Data processing agreement

Version 1.0, effective [to confirm: launch date]

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Coffee Cup Solutions Ltd, trading as Coffee Cyber ("we", "us"), and the business customer that has signed up to the service ("you"). It sets out the terms required by Article 28 of the UK GDPR for personal data that we process on your behalf.

1. Scope and roles

1.1 This DPA applies where we process personal data on your behalf in providing the service. This mainly means device and telemetry data from the CrowdStrike Falcon platform, such as hostnames, operating system details, last seen times, sensor versions and detections, which can include usernames and file paths.

1.2 For that data, you are the controller and we are your processor.

1.3 This DPA does not cover personal data we use to run your account, the control panel, billing and support for our own purposes. We are the controller of that data, and our Privacy Notice explains how we use it.

1.4 CrowdStrike processes endpoint telemetry as part of the Falcon platform under its own end user terms and data protection terms, which you accept at sign-up. This DPA does not change those terms. Where CrowdStrike processes data in providing the Falcon platform to you through us, it is listed as a sub-processor in Annex 2.

1.5 The details of the processing, including the types of data and data subjects, are set out in Annex 1.

2. Key words used in this DPA

2.1 "UK GDPR", "controller", "processor", "data subject", "personal data", "personal data breach" and "processing" have the meanings given in the UK GDPR and the Data Protection Act 2018. "Data Protection Law" means the UK GDPR, the Data Protection Act 2018 and any other UK law about the processing of personal data that applies.

2.2 "Sub-processor" means any third party we engage to process personal data on your behalf under this DPA.

2.3 Other capitalised words have the meanings given in the Terms of Service.

3. Your obligations as controller

3.1 You are responsible for making sure that you have a lawful basis for the processing, and that you have given any information to data subjects (such as your staff) that Data Protection Law requires, including about monitoring of devices.

3.2 Your instructions to us must comply with Data Protection Law.

3.3 You are responsible for the accuracy of the data you provide, and for the settings you choose in your Falcon console.

4. Processing only on your instructions

4.1 We will process personal data only on your documented instructions, unless UK law requires us to do otherwise. If so, we will tell you before processing, unless the law prevents us from doing so.

4.2 Your instructions are set out in the Terms of Service, this DPA, and the settings and actions you take in the control panel and the Falcon console. Any further instructions must be agreed in writing and must be consistent with the service.

4.3 We will tell you straight away if we think an instruction breaks Data Protection Law.

5. Confidentiality of our staff

5.1 We will make sure that anyone we authorise to process the personal data is bound by a duty of confidentiality, whether by contract or by law.

5.2 We will limit access to the personal data to those who need it to provide the service.

6. Security

6.1 We will put in place appropriate technical and organisational measures to protect the personal data, as required by Article 32 of the UK GDPR. These take account of the nature of the data, the risks involved and the state of the art.

6.2 Our measures include:

• encryption of data in transit;
• passwordless sign-in to our control panel, using one-time email links, Microsoft work account sign-in or passkeys;
• role-based access controls, so people only see what they need;
• audit logging of sign-ins and key actions;
• separate Falcon consoles for each customer; and
• keeping our own systems patched and protected.

[to confirm: any further measures to list, such as encryption at rest and backups]

6.3 We may update our security measures over time, as long as the overall level of protection is not reduced.

7. Sub-processors

7.1 You give us general authorisation to use sub-processors. Our current sub-processors are listed in Annex 2.

7.2 We will tell you at least 30 days before we add or replace a sub-processor, by email or through the control panel. [to confirm: notice period]

7.3 You may object to a new sub-processor on reasonable data protection grounds by telling us through the control panel within that notice period. If you object, we will discuss your concerns in good faith. If we cannot resolve them, you may cancel the service under the Terms of Service before the change takes effect, without any charge beyond the fees already due.

7.4 We will put a written contract in place with each sub-processor that gives data protection obligations that are no less protective than those in this DPA, so far as they apply to the services that sub-processor provides. Where a sub-processor provides a standard service on its own terms (for example CrowdStrike for the Falcon platform), we rely on its published data protection terms.

7.5 We remain responsible to you for the performance of our sub-processors' obligations, to the extent required by Data Protection Law.

8. International transfers

8.1 Some sub-processors may process personal data outside the UK, including in the United States.

8.2 We will only transfer personal data outside the UK where the transfer is permitted by Data Protection Law. This means the destination has UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework, where the recipient is certified), or the transfer is protected by the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, together with any supplementary measures needed.

9. Helping you with data subject requests

9.1 If we receive a request from a data subject about personal data we process for you, we will pass it to you promptly and will not respond to it ourselves, unless you ask us to or the law requires it.

9.2 Taking into account the nature of the processing, we will give you reasonable help to respond to data subject requests, for example by helping you find or export data from your Falcon console.

10. Helping you meet your other obligations

10.1 We will give you reasonable help, taking into account the nature of the processing and the information available to us, with:

• keeping personal data secure;
• dealing with personal data breaches;
• data protection impact assessments; and
• consultation with the Information Commissioner's Office.

10.2 We may charge a reasonable fee for help that goes beyond what is normally included in the service, and will agree it with you first. [to confirm: whether to charge for assistance]

11. Personal data breaches

11.1 We will tell you without undue delay after becoming aware of a personal data breach affecting personal data we process for you.

11.2 We will give you the information you reasonably need to meet your own obligations, as far as we have it. This includes, where known:

• what happened and when;
• the categories and approximate number of data subjects and records affected;
• the likely consequences; and
• what we have done, or plan to do, to deal with the breach and reduce its effects.

11.3 If we cannot give all the information at once, we will give it in stages as it becomes available.

11.4 Telling you about a breach is not an admission of fault or liability.

11.5 This section is about breaches of the personal data we process. It does not mean we monitor or respond to security alerts in your Falcon console. That remains your responsibility, or CrowdStrike's on the Complete plan, as set out in the Terms of Service.

12. Deleting data at the end of the service

12.1 When the service ends, we will close your Falcon console as described in the Terms of Service. Before that happens, you can export any data you need.

12.2 After the service ends, we will delete the personal data we process for you, or return it if you ask before the end date, unless UK law requires us to keep it. Data held by CrowdStrike in the Falcon platform will be deleted in line with CrowdStrike's own retention policies.

12.3 We may keep device counts and related records that support our invoices for as long as we need them for tax and accounting purposes (6 years after the end of the financial year they relate to). We will continue to protect any data we keep under this DPA.

13. Information and audits

13.1 We will make available to you the information you reasonably need to show that we are meeting our obligations under Article 28 of the UK GDPR.

13.2 We will allow for and contribute to audits, including inspections, by you or an independent auditor you appoint, as long as:

• you give us at least 30 days' written notice, unless a shorter period is needed because of a personal data breach or a regulator's request;
• audits take place during normal UK business hours and do not unreasonably disrupt our business;
• the auditor agrees to keep our information confidential;
• audits are no more than once in any 12-month period, unless required by a regulator or following a personal data breach; and
• you pay your own costs, and our reasonable costs where the audit takes more than one working day of our time.

13.3 We may first answer your questions in writing or provide existing documents, certifications or reports, and you agree to consider whether these meet your needs before asking for an inspection.

13.4 Audits of CrowdStrike, Pax8 and other sub-processors are subject to the audit terms they offer.

14. Liability

14.1 Each party's liability under or in connection with this DPA is subject to the limits and exclusions in the Terms of Service.

15. How long this DPA lasts, and which document wins

15.1 This DPA lasts for as long as we process personal data for you under the Terms of Service, and continues for any data we keep after that.

15.2 If this DPA conflicts with the Terms of Service on a matter of data protection, this DPA wins.

15.3 This DPA is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

Annex 1: Details of the processing

Annex 2: Sub-processors

Companies House is a public source of company information that we query. It is not a sub-processor.