// LEGAL

Data Processing Agreement

Last updated: 15 September 2026. This DPA forms part of the engagement agreement between Acta Security and each client.

1. Parties and scope

Data Processor: Acta Security, EU ("Acta" or "we").

Data Controller: the client entity identified in the onboarding submission or engagement agreement ("Client" or "you").

This Data Processing Agreement ("DPA") governs all processing of personal data that Acta carries out on behalf of the Client in connection with the delivery of security services. It applies from the point of onboarding and for the duration of the engagement.

2. Subject matter and nature of processing

Acta processes personal data solely to the extent necessary to deliver the agreed security services, which may include:

• Penetration testing, attack surface mapping and vulnerability assessment of assets the Client controls and has authorised us to test.
• Delivery of written reports, findings and remediation guidance via the client portal.
• Virtual CISO (vCISO) advisory: reviewing policies, programmes and governance documentation that may reference individuals.
• Incident response: analysis of logs, artefacts and communications containing personal data to the extent provided by the Client.

3. Categories of data subjects and personal data

Depending on the engagement scope and materials provided by the Client, processing may involve:

• Client personnel: names, email addresses, roles, system access credentials (in scope targets only).
• End users of the Client's systems: authentication artefacts, session tokens, or data incidentally observed during testing, limited to what is technically necessary and removed from deliverables unless explicitly required.
• Third-party data: Acta will not retain personal data of individuals beyond what is required to substantiate a finding. We redact PII from reports wherever its inclusion is not necessary to evidence the vulnerability.

4. Processor obligations

Acta shall:

• Process personal data only on the documented instructions of the Client, including with regard to transfers to third countries.
• Ensure that personnel authorised to process personal data are bound by confidentiality obligations.
• Implement appropriate technical and organisational security measures as set out in Section 7.
• Assist the Client, at the Client's cost, in fulfilling its obligations to respond to data subject rights requests, data protection impact assessments, and supervisory authority consultations.
• Delete or return all personal data upon completion or termination of the engagement, at the Client's choice, within 30 days, and delete existing copies unless EU law requires storage.
• Make available all information necessary to demonstrate compliance with this DPA and allow for audits and inspections, either directly or through an appointed third-party auditor.
• Inform the Client immediately if any instruction infringes the GDPR or applicable data protection law.

5. Sub-processors

Acta uses the following sub-processors. The Client provides general authorisation for their use. Acta will notify the Client of intended additions or replacements, giving the Client the opportunity to object.

All sub-processors are bound by data processing agreements at least as protective as this DPA. Acta will notify the Client of any intended additions or replacements with reasonable notice, giving the Client the opportunity to object before the change takes effect.

6. International transfers

Processing takes place primarily within the EU/EEA. The United Kingdom (Sage) is covered by a European Commission adequacy decision. Where a transfer outside the EEA is required, it is made under European Commission Standard Contractual Clauses (SCCs) in accordance with GDPR Article 46(2)(c). A copy of the applicable SCCs is available on request.

7. Security measures

Acta implements appropriate technical and organisational measures, including:

• Encryption of personal data in transit and at rest.
• Access controls and authentication for the client portal and Acta systems.
• Network and application protections appropriate to the risk.
• Monitoring, logging and alerting, with security and access logs retained for 90 days then purged.
• Regular vulnerability management and encrypted backups to EU-resident storage.
• Malware scanning of files uploaded through the portal before they are stored.

8. Personal data breach notification

Acta shall notify the Client without undue delay, and in any event within 72 hours of becoming aware, of any personal data breach affecting Client data. Notification will be made to the contact email on record and will include the nature of the breach, categories and approximate number of data subjects affected, likely consequences, and measures taken or proposed. Acta will cooperate fully in any required supervisory authority notification.

9. Duration and termination

This DPA applies for the duration of the engagement and any retention period thereafter. On expiry or termination, Acta will securely delete or return all personal data within 30 days unless a longer retention period is required by EU law, in which case Acta will protect the data and limit processing to what is legally required.

10. Governing law

This DPA is governed by the laws of the European Union. Disputes arising in connection with this DPA are subject to the exclusive jurisdiction of the competent EU courts, without prejudice to the Client's right to lodge a complaint with its local data protection supervisory authority.

11. Contact

Questions about this DPA or data protection matters: privacy@actasecurity.eu.