'%3e%3c/ellipse%3e%3cpath%20d='M20.5%2023.5%20L3.4%2045.6%20L23%2031.8%20Z'%20fill='%23B4EE3A'%20stroke='%23B4EE3A'%20stroke-width='3'%20stroke-linejoin='round'%20stroke-linecap='round'%3e%3c/path%3e%3cpath%20d='M47%2020.5%20Q42%2033%2030.5%2036.5'%20stroke='%23FFFFFF'%20stroke-opacity='0.35'%20stroke-width='2.4'%20fill='none'%20stroke-linecap='round'%3e%3c/path%3e%3ccircle%20cx='30.2'%20cy='20.2'%20r='4.4'%20fill='%23FFFFFF'%3e%3c/circle%3e%3ccircle%20cx='28.9'%20cy='20.4'%20r='2.15'%20fill='%23101116'%3e%3c/circle%3e%3ccircle%20cx='27.9'%20cy='19.1'%20r='0.85'%20fill='%23FFFFFF'%3e%3c/circle%3e%3c/svg%3e)
for procurement
Sections 4 to 11 map one-to-one onto the requirements of Article 28(3)(a) to (h), and each heading names the sub-paragraph it satisfies. Annex I details the processing, Annex II the security measures, and Annex III the sub-processors.
Parties, scope and precedence
Clause 1.1. This Data Processing Agreement (the "DPA") is entered into between:
| Role | Party |
|---|---|
| Data Controller | The Customer - the organisation that subscribes to the Service and enrols its personnel. |
| Data Processor | Hackiwi B.V., established in the Netherlands. |
The Processor's registration details are:
- Legal entity
- Hackiwi B.V.
Clause 1.2. This DPA applies whenever Hackiwi processes personal data on the Customer's behalf in providing the Service. It forms part of, and is governed by, the Terms of Service (together, the "Agreement").
Clause 1.3. It takes effect automatically on the Customer's acceptance of the Terms of Service and requires no separate signature. A countersigned copy for procurement files is available on request to [email protected].
Clause 1.4. In the event of a conflict between this DPA and the Terms of Service in relation to the processing of personal data, this DPA prevails.
Clause 1.5. Terms defined in the Terms of Service have the same meaning here. "Personal data", "processing", "controller", "processor", "data subject", "personal data breach" and "supervisory authority" have the meanings given in Article 4 of Regulation (EU) 2016/679 (the "GDPR").
Subject matter, duration, nature and purpose
Clause 2.1. Subject matter. Hackiwi processes personal data in order to provide the security awareness platform to the Customer.
Clause 2.2. Duration. Processing continues for the term of the Customer's subscription, and thereafter only for the limited period required to delete or return the data under section 11.
Clause 2.3. Nature and purpose. The processing consists of:
- storage and display of training records;
- processing of phishing simulation results;
- OSINT and breach intelligence checks;
- sending transactional emails;
- audit logging of administrative actions.
Clause 2.4. Full details of the processing are set out in Annex I (section 16).
Categories of personal data and data subjects
Categories of personal data
| Category | Examples |
|---|---|
| Identity | Names, email addresses |
| Training | Completion records, quiz results, progress |
| Simulation | Click and report events |
| Security | Breach check results, session data, IP addresses |
| Audit | Administrative action logs |
Categories of data subjects
Employees and contractors of the Customer who have access to the platform.
Special categories
The Service is not designed to process special categories of personal data under Article 9 GDPR, or data relating to criminal convictions and offences under Article 10. The Customer must not instruct Hackiwi to process such data through the Service without a prior written agreement addressing the additional safeguards required.
Processing on documented instructions - Art. 28(3)(a)
Clause 4.1. Hackiwi processes personal data only on the Customer's documented instructions, including with regard to transfers to a third country, unless required to do otherwise by Union or Member State law to which Hackiwi is subject. In that case Hackiwi will inform the Customer of that legal requirement before processing, unless the law prohibits such information on important grounds of public interest.
Clause 4.2. The Agreement, this DPA, and the Customer's use and configuration of the Service constitute the Customer's complete documented instructions. Additional instructions must be agreed in writing and may be subject to a charge where they require material effort.
Clause 4.3. Hackiwi will inform the Customer if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions, and may suspend the affected processing until the instruction is confirmed, withdrawn or amended.
Clause 4.4. Hackiwi does not process Customer personal data for its own purposes, does not sell it, and does not use it to train machine learning models.
Clause 4.5. The Customer warrants that it has a lawful basis for the processing it instructs, that it has provided the information required by Articles 13 and 14 GDPR to its data subjects, and that it has met any consultation or notification obligations owed to employee representatives - a point of particular relevance to phishing simulations, addressed in section 6 of the Acceptable Use Policy.
Confidentiality - Art. 28(3)(b)
Clause 5.1. Hackiwi ensures that every person authorised to process personal data under this DPA is bound by an appropriate obligation of confidentiality, whether contractual or statutory, and that the obligation survives the end of their engagement.
Clause 5.2. Access to personal data is limited to personnel who need it to provide, support or secure the Service, and is granted on a least-privilege basis.
Clause 5.3. Personnel receive instruction on their data protection obligations appropriate to their role.
Security of processing - Art. 28(3)(c) and Art. 32
Clause 6.1. Hackiwi implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking account of the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing, as required by Article 32 GDPR.
Clause 6.2. The measures in force are described in Annex II (section 17). Hackiwi may update them from time to time provided the level of security is not materially reduced.
Clause 6.3. The Customer is responsible for the security measures within its own control - in particular the assignment of administrative roles, the protection of its Users' credentials, and the safekeeping of any third-party API keys it connects.
Sub-processors - Art. 28(2), 28(3)(d) and 28(4)
Clause 7.1. The Customer grants Hackiwi general written authorisation to engage sub-processors for the provision of the Service. The sub-processors engaged as at the date of this DPA are listed in Annex III (section 18) and published at hackiwi.com/subprocessors.
Clause 7.2. Hackiwi will give the Customer at least 30 days' notice before adding or replacing a sub-processor, by email to the administrative contact on the account and by updating the published list.
Clause 7.3. The Customer may object to a proposed sub-processor on reasonable data protection grounds within that 30-day period, by written notice to [email protected]. The parties will discuss the objection in good faith. If no resolution is reached, the Customer may terminate the affected part of the subscription without penalty and receive a pro-rata refund of prepaid fees for the unused term.
Clause 7.4. Hackiwi imposes on each sub-processor, by written contract, data protection obligations no less protective than those in this DPA, as required by Article 28(4).
Clause 7.5. Hackiwi remains fully liable to the Customer for the performance of each sub-processor's obligations.
not sub-processors
Anthropic, Have I Been Pwned and VirusTotal are not Hackiwi sub-processors. They receive data only where the Customer connects its own API key, which creates a direct relationship between the Customer and that provider. Where no key is connected, no data is sent. See Annex III.
Assistance with data subject rights - Art. 28(3)(e)
Clause 8.1. Taking into account the nature of the processing, Hackiwi assists the Customer by appropriate technical and organisational measures, insofar as possible, in fulfilling the Customer's obligation to respond to requests to exercise data subject rights under Chapter III GDPR.
Clause 8.2. The Service provides self-service functionality through which the Customer can access, correct, export and delete the personal data of its Users, which will in most cases be sufficient to respond without Hackiwi's involvement.
Clause 8.3. Where Hackiwi receives a request directly from a data subject relating to Customer personal data, it will not respond to it itself - other than to acknowledge receipt and direct the data subject to the Customer - and will forward the request to the Customer within 48 hours of identifying the relevant Customer.
Clause 8.4. Where the Customer cannot fulfil a request through the Service, Hackiwi will provide reasonable additional assistance on request to [email protected].
Clause 8.5. The Customer should note the deliberate durability of audit records described in section 8 of the Privacy Policy when designing its own erasure process.
Assistance with breaches, DPIAs and consultation - Art. 28(3)(f)
Clause 9.1. Hackiwi assists the Customer in ensuring compliance with its obligations under Articles 32 to 36 GDPR, taking into account the nature of processing and the information available to Hackiwi.
Clause 9.2. Personal data breach notification. Hackiwi will notify the Customer without undue delay and in any event within 72 hours of becoming aware of a personal data breach affecting Customer personal data.
Clause 9.3. The notification will describe, to the extent known at the time: the nature of the breach and the categories and approximate number of data subjects and records concerned; the likely consequences; the measures taken or proposed to address it and to mitigate its effects; and a contact point for further information. Where the full picture is not available at once, information will be provided in phases without further undue delay.
Clause 9.4. Hackiwi will not notify a supervisory authority or any data subject on the Customer's behalf unless legally required to do so or expressly instructed by the Customer in writing. Assessment and notification under Articles 33 and 34 remain the Customer's responsibility as controller.
Clause 9.5. DPIAs and prior consultation. Hackiwi provides the Customer with reasonable information and assistance for data protection impact assessments under Article 35 and prior consultation with a supervisory authority under Article 36, insofar as these relate to the Service and the information is available to Hackiwi.
Clause 9.6. Breaches and suspected breaches may be reported to Hackiwi at [email protected].
Deletion or return of personal data - Art. 28(3)(g)
Clause 10.1. At the Customer's choice, Hackiwi will delete or return all personal data processed on the Customer's behalf at the end of the provision of the Service, and delete existing copies, unless Union or Member State law requires storage of the personal data.
Clause 10.2. The Customer may export its data through the Service at any time up to termination. Absent a written instruction to the contrary within 30 days of termination, Hackiwi will delete the data.
Clause 10.3. Deletion timetable: access is revoked immediately on termination; personal data is permanently deleted from live systems within 30 days; copies age out of encrypted backups within a further 30 days.
Clause 10.4. Hackiwi will confirm deletion in writing on request.
Compliance evidence and audits - Art. 28(3)(h)
Clause 11.1. Hackiwi makes available to the Customer all information necessary to demonstrate compliance with the obligations in Article 28 GDPR, on written request to [email protected].
Clause 11.2. Hackiwi allows for and contributes to audits, including inspections, conducted by the Customer or an auditor it mandates. Audits are limited to once in any twelve-month period unless a personal data breach has occurred or a supervisory authority requires otherwise, are conducted on at least 30 days' written notice and during normal business hours, must not unreasonably disrupt Hackiwi's operations, and are subject to confidentiality obligations.
Clause 11.3. The auditor must not be a competitor of Hackiwi. The Customer bears the cost of the audit, save where the audit reveals a material breach of this DPA by Hackiwi.
Clause 11.4. Where the information sought concerns a sub-processor's own controls, Hackiwi will provide the third-party reports and certifications that sub-processor makes available, which the parties agree is an appropriate way to satisfy the request in the first instance.
Clause 11.5. The Hackiwi platform source code is published under the AGPL-3.0 and may be independently reviewed at any time - a standing form of technical transparency that supplements, but does not replace, the rights in this section.
International transfers
Clause 12.1. Hackiwi does not transfer Customer personal data outside the European Economic Area except in accordance with Chapter V GDPR.
Clause 12.2. All international transfers are covered by the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914), module three (processor to sub-processor), together with the supplementary technical measures described in Annex II.
Clause 12.3. Cloudflare EU data localisation is available on request; contact [email protected] before onboarding if the Customer has a data residency requirement.
Clause 12.4. Where a transfer mechanism relied upon is invalidated, the parties will cooperate in good faith to put an alternative lawful mechanism in place without undue delay.
Liability, term and governing law
Clause 13.1. Each party's liability under this DPA is subject to the limitations and exclusions in section 11 of the Terms of Service, to the extent permitted by applicable law.
Clause 13.2. This DPA takes effect on acceptance of the Terms of Service and remains in force for as long as Hackiwi processes personal data on the Customer's behalf. Sections 5, 10, 11 and 13 survive its termination.
Clause 13.3. This DPA is governed by the laws of the Netherlands. The courts of Amsterdam have exclusive jurisdiction, without prejudice to any jurisdiction conferred on a supervisory authority or a court by the GDPR.
Clause 13.4. If any provision of this DPA is held invalid, the remainder stays in force and the parties will replace the invalid provision with a valid one having the nearest possible effect.
Contact
- Data protection, DPA countersignature, audit requests - [email protected]
- Personal data breach reports - [email protected]
- Commercial and data residency - [email protected]
Hackiwi B.V. is established in the Netherlands. Its registration details are:
- Legal entity
- Hackiwi B.V.
Annex I - Details of the processing
| Item | Detail |
|---|---|
| Subject matter | Provision of the Hackiwi security awareness platform to the Customer. |
| Duration | The term of the subscription, plus the deletion period in section 10. |
| Nature and purpose | Storage and display of training records; processing of phishing simulation results; OSINT and breach intelligence checks; sending transactional emails; audit logging of administrative actions. |
| Categories of personal data | Identity (names, email addresses); training (completion records, quiz results, progress); simulation (click and report events); security (breach check results, session data, IP addresses); audit (administrative action logs). |
| Categories of data subjects | Employees and contractors of the Customer with platform access. |
| Sensitive data | None. The Service is not designed to process Article 9 or Article 10 data. |
| Frequency of processing | Continuous, for the duration of the subscription. |
| Retention | Lifetime of the organisation account; permanent deletion within 30 days of account deletion; backups within a further 30 days. |
| Controller | The Customer. |
| Processor | Hackiwi B.V., the Netherlands. |
Annex II - Technical and organisational measures
The measures Hackiwi implements under Article 32 GDPR. These are the controls the platform enforces, not a statement of intent.
Encryption and key handling
- Encryption of data at rest (Cloudflare D1).
- Encryption in transit using TLS 1.2 or higher.
- Encrypted storage of all credentials and third-party API keys, which are never returned in any API response.
- Passwords stored only as salted one-way hashes, never in recoverable form.
Access control
- Role-based access control across five roles, from owner to viewer, with each function gated at the role it requires.
- Every database query is scoped to a single organisation, so one customer's data cannot be read by another.
- Least-privilege access for Hackiwi personnel, limited to those who need it to operate and support the Service.
- Support access to a customer tenant is explicit, time-limited, uses a structurally separate credential from an ordinary sign-in, and is recorded in the audit log.
Accountability and monitoring
- Audit logging of every administrative and security-relevant action, with actor, target, timestamp and source IP address.
- Audit records are retained independently of user records so that they survive a member's removal.
- Error monitoring with personal data stripped before transmission.
Session and authentication security
- Automatic session expiry, and explicit revocation on removal.
- Session cookies set HttpOnly, Secure and SameSite, so they are not readable by scripts and are not sent on cross-site requests.
- Rate limiting on authentication and other sensitive endpoints.
- Optional single sign-on (OIDC and SAML), allowing the Customer to enforce its own authentication policy.
Application and network security
- Input validation on every endpoint, with requests rejected before processing where they do not conform.
- Strict Transport Security, a restrictive Content Security Policy, and clickjacking and MIME-sniffing protections on every response.
- Cross-site request forgery protection on state-changing requests.
- Web application firewall and DDoS mitigation at the edge.
Resilience and organisational measures
- Managed, replicated infrastructure with encrypted backups, retained for up to 30 days.
- Organisation deletion is staged rather than immediate and irreversible, so that an erroneous deletion can be identified before data is destroyed.
- Confidentiality obligations on all authorised personnel.
- Change management through version control and peer review, with the source code published for independent inspection under AGPL-3.0.
- A published vulnerability disclosure contact: [email protected].
scope
Hackiwi does not currently hold an ISO 27001 certification or a SOC 2 report. Where a procurement process requires third-party assurance, the certifications and audit reports published by our infrastructure sub-processors are available, and the platform source code is open to direct review.
Annex III - Sub-processors
The sub-processors authorised under section 7 as at the date at the top of this document. The authoritative, continuously maintained list is published at hackiwi.com/subprocessors.
| Sub-processor | Country | Purpose | Data shared |
|---|---|---|---|
| Cloudflare, Inc. | USA (EU Standard Contractual Clauses) | Infrastructure, database, CDN, WAF | All platform data |
| Resend, Inc. | USA (EU Standard Contractual Clauses) | Transactional email | Email addresses, message content |
| Functional Software, Inc. (Sentry) | USA (EU Standard Contractual Clauses) | Error tracking | Error reports - personal data stripped before transmission |
Each sub-processor's own data processing terms: cloudflare.com/gdpr · resend.com/legal/dpa · sentry.io/legal/dpa.
Customer-controlled integrations - not sub-processors
These providers receive data only where the Customer connects its own API key. In doing so the Customer establishes a direct processing relationship with that provider, on that provider's terms, and Hackiwi is not that provider's controller or processor.
| Provider | Purpose | What is sent |
|---|---|---|
| Anthropic PBC | AI-assisted content generation | The prompts an administrator writes |
| Have I Been Pwned | Breach-exposure lookups | The domain or email address being checked |
| VirusTotal (Google) | URL and file reputation lookups | The web addresses being checked |
This document was prepared in good faith. Hackiwi recommends that customers seek independent legal advice regarding their own compliance obligations.