Skip to content

Data Processing Agreement

Last updated: August 26, 2026

This Data Processing Agreement ("DPA") forms part of the agreement between Cykanner ("Processor", "we") and the customer identified in the applicable order or account registration ("Controller", "you") for use of Cykanner's breach-monitoring service (the " Service"). It applies automatically, in full — including Section 6's international-transfer mechanisms (the EU Standard Contractual Clauses, UK Addendum, and Swiss adaptations) — to the extent we process personal data on your behalf, without a separate signature, so there's no gap in coverage while data is transferred; we're happy to countersign a copy, populated with your organization's specific details, for your own records — contact us (see below) to request one.

This DPA is offered as a standard template reflecting our actual data-processing practices, described in more detail in our Privacy Policy. It is not a substitute for your own legal review, particularly if you operate in a regulated industry or need terms beyond this standard form — contact us to discuss.

1. Definitions

"Personal Data", "Processing", "Controller", "Processor", "Data Subject", and "Supervisory Authority" have the meanings given in the EU General Data Protection Regulation (GDPR) and, where applicable, the UK GDPR and comparable US state privacy laws (e.g. the CCPA/CPRA). "Sub-processor" means a third party we engage to process Personal Data on your behalf as part of the Service.

2. Subject Matter, Duration, and Purpose

We process Personal Data on your behalf solely to provide the Service — checking the email addresses you configure against known data-breach records and alerting you when a match is found — for as long as your account remains active, and thereafter only as described in our Privacy Policy's Data Retention section.

3. Categories of Data Subjects and Personal Data

Data Subjects: your organization's account users; the individuals whose email addresses you configure the Service to monitor; individuals you configure as standalone alert recipients (an email address you add to receive breach alerts, which need not belong to an account user or a monitored address); and, where you use bulk file import, any other individual represented in the content of an uploaded import file (for example, a name or phone number appearing in a column of that file), even if their own address isn't ultimately configured for monitoring.

Personal Data processed: account holder name and email address; the IP address logged against an account user's audited actions (e.g. changing a domain or alert setting), retained alongside that audit log entry; monitored email addresses and, where you supply it, an associated owner name identifying who that address belongs to; breach-match results (which breach, which data classes were exposed, and when); where you use it, alert-channel configuration (recipient addresses, Slack workspace, or webhook destination); and, where you use bulk file import to add monitored addresses, the content of the uploaded file for the duration of that import — if our own extraction can't identify any addresses in it, the complete raw file content (not just addresses) is sent to a Sub-processor (OpenAI) as a fallback, described further in our Privacy Policy's Data Sharing section. We do not intentionally collect or solicit special categories of data (e.g. health, biometric, or genetic data). However, because breach-match results describe what a third-party breach database reports was exposed, a given breach record's data classes could incidentally reveal special-category information about a Data Subject (for example, a breach from a health-related service). We process that incidental data solely to relay the breach match to you, under the same technical and organizational measures described in Processor Obligations below, and do not use it for any other purpose.

4. Processor Obligations

We will:

  • process Personal Data only on your documented instructions, including with regard to international transfers, unless required to do otherwise by law we're subject to, in which case we will inform you before carrying out that processing, unless that law prohibits informing you on important grounds of public interest; and will promptly inform you if, in our opinion, an instruction you give infringes the GDPR or another applicable data-protection law;
  • ensure personnel authorized to process Personal Data are subject to confidentiality obligations;
  • implement appropriate technical and organizational measures to protect Personal Data, as described in our Security page and Privacy Policy;
  • assist you, insofar as reasonably possible, in responding to requests from Data Subjects exercising their rights under applicable data-protection law;
  • assist you in ensuring compliance with security, breach-notification, and data-protection-impact-assessment obligations, including, where a data-protection impact assessment identifies a residual high risk, assisting with your prior consultation with a supervisory authority under Article 36, taking into account the nature of processing and information available to us;
  • at your election, delete or return all Personal Data to you at the end of the Service relationship, and delete existing copies (subject to our standard backup-retention schedule and any legal retention requirement) — you can trigger this yourself at any time via self-service account deletion, described in our Privacy Policy;
  • make available information reasonably necessary to demonstrate compliance with this DPA, and allow for and contribute to reasonable audits, including inspections, conducted by you or an auditor you mandate, subject to reasonable advance notice and confidentiality.

5. Sub-processors

You give general written authorization to engage the Sub-processors listed in our Privacy Policy's Data Sharing section as of the date of processing. Before we engage a new Sub-processor or replace an existing one, we will notify you (by email to your account's registered address, or another method we've agreed with you) at least 14 days in advance, so you have an opportunity to object on reasonable grounds before that Sub-processor begins processing Personal Data. Each Sub-processor is bound by data-protection obligations materially equivalent to those in this DPA, appropriate to the nature of the service they provide us.

6. International Transfers

We are based in the United States, and our Sub-processors primarily process data there. Where Personal Data originating in the EEA, UK, or Switzerland is transferred to us, the Standard Contractual Clauses annexed to European Commission Implementing Decision (EU) 2021/914 of 4 June 2021 ("SCCs") are incorporated into, and form part of, this DPA — Module Two (Controller to Processor) applies, with you as "data exporter" and us as "data importer", completed as set out below. This Module Two incorporation governs only the transfer between you and us; it doesn't itself extend to the further transfer of that data from us to a Sub-processor located in the US or another country not deemed to provide an adequate level of protection. For those onward transfers, we separately require each such Sub-processor to have its own appropriate safeguard in place (for example, its own Standard Contractual Clauses executed with us, or its own certified adequacy mechanism), as part of the "data-protection obligations materially equivalent to those in this DPA" every Sub-processor is already bound by under Section 5.

Annex I.A — List of Parties. Data exporter: the customer identified in the applicable order or account registration, at the organization name and account contact email on file in your account; role: Controller. Data importer: Cykanner, 5830 E 2nd St, Ste 7000 #37463, Casper, Wyoming 82609, US; contact: Data Protection Contact, legal@cykanner.io; role: Processor. Note on completeness: standard account registration doesn't collect a physical address or a named contact person's title for the data exporter — those two specific fields are the only ones left incomplete here, and we can't synthesize them without you telling us. The substantive protections and obligations in this DPA and the incorporated SCCs, UK Addendum, and Swiss adaptations (confidentiality, security measures, breach notification, deletion, sub-processor flow-down, and all Processor Obligations in Section 4) apply automatically and in full from the date processing begins, regardless of those two fields — they aren't conditions of the DPA's substantive effect. But if your organization specifically needs those two fields completed (for example, for your own internal SCC compliance recordkeeping), contact us and we'll provide a countersigned copy naming them; until then, treat this as a disclosed, narrow completeness gap in the paperwork, not a gap in the underlying protection. Activities relevant to the transfer: as described in Section 2 (Subject Matter, Duration, and Purpose) above. Signature: this Annex is deemed signed by both parties as of the date Personal Data processing under the Service begins, consistent with this DPA's automatic-application clause above.

Annex I.B — Description of Transfer. Categories of data subjects and categories of Personal Data transferred: as listed in Section 3 above. Sensitive data: none transferred by design, subject to two incidental exceptions described in Section 3: breach-match results that happen to reveal special-category information, and bulk-import file content that falls back to a Sub-processor (OpenAI) and may contain arbitrary fields from your uploaded file, including special-category data if present in it. Frequency of transfer: continuous, for as long as the Service is in use. Nature and purpose of processing: as described in Section 2. Duration of processing and retention: for as long as your account remains active, and thereafter per the retention periods in our Privacy Policy's Data Retention section. Recipients: the Sub-processors listed in our Privacy Policy's Data Sharing section.

Annex I.C — Competent Supervisory Authority. If you (as data exporter) are established in an EEA member state, the supervisory authority of that member state. If you are not established in an EEA member state but are subject to the GDPR under Article 3(2) (e.g. because you monitor addresses belonging to individuals in the EEA), and you have designated an EU representative under Article 27, the supervisory authority of the member state in which that representative is established. Otherwise, determined in accordance with SCC Clause 13(c) itself — generally, the supervisory authority of the EEA member state where the data subjects whose Personal Data is transferred are mainly located — rather than a single authority fixed in advance here, since that determination depends on facts specific to your organization's own data subjects.

Annex II — Technical and Organizational Measures. All Personal Data encrypted in transit using HTTPS between your browser or API client and our servers; passwordless, magic-link authentication; organization-scoped access controls; time-limited (30-minute), read-only support sessions for authorized personnel, each creating an audit record; automated daily database backups, retained for 7 days. The connection between our application servers and our database is not itself TLS-encrypted; instead, it's confined to a private network not exposed to the public internet, which we've assessed as providing comparable protection for that specific internal link — see our Security page for further detail on this and our other measures.

For the purposes of Clause 17 of the SCCs, the Parties select the law of Ireland (without prejudice to a mandatorily-applicable law of your own EEA member state permitting third-party beneficiary rights, per Clause 17). For the purposes of Clause 18(b), the Parties select the courts of Ireland, without prejudice to a Data Subject's right to bring proceedings before the courts of their own habitual residence. This selection applies only to the SCCs themselves and does not alter the governing law and forum of the remainder of this DPA and the Terms of Service, described in Section 8 below.

Swiss adaptations. Where Personal Data protected by the Swiss Federal Act on Data Protection ("FADP") is transferred, the SCCs incorporated above apply with the adaptations required by the Swiss Federal Data Protection and Information Commissioner's guidance of 27 August 2021: references to the "GDPR" are understood as references to the FADP to the extent the FADP governs the relevant processing; references to a "Member State" are understood to include Switzerland; and, for a data exporter established in Switzerland, the competent supervisory authority under Annex I.C is the FDPIC and Clause 18(b)'s courts include the competent courts of Switzerland, rather than Ireland.

Where Personal Data originating in the UK is transferred on the same basis, the UK Information Commissioner's Office's International Data Transfer Addendum to the EU Commission Standard Contractual Clauses ("UK Addendum") is incorporated into, and forms part of, this DPA. Its Table 1 (Parties) is populated by Annex I.A above. Table 2 selects the SCCs and Module Two module incorporated above as the underlying Approved EU SCCs, with the following elections: the optional docking clause (Clause 7) is included; for Clause 9(a) (Sub-processors), Option 2 (general written authorization) is selected, with the minimum time period for prior notice of a new Sub-processor set at 14 days, matching Section 5 above; and the optional redress wording in Clause 11(c) (allowing a Data Subject to lodge a complaint with an independent dispute resolution body) is not adopted. Table 3 (Appendix Information) is populated by Annexes I.B and II above; and, for Table 4, either Party may end the UK Addendum as permitted by Section 19 of the UK Addendum itself, but not otherwise while this DPA remains in effect. We will provide a completed, standalone copy of the SCCs and UK Addendum, populated with your organization's specific details, on request.

7. Security Incidents

We will notify you without undue delay after becoming aware of a security incident resulting in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data we process on your behalf, and will provide information reasonably available to us to help you meet your own notification obligations.

8. Liability and Term

This DPA is governed by, and liability under it is subject to, the limitations and terms of our Terms of Service, except that where the SCCs, UK Addendum, or Swiss adaptations incorporated in Section 6 apply, their own liability provisions and data-subject third-party-beneficiary rights govern instead, to the extent those provisions can't lawfully be limited by our commercial terms — the Terms of Service's liability cap doesn't reduce them. This DPA remains in effect for as long as we process Personal Data on your behalf under the Service.

9. Contact

Questions about this DPA, or want a countersigned copy for your records? Contact us at:
Email: legal@cykanner.io
Address: 5830 E 2nd St, Ste 7000 #37463, Casper, Wyoming 82609, US