Data processing agreement

Roles

Who acts as what depends on whose instruction the processing happens on:

• Scan content processed on your instruction - the pages, findings and screenshots of domains you tell us to scan, and the workspace data around them: you are the controller, we are your processor. This agreement governs exactly this processing.
• Your account, billing, support and our security and operational records (sessions, audit log, rate limits): ADMI ENTERPRISES s.r.o. is an independent controller, as described in the privacy policy.
• Anonymous scans from the public form: we are the controller under our legitimate interest. They are outside this agreement.
• Personal data of third parties appearing on pages you instruct us to scan: you are the controller of it; we process it for you as part of the scan content.

Annex 1 - description of the processing

Stated here rather than in a separate exhibit, so the description and the obligations cannot be accepted separately.

• Subject matter: automated auditing of websites the controller instructs us to scan, and the storage and presentation of the results.
• Duration: the term of the main agreement - this agreement runs exactly as long as the terms of service do, and ends with them.
• Nature and purpose: crawling publicly reachable pages of instructed domains; analysing content, headers and behaviour; producing findings, scores, screenshots and reports; storing them for the plan's retention window, save that the newest scan of each of the controller's own projects is kept beyond that window until the project or the workspace is deleted.
• Types of personal data: workspace member and invitee identification data (name, e-mail, role); and any personal data visible on the scanned pages - which can include names, contact details and photographs captured in screenshots - as determined by what the controller instructs us to scan.
• Categories of data subjects: the controller's users, team members and invitees; and persons whose personal data appears on the scanned pages.
• Special categories: the service is not intended for them, and the controller must not instruct us to process special-category data (Art. 9) without our prior written agreement.

Instructions

We process scan content only on your documented instructions, including for transfers to a third country, unless EU or member-state law we are subject to requires otherwise - in which case we tell you before processing, unless that law forbids it. Your documented instructions are this agreement plus the configuration you set in the product: the domains you add, the scans you start, the members you invite, the retention your plan carries and the deletions you perform. Anything beyond that is an instruction only if we agree to it in writing.

One exception to processing only on your instructions, which you agree to by accepting this agreement: the domain opt-out and do-not-scan list at /opt-out. A person who verifies control of a domain can put it on the do-not-scan list, and we then refuse every scan of it, yours included, whatever your plan. They can also have every stored scan of the domain erased from every customer's workspace, yours included: the pages, findings, screenshots, reports and share links those scans produced. We carry this out on their request, not on yours, 7 days after we tell your workspace's owners, who can tell us in that time if the request did not come from someone entitled to make it. The erasure covers the scans started up to the request, and it removes scan content, not every mention of the domain. What remains afterwards is: the domain on the do-not-scan list, where the operator chose the block, so that the block keeps working; our record of the request and its outcome (the domain, the dates, the affected workspaces, the share links switched off, the number of scans erased, and the IP address the request came from, which is removed after twelve months); the records of the confirmation ticked on our public free scanner for that domain (the domain, the time and the IP address), each deleted 365 days after it was made; the public free scanner's project entry for the domain, with no scans in it; and each customer's own project for the domain, with no scans in it, yours included, which stays in the workspace until the customer deletes it. Erased scans are not restored, and no compensation is owed for them. What our backups hold of it is covered by the backup statement under Deletion and return below.

We will inform you without delay if, in our opinion, an instruction of yours infringes the GDPR or other EU or member-state data-protection law.

Confidentiality of persons authorised

We ensure that every person we authorise to process scan content is committed to confidentiality under a contractual or statutory duty, and that access is limited to what operating and securing the service requires.

Security measures (Art. 32)

• TLS in transit and encryption at rest, as provided by each sub-processor. There is no per-workspace encryption scoping
• Row-level security policies on every tenant-scoped table, with cross-tenant isolation covered by tests that run against a real database
• Audit log of sign-ins, scans started from the app or the API, batch scan runs, report generation, share link creation and revocation, invitations, membership and role changes, not editable by customers; kept for the life of the workspace, with IP addresses removed after twelve months
• API keys stored only as a hash; a key's plaintext is shown once and cannot be recovered
• Nightly encrypted database backups (GPG, AES256) to offsite object storage, with a bounded window stated under Deletion and return below
• Automated dependency scanning: Dependabot on the repository, and a dependency audit in CI on every change

Sub-processors

You give general written authorisation for the sub-processors on the public list at /legal/subprocessors, which carries each one's purpose, location and transfer mechanism. In outline:

• Railway - application and scan-worker hosting, region europe-west4 (Amsterdam, Netherlands)
• Neon - PostgreSQL database, Frankfurt, Germany (running on AWS eu-central-1)
• Cloudflare - R2 object storage for scan artefacts and encrypted backups, and Turnstile on the public scan form
• Resend - transactional e-mail, EU region (sending via Amazon SES, AWS eu-west-1, Ireland)
• Sentry - error monitoring, EU region, processing only when error monitoring is enabled
• GitHub - runs the nightly encrypted backup job, and briefly holds the dump during it

Sub-processor changes and flow-down

Before we add or replace a sub-processor we announce the change on /legal/subprocessors at least 30 days before it takes effect. If you object within that period and we cannot resolve the objection, you may terminate the affected subscription without penalty, with a refund of the unused part of any prepaid period.

We impose on every sub-processor, by contract, the same data-protection obligations this agreement imposes on us - in particular sufficient guarantees of appropriate technical and organisational measures - and we remain fully liable to you for the performance of each sub-processor's obligations.

Our authentication layer (Better Auth) is a software library running in our own infrastructure, not a vendor: no personal data leaves our systems through it, so it does not appear on the sub-processor list.

Independent controllers

Two parties process personal data in connection with the service as independent controllers, not as our sub-processors: Stripe, with Link as merchant of record, for payments, invoicing, refunds and disputes; and Google, for accounts that choose Google sign-in. They determine their own purposes and their own notices apply - they are listed on /legal/subprocessors for completeness, separately from the sub-processors.

Locations, transfers and safeguards

The application and scan workers run in the EU (Amsterdam), the database in Frankfurt (EU), and scan artefacts (screenshots and report PDFs) and encrypted backups in object storage under Cloudflare's EU jurisdiction. Transactional e-mail is sent from the EU (Ireland).

Several vendors are US-incorporated, so transfers of personal data to the United States can occur. Where they do, they rely on the EU–US Data Privacy Framework for vendors certified under it, and on Standard Contractual Clauses otherwise.

Assistance

Taking into account the nature of the processing, we assist you with appropriate technical and organisational measures in fulfilling your obligation to respond to data-subject requests under Arts. 12–23 - a request that reaches us for processing we perform for you is forwarded to you without undue delay, and we act on your instruction rather than unilaterally.

We also assist you in ensuring compliance with Arts. 32–36 - security, breach notification, and data protection impact assessments and prior consultation where they concern this processing - taking into account the nature of the processing and the information available to us.

Breach notification

We will notify you without undue delay, and in any event within 24 hours of becoming aware, of a personal data breach affecting personal data we process for you - with the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Where not all of that is known within 24 hours, we notify with what we have and follow up as we learn more.

We assist you with your own notification obligations under Arts. 33 and 34, and we document every personal data breach, its effects and the remedial action taken.

Deletion and return

At the end of the services, at your choice, we delete or return all personal data we processed for you, and delete existing copies unless EU or member-state law requires us to keep them. Deleting your workspace is such a choice: it deletes scans, artefacts and reports at once. Before deletion you can download every scan and every finding as CSV yourself, from Settings under the Data tab; a copy of what that export does not contain, such as screenshots and report PDFs, can be requested at any point before deletion. Retention inside the subscription follows the plan window and is enforced by a daily pruner rather than being an intention - save that the newest scan of each of your own projects is kept beyond the window until you delete the project or the workspace, so a dashboard does not go blank.

One record outlives the deletion and it is ours, not something the law obliges us to keep: a note of which workspace was deleted, when, and the e-mail address of the person who deleted it, held for twelve months as evidence that the erasure was carried out and then removed automatically. It contains no scan content and no personal data of your data subjects.

Deleted data can remain recoverable for up to 8 days across our backup copies: Neon (AWS eu-central-1, Frankfurt) (0.25 day window); Cloudflare R2 (EU jurisdiction) (8 day window). That is the longest-lived copy, not an average - adding a copy lengthens this window and it is published from the copies themselves rather than restated by hand.

Audits and information

We make available to you all information necessary to demonstrate compliance with the obligations in Art. 28 GDPR, and we allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate. Audits are limited to once per contract year, are conducted remotely on the basis of documentation and written answers, run at your cost, and require 30 days' notice - except after a personal data breach affecting your data, when one additional audit may follow without waiting for the next year.

Controller warranties and responsibility

You warrant that you have a lawful basis for the personal data on the domains you instruct us to scan, that you are authorised to have them scanned, and that you have satisfied your own information duties towards the data subjects concerned. Each party is responsible for its own compliance with the GDPR in the role it holds; we are responsible for processing scan content in accordance with this agreement, and you are responsible for the lawfulness of the instructions you give.

This agreement lasts as long as the main agreement and is governed by the same law (see the terms of service, section 20). If this agreement and the terms conflict about the processing of personal data, this agreement prevails.