This Data Processing Addendum ("DPA") forms part of the Terms of Service (or other written agreement) between the customer organization ("Customer") and TAS Group LLC, a Wyoming limited liability company, operator of TasScan ("TAS Group"). It applies when TAS Group processes Customer Personal Data on Customer's behalf in providing the Service, and is effective from the date Customer first accepts the Terms or uses the Service. If this DPA conflicts with the Terms on the processing of personal data, this DPA controls.
1. Scope
This DPA applies to the processing of Customer Personal Data by TAS Group on behalf of Customer under the Terms. It does not apply to personal data for which TAS Group is itself a controller, which is described in the Privacy Policy.
2. Definitions
Terms such as "controller", "processor", "personal data", "processing", "personal data breach", "data subject" and "supervisory authority" have the meanings in the GDPR. In this DPA:
- "Customer Personal Data" means personal data contained in Customer Data that TAS Group processes as Customer's processor.
- "Data Protection Laws" means laws on privacy and data protection that apply to the processing, including Regulation (EU) 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, and U.S. state privacy laws such as the California Consumer Privacy Act as amended.
- "Subprocessor" means a third party engaged by TAS Group to process Customer Personal Data.
- "SCCs" means the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914.
- "UK Addendum" means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner, or any successor mechanism recognized under UK law.
3. Roles of the parties
As between the parties, Customer is the controller (or processor, where it processes on behalf of its own customers) and TAS Group acts as processor (and, under U.S. state privacy laws, as a service provider) when processing Customer Personal Data on Customer's behalf. Customer is responsible for the lawfulness of its instructions and for having a legal basis for the processing, including for scanning targets it is authorized to test and for any personal data that those targets expose.
4. Documented instructions
TAS Group will process Customer Personal Data only on Customer's documented instructions, which are the Terms, this DPA, the settings and configuration Customer selects in the Service, and any further reasonable written instruction that is consistent with the Terms. TAS Group will tell Customer if, in its opinion, an instruction infringes Data Protection Laws, and may suspend the instruction until it is clarified. TAS Group will not retain, use or disclose Customer Personal Data outside the direct business relationship for any purpose other than the business purposes specified in the Terms and this DPA, will not sell or share it (as those terms are defined under U.S. state privacy laws), and will not combine it with personal data from other sources except as permitted by law.
5. Customer obligations
Customer will: (a) comply with Data Protection Laws; (b) give TAS Group lawful instructions; (c) provide any notices and obtain any consents needed for the processing; (d) not submit special-category or regulated personal data to the Service unless agreed in writing; (e) use the security features of the Service appropriately (for example multi-factor authentication and role-based access); and (f) assess whether the Service's security measures meet its needs.
6. Confidentiality
TAS Group will ensure that persons authorized to process Customer Personal Data are bound by appropriate confidentiality obligations and receive access only as needed for their role.
7. Security measures
TAS Group implements technical and organizational measures designed to provide a level of security appropriate to the risk, as described in Annex II. These may be updated from time to time, provided the overall level of protection is not materially reduced.
8. Subprocessors
- General authorization. Customer gives TAS Group general authorization to engage Subprocessors, subject to this section.
- Categories. Subprocessors are engaged in these categories: cloud hosting and infrastructure; content delivery and attack protection; email delivery; object storage and encrypted off-site backup; payment processing; push-notification delivery; error monitoring; and uptime monitoring. A current list is available on request through the official contact page.
- Terms. TAS Group will bind each Subprocessor to data-protection obligations no less protective, in substance, than those in this DPA, and remains responsible for the Subprocessor's performance.
- Changes. TAS Group will give Customer at least 30 days' notice of a new or replacement Subprocessor (by email, in the product or by updating the list). Customer may object on reasonable data-protection grounds within that period. If the parties cannot resolve the objection, Customer may terminate the affected part of the Service and receive a pro-rata refund of prepaid fees.
9. Data subject requests
Taking into account the nature of the processing, TAS Group will provide reasonable assistance, through the features of the Service where possible, to enable Customer to respond to requests from data subjects to exercise their rights. If TAS Group receives such a request directly relating to Customer Personal Data, it will refer the person to Customer and will not respond except as instructed or as required by law.
10. Personal data breach notification
TAS Group will notify Customer without undue delay, and where feasible within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, to the extent known, the nature of the breach, the categories and approximate numbers of data subjects and records concerned, likely consequences, and measures taken or proposed. TAS Group will take reasonable steps to contain and investigate the breach and to give further information as it becomes available. Notice is not an admission of fault.
11. Regulatory assistance and DPIAs
TAS Group will give Customer reasonable assistance, taking into account the nature of the processing and the information available to TAS Group, with Customer's obligations on security, breach notification, data protection impact assessments and prior consultation with supervisory authorities. TAS Group may charge reasonable fees for assistance beyond what the Service and its documentation already provide.
12. Return and deletion
On termination or expiry of the Service, or on Customer's written request, TAS Group will delete or return Customer Personal Data as described in the Terms (including a restoration period, 30 days by default, after organization closure). Customer can export reports and findings from the Service before closure. TAS Group will delete remaining copies within a reasonable period after that, except where law requires retention or where records are kept to evidence authorization and investigate misuse as described in the Terms and Privacy Policy. Backups are deleted on their normal rotation and are protected until then.
13. Audits and information
TAS Group will make available to Customer the information reasonably necessary to demonstrate compliance with this DPA and Article 28 of the GDPR, including through documentation on its security measures and responses to reasonable security questionnaires. If that is not sufficient, Customer may, no more than once a year (or after a personal data breach, or as required by a supervisory authority), on at least 30 days' written notice, carry out or have an independent auditor bound by confidentiality carry out an audit of TAS Group's relevant controls, during business hours, in a manner that does not disrupt operations or compromise the security or confidentiality of other customers, and at Customer's expense.
14. International transfers
- Processing locations. TAS Group is based in the United States. Customer Personal Data may be processed in the United States, the European Union and other countries where TAS Group or its Subprocessors operate.
- EEA transfers. Where Customer Personal Data subject to the GDPR is transferred to TAS Group in a country that has not been recognized by the European Commission as providing an adequate level of protection, the parties incorporate the SCCs by reference as follows: Module Two (controller to processor) applies where Customer is a controller; Module Three (processor to processor) applies where Customer is a processor for its own customers. Clause 7 (docking) applies; in Clause 9 Option 2 (general authorization) applies with the notice period in section 8; in Clause 11 the optional language does not apply; in Clause 17 the governing law is the law of Ireland; in Clause 18 the courts of Ireland; Annex I is Annex I below, and Annex II is Annex II below, and the list of Subprocessors is available as described in section 8. Customer is the data exporter and TAS Group is the data importer. Where the SCCs are not required (for example because TAS Group relies on an adequacy decision or another valid mechanism), they do not apply.
- UK transfers. Where the UK GDPR applies, the UK Addendum applies to transfers of Customer Personal Data to TAS Group, and is incorporated by reference. The information required in its tables is in this DPA, with the SCCs as described in paragraph 2 and Annex I, and the parties choose neither party as the party that may terminate the Addendum on a change in the Approved Addendum, unless the Addendum requires otherwise. If the UK Addendum is replaced by a successor mechanism recognized under UK law, that mechanism applies.
- Switzerland. For transfers subject to the Swiss Federal Act on Data Protection, the SCCs apply with references to the GDPR read as references to that Act, the Swiss Federal Data Protection and Information Commissioner as the competent supervisory authority, and data subjects in Switzerland able to enforce their rights.
- Onward transfers. TAS Group will transfer Customer Personal Data to Subprocessors outside the EEA or UK only under a valid transfer mechanism.
- Order of precedence. If this DPA conflicts with the SCCs or the UK Addendum, those control.
15. U.S. state privacy laws
To the extent that Data Protection Laws of a U.S. state apply: TAS Group acts as a service provider or processor; processes Customer Personal Data only for the business purposes in the Terms and this DPA; will not sell or share it, retain, use or disclose it outside the direct business relationship, or combine it with other personal data except as permitted by law; will notify Customer if it can no longer meet its obligations; will give Customer the information needed to show compliance and allow reasonable steps to stop and remediate unauthorized use; and will require Subprocessors to meet equivalent obligations. TAS Group certifies that it understands and will comply with these restrictions.
16. Liability and term
Each party's liability under this DPA is subject to the limitations and exclusions in the Terms, except where law (including the SCCs) provides otherwise or where liability cannot lawfully be limited. This DPA lasts as long as TAS Group processes Customer Personal Data, and its terms survive as long as needed to fulfil its purpose.
17. Order of precedence and changes
If there is a conflict, the order is: the SCCs and UK Addendum (where they apply); this DPA; the Terms. TAS Group may update this DPA to reflect changes in law, in the Service or in Subprocessors by posting a new version, with notice as described in the Terms; a change does not reduce the protections of the SCCs or the UK Addendum. A countersigned copy is available on request through the contact page.
Annex I: Processing details
Parties. Data exporter: Customer (the organization that accepted the Terms). Data importer: TAS Group LLC, Wyoming, United States, operator of TasScan. Contact: through the official contact page at tasscan.com/contact.
Subject matter. TasScan cybersecurity services.
Duration. The term of the Service, plus the applicable retention period described in the Privacy Policy and this DPA.
Nature and purpose of processing. Hosting, scanning, monitoring, reporting, storage, logging, support and administration of the Service, as instructed by Customer.
Frequency of transfer. Continuous, for the duration of the Service.
Categories of data subjects may include: Customer's employees, administrators, contractors and users; technical contacts; Customer's clients; and individuals whose data is incidentally visible in authorized target systems.
Categories of personal data may include: contact data; user IDs; IP addresses; activity information; authentication events; scan evidence; system logs; and support communications.
Sensitive data. None is intended. Scan evidence may incidentally expose sensitive data; the Service is designed to minimize and redact common secrets, and Customer must not direct the Service to collect special-category data.
Retention. As set out in the Privacy Policy and section 12 above.
Competent supervisory authority (for the SCCs): the authority of the EU Member State in which Customer is established or, if none, where its representative is established or where the data subjects are, and, for the UK Addendum, the UK Information Commissioner.
Annex II: Security measures
TAS Group applies measures designed to provide appropriate security. They are described at a high level and may include:
- Access control: role-based access; separation of customer, administrator and system roles; row-level isolation of customer data in the database; multi-factor and passkey authentication options; session controls and lockouts; administrator access limited to named personnel.
- Encryption and credentials: encryption in transit using TLS; hashed passwords using a memory-hard algorithm; encrypted backups before they leave the servers; secrets held outside source code.
- Network and application security: network-safety controls that block private and restricted ranges; rate limiting; security headers and a content security policy; dependency and image scanning in the build process.
- Logging and monitoring: audit logging of security-relevant actions; error monitoring; alerting on selected failures.
- Data minimization: redaction of common secrets in stored evidence; limited retention periods.
- Resilience: backups, with restoration testing as part of operations; incident response procedures.
- Organizational measures: confidentiality obligations; access on a need-to-know basis; vendor review of Subprocessors.
These measures do not constitute a guarantee of any particular outcome or a certification against any standard. TAS Group does not claim certifications it has not obtained.
Annex III: Subprocessors
Categories are listed in section 8. The current list of named Subprocessors and their processing locations is available on request through the contact page and is updated in accordance with section 8.