Data Processing Addendum

DRAFT, not yet reviewed by a lawyer.
Effective date: [EFFECTIVE DATE]
Last updated: 11 November 2026

This Data Processing Addendum (“DPA“) forms part of the Terms of Service (the “Agreement“) between [LEGAL ENTITY NAME AND FORM], trading as “GLAV”, [REGISTERED ADDRESS], OIB [OIB] (“GLAV“ or “Processor“) and the customer that has accepted the Agreement (“Customer“ or “Controller“). It applies where GLAV processes Customer Personal Data on Customer’s behalf in providing the Service.

It is entered into automatically when Customer accepts the Agreement.

1. Definitions

Terms such as “controller”, “processor”, “personal data”, “processing”, “data subject”, “personal data breach” and “supervisory authority” have the meanings given in Regulation (EU) 2016/679 (“GDPR“).

• “Customer Personal Data“ means personal data that GLAV processes on behalf of Customer under the Agreement, including personal data contained in targets, test results, evidence, findings and reports.

• “Data Protection Law“ means the GDPR, the Croatian Act on the Implementation of the GDPR, and any other data protection law applicable to the processing, including (where relevant) the UK GDPR and the Swiss Federal Act on Data Protection.

• “Subprocessor“ means any processor engaged by GLAV to process Customer Personal Data.

• “SCCs“ means the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914.

2. Roles and scope

2.1 Customer is the controller of Customer Personal Data, or a processor acting on behalf of its own client. Where Customer is a processor, Customer warrants that its instructions, including the appointment of GLAV as a (sub)processor, are authorised by the relevant controller.

2.2 GLAV is the processor of Customer Personal Data. GLAV is an independent controller for account, billing, usage and security data it processes for its own purposes, as described in the Privacy Policy.

2.3 Customer is responsible for the lawfulness of the processing it instructs, including having a legal basis and the target owner’s authorisation for any testing that may involve personal data.

3. Subject matter, nature, purpose and duration

3.1 Subject matter: provision of the GLAV automated security testing platform under the Agreement.

3.2 Nature and purpose: running authorised automated penetration tests against Customer-defined targets; collecting, storing and analysing responses, evidence and artefacts; validating findings, including with the help of AI models; managing projects and clients; generating and storing reports; and providing support.

3.3 Duration: for the term of the Agreement plus the period until deletion or return of Customer Personal Data under section 11.

Further details are set out in Annex 1.

4. Processing on documented instructions

4.1 GLAV will process Customer Personal Data only on Customer’s documented instructions, including with regard to international transfers, unless required otherwise by EU or Member State law. In that case GLAV will inform Customer of the legal requirement before processing, unless that law prohibits it.

4.2 The Agreement, this DPA, and Customer’s configuration and use of the Service (including the targets, scope and settings it defines) are Customer’s complete instructions. Additional instructions must be agreed in writing.

4.3 GLAV will tell Customer immediately if, in its opinion, an instruction infringes Data Protection Law.

5. Confidentiality

GLAV ensures that persons authorised to process Customer Personal Data are bound by confidentiality obligations and have access only as needed to provide the Service.

6. Security

6.1 GLAV implements appropriate technical and organisational measures to protect Customer Personal Data, as required by Article 32 GDPR, as described in Annex 2.

6.2 Customer acknowledges that findings and evidence may contain highly sensitive data, such as credentials, secrets, session tokens and personal data found on target systems, and is responsible for configuring tests and retention settings to minimise the collection of such data where possible.

6.3 GLAV may update its security measures provided the overall level of protection is not reduced.

7. Subprocessors

7.1 Customer gives GLAV general written authorisation to engage Subprocessors. The current list is published at glav.ai/subprocessors and forms Annex 3.

7.2 GLAV will notify Customer of any intended addition or replacement of a Subprocessor at least [SUBPROCESSOR NOTICE DAYS] days in advance, by [NOTICE METHOD, e.g. email to account owner / subscription to the subprocessor page].

7.3 Customer may object on reasonable data protection grounds within that notice period. The parties will discuss the objection in good faith. If GLAV cannot offer a reasonable alternative, Customer may terminate the affected Service and receive a refund of prepaid fees for the period after termination.

7.4 GLAV imposes data protection obligations on each Subprocessor that are no less protective than those in this DPA, and remains responsible to Customer for its Subprocessors’ performance.

8. International transfers

8.1 GLAV may transfer Customer Personal Data outside the EEA only in compliance with Chapter V GDPR.

8.2 Where a transfer relies on an adequacy decision (including the EU-U.S. Data Privacy Framework for certified recipients), that decision applies. Otherwise, the SCCs apply and are incorporated by reference:

• Module 2 (controller to processor) where Customer is a controller;

• Module 3 (processor to processor) where Customer is a processor.

8.3 For the SCCs: the optional docking clause (Clause 7) [applies / does not apply]; Clause 9 Option 2 (general authorisation) applies with the notice period in section 7.2; the optional wording in Clause 11 does not apply; Clauses 17 and 18 are governed by the law and courts of [SCC GOVERNING LAW AND COURTS — e.g. Croatia]; and Annexes 1 to 3 of this DPA complete the SCC annexes. Where GLAV transfers to its own Subprocessors, GLAV relies on the transfer safeguards in those Subprocessors’ agreements.

8.4 For transfers from the UK or Switzerland, the SCCs apply with the UK International Data Transfer Addendum or the Swiss amendments, as applicable.

9. Assistance

9.1 Data subject requests. GLAV will promptly forward to Customer any request from a data subject relating to Customer Personal Data and will not respond except to direct the person to Customer. Taking into account the nature of the processing, GLAV will help Customer respond, mainly through the Service’s functionality.

9.2 Other assistance. GLAV will provide reasonable assistance with Customer’s obligations under Articles 32 to 36 GDPR (security, breach notification, data protection impact assessments and prior consultation), taking into account the information available to GLAV.

10. Personal data breaches

10.1 GLAV will notify Customer without undue delay, and in any event within [BREACH NOTICE HOURS] hours, after becoming aware of a personal data breach affecting Customer Personal Data.

10.2 The notice will describe, to the extent known, the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed. Information may be provided in phases.

10.3 GLAV will take reasonable steps to contain and remediate the breach. Notifying a breach is not an admission of fault.

11. Deletion and return

11.1 On termination of the Agreement, Customer may export its reports and data during the period set out in the Agreement ([EXPORT WINDOW DAYS] days).

11.2 After that period, GLAV will delete Customer Personal Data, including from active systems within [DELETION PERIOD DAYS] days and from backups within [BACKUP DELETION PERIOD DAYS] days, unless EU or Member State law requires retention. Data retained under law, or to preserve evidence of a suspected breach of the Acceptable Use Policy, will remain protected under this DPA.

11.3 Customer may also delete projects, findings and reports during the term using the Service’s functionality, subject to the backup cycle above.

12. Audits

12.1 GLAV will make available to Customer the information reasonably necessary to demonstrate compliance with Article 28 GDPR, including this DPA, its security documentation and, where available, third-party audit reports.

12.2 If that information is not reasonably sufficient, Customer may, at its own cost and no more than once in any 12-month period (unless required by a supervisory authority or following a personal data breach), carry out an audit, by itself or through an independent auditor bound by confidentiality, on at least [AUDIT NOTICE DAYS] days’ written notice, during business hours and without disrupting GLAV’s operations or other customers’ data.

12.3 Audits do not extend to the facilities of GLAV’s infrastructure Subprocessors; for these, GLAV will provide the Subprocessor’s available audit reports.

13. Liability and precedence

13.1 Each party’s liability under this DPA is subject to the limitations in the Agreement, except where Data Protection Law does not allow it.

13.2 If this DPA conflicts with the Agreement, this DPA prevails for matters relating to personal data. If the SCCs conflict with this DPA, the SCCs prevail.

Annex 1 — Description of processing

Item: Data exporter
Description: Customer, as identified in its account. Role: controller or processor

Item: Data importer / processor
Description: [LEGAL ENTITY NAME AND FORM] (GLAV), [REGISTERED ADDRESS]. Contact: [PRIVACY CONTACT EMAIL]. Role: processor

Item: Categories of data subjects
Description: Customer’s users and team members; Customer’s clients and their staff; individuals whose data is present on or accessible from tested targets (for example employees, customers or users of the tested systems)

Item: Categories of personal data
Description: Names, email addresses, usernames and contact details found on targets; credentials, password hashes, API keys, session tokens and secrets exposed by vulnerabilities; IP addresses, device and log data; any other personal data contained in HTTP responses, screenshots, files, database extracts or other evidence collected during authorised tests; data in reports and comments

Item: Special categories of data
Description: Not intended. However, tests may incidentally expose special-category data present on a target. Safeguards: strict access controls, tenant isolation, encryption in transit, minimisation settings, deletion on request

Item: Frequency of transfer
Description: Continuous, for the duration of the Agreement, as tests are run

Item: Nature of processing
Description: Collection, recording, storage, analysis (including by AI models), structuring, retrieval, reporting and deletion

Item: Purpose
Description: Providing authorised automated security testing, validation of findings and reporting under the Agreement

Item: Retention
Description: During the term as configured by Customer; deletion under section 11

Item: Transfers to Subprocessors
Description: As listed in Annex 3, for the purposes described there

Item: Competent supervisory authority
Description: Agencija za zaštitu osobnih podataka (AZOP), Croatia

Annex 2 — Technical and organisational measures

GLAV maintains at least the following measures.

Tenant isolation and access control

• Logical separation of each customer’s data (per-tenant isolation) enforced at the application and database layer.

• Role-based access within customer accounts.

• Access by GLAV personnel to production data limited to those who need it, using individual accounts.

Isolated testing infrastructure

• Pentest engines run in isolated, containerised (Docker) workers, separated from the core application and from other customers’ runs.

• A scope and authorisation gate checks every test request against verified, in-scope assets before execution.

• Domain and asset verification before testing.

Encryption

• Data in transit is encrypted using TLS.

• Data at rest:

Logging and monitoring

• Audit logs record user and test activity, including who ran which test against which target and when.

• Logs retained for [AUDIT LOG RETENTION].

Secure development and operations

Data minimisation and deletion

• Customer-controlled deletion of projects, findings and reports.

• Deletion and backup cycles as set out in section 11.

Incident response

• A documented process for detecting, triaging and notifying personal data breaches.

Subprocessor management

• Subprocessors are bound by data processing terms and reviewed before engagement.

Annex 3 — Subprocessors

See glav.ai/subprocessors, which forms part of this DPA.