bug bounty.
People	Background checks, security training on onboarding and annually, role-based access reviews.
Physical	Hosted on AWS / Hetzner; SOC 2 Type II and ISO 27001-certified data centres.

Annex C — SCC selections

• Module: 2 (controller-to-processor) by default, 3 (processor-to-processor) where Controller is itself a processor.
• Clause 7 (docking): permitted.
• Clause 9 (sub-processors): Option 2, with 30 days' prior notice (per §6 above).
• Clause 11 (redress): independent dispute resolution body not selected.
• Clause 17 (governing law): law of Ireland.
• Clause 18 (forum): courts of Ireland.
• Annex I.A: Parties — as in the MSA.
• Annex I.B: Description of transfer — as in §2 of this DPA.
• Annex I.C: Competent supervisory authority — Irish DPC for EU; UK ICO for UK Addendum.
• Annex II: Technical and organisational measures — Annex B above.
• Annex III: Sub-processors — /subprocessors.

---

Signature

For most customers this DPA is incorporated by reference into the MSA / Terms and is binding on both parties without a separate signature. Customers requiring a wet-signed counterpart can request one at dpo@siluxconnect.com.