Data processing
addendum.

The short version.

• You control your data. We process it only to deliver the services, on your instructions.
• We give notice before adding a subprocessor, report a breach within 48 hours, and delete your data within 30 days after the end.
• EU, UK and Swiss transfers are covered by the Standard Contractual Clauses.

1. What this is.

This Data Processing Addendum (“DPA”) is part of the agreement between YellowForce Inc. (“YellowForce”, “we”) and the client named in it (“Client”, “you”), made of the signed order or engagement agreement and our Terms of Service (together, the “Agreement”). It applies whenever we process Client Personal Data. No separate signature is needed: signing the Agreement accepts this DPA.

2. Definitions.

• Client Personal Data: personal data we access, receive or store from your systems to deliver the services.
• Data Protection Laws: laws that apply to that processing, including the EU GDPR, the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection (FADP), and the California Consumer Privacy Act as amended by the CPRA, with its regulations (CCPA).
• Security Incident: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Client Personal Data.
• Subprocessor: a third party we engage that processes Client Personal Data.
• Other terms (“controller”, “processor”, “service provider”, “sell”, “share” and so on) mean what the GDPR or the CCPA says.

3. Roles and scope.

• You are the controller (and the “business” under the CCPA). We are your processor (and your “service provider”).
• If you act as a processor for someone else, we are your subprocessor, and you confirm that your controller has authorized our processing.
• Annex 1 describes the processing. You are responsible for having a lawful basis for it, including any notice to or consent from your staff that the law requires.

4. Instructions.

• We process Client Personal Data only on your documented instructions. Your instructions are: the Agreement, this DPA, the access your administrator grants, and any other written instructions from your authorized contacts that are consistent with the Agreement.
• We take response actions (such as disabling an account or isolating a device) only when you have authorized them, as the Agreement describes.
• If we think an instruction breaks Data Protection Laws, we will tell you and may pause that instruction until we agree on how to proceed.
• If the law requires us to process Client Personal Data in another way, we will tell you first, unless the law forbids it.

5. Our people.

• Only people who need access to deliver your services get it, and only for the clients they work on.
• Each is bound by written confidentiality duties that continue after their work ends, and trained on handling client data.
• Some of our engineers are based in India. They access data remotely on our systems, under the same rules.

6. Security.

We keep in place the measures in Annex 2, and review them at least once a year. We may improve them over time, but we will not lower the overall level of protection during your Agreement.

7. Subprocessors.

• You authorize us to use the subprocessors listed in Annex 3, which we keep current at https://yellow-force.com/dpa/#subprocessors.
• Before we add or replace a subprocessor, we update that list and email your notice contact at least 30 days in advance (or as soon as possible if we need to replace one urgently for security reasons).
• You may object on reasonable data protection grounds within that notice period. We will then work with you in good faith on a fix. If we can’t find one, you may end the affected services and receive a refund of prepaid fees for the unused period.
• Each subprocessor is bound by a written contract with data protection duties at least as protective as this DPA, including a ban on using Client Personal Data to train AI models. We remain responsible for our subprocessors.

8. Helping you.

• Data subject requests. If a person contacts us about Client Personal Data, we pass the request to you without undue delay and don’t answer it ourselves unless you tell us to. We help you answer requests to access, correct, delete, restrict, port or object, taking into account what we can technically do.
• Assessments and regulators. We give you reasonable information and help for data protection impact assessments and consultations with regulators about our services.
• Government requests. If an authority asks us for Client Personal Data, we redirect it to you where we can, tell you unless the law forbids it, and disclose only the minimum required.

9. Security Incidents.

• We notify you without undue delay, and within 48 hours of becoming aware of a Security Incident.
• The notice says, as far as we know at that time: what happened, the data and people affected, likely consequences, what we have done and will do, and a contact person. We send updates as we learn more.
• We take reasonable steps to contain and fix the incident and help you meet your own notification duties.
• Our notice is not an admission of fault.

10. Return and deletion.

• When the Agreement ends, we disable our credentials for your systems straight away.
• If you ask within 30 days of the end date, we return Client Personal Data in a standard, machine-readable format.
• We delete Client Personal Data, including backups, within 30 days of the end date, and confirm deletion in writing if you ask.
• We may keep data only if the law requires it. Then we keep it confidential, protected by this DPA, and use it for nothing else.

11. Audits.

• On request, once a year, we give you information that shows we comply with this DPA: our security documentation, completed questionnaires, and any independent audit reports or certifications we hold.
• If that is not enough to show compliance, or a regulator requires it, or after a Security Incident, you may audit us, yourself or through an independent auditor bound by confidentiality. Audits need 30 days’ written notice, take place during business hours, are limited to what is needed, must not put other clients’ data at risk, and are at your cost. Outside these special cases, one audit per year.

12. International transfers.

• EU. Where we process Client Personal Data from the European Economic Area in a country without an adequacy decision, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (the “SCCs”) apply and are incorporated by reference. Module 2 (controller to processor) applies where you are a controller, and Module 3 (processor to processor) where you are a processor. For the SCCs: the docking clause (Clause 7) is included; Clause 9(a) Option 2 (general authorization) applies, with the notice period in section 7; the optional language in Clause 11 is not used; Clauses 17 and 18 choose Irish law and the courts of Ireland; and Annexes I and II of the SCCs are completed by Annexes 1 and 2 of this DPA, with the competent supervisory authority determined under Clause 13.
• UK. For transfers from the UK, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, version B1.0, issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018 (the “UK Addendum”), applies and is incorporated by reference. Its tables are completed with the details in this DPA, and either party may end it as its Table 4 allows.
• Switzerland. For transfers from Switzerland, the SCCs apply with these changes: the Swiss Federal Data Protection and Information Commissioner (FDPIC) is the competent supervisory authority for those transfers; references to the GDPR include the FADP; and the term “Member State” must not be read to stop people in Switzerland from bringing claims where they normally live.
• Order. If the SCCs or the UK Addendum conflict with this DPA, they win.
• Onward transfers. We make onward transfers to subprocessors only with appropriate safeguards in place.

13. CCPA service provider terms.

For Client Personal Data that the CCPA covers, we:

• will not sell or share it;
• process it only for the business purposes in Annex 1, which you are disclosing it to us for;
• will not retain, use or disclose it for any other purpose, including any other commercial purpose, or outside our direct business relationship with you, except as the CCPA allows;
• will not combine it with personal information we receive from others or collect ourselves, except as the CCPA allows for service providers;
• will comply with the CCPA and give it the same level of privacy protection the CCPA requires of you, including reasonable security;
• will tell you if we decide we can no longer meet our CCPA duties;
• will help you answer consumer requests, as section 8 describes.

You may take reasonable and appropriate steps to make sure we use the data in line with your CCPA duties (section 11), and, on notice, to stop and fix any unauthorized use. We understand and will comply with these restrictions.

14. Google and Microsoft data.

• Data we receive through Google APIs is also subject to the Google API Services User Data Policy and the Google Workspace User Data and Developer Policy, including their Limited Use requirements. Our Privacy Policy sets out how we meet them. Where those rules are stricter than this DPA, we follow them.
• Data we receive through Microsoft APIs (including Microsoft Graph and the Defender APIs) is also subject to the Microsoft APIs Terms of Use, including the ban on advertising and marketing use and the duty to return or delete data on your instructions.

15. Liability and order of documents.

• Each party’s liability under this DPA is subject to the limits and exclusions in the Agreement, except where the SCCs or Data Protection Laws do not allow that.
• If this DPA and the Agreement conflict on data protection, this DPA wins.
• This DPA lasts as long as we process Client Personal Data.

Annex 1: Description of processing.

• Parties. Data exporter: the Client (controller or processor), contact as in the Agreement. Data importer: YellowForce Inc. (processor), 825 Geary St, Apt 1400, San Francisco, CA 94109, USA, privacy@yellow-force.com.
• Data subjects. The Client’s employees, contractors and other users of its systems, and people who communicate with them or appear in its logs.
• Categories of data. Identity and account data (names, work emails, usernames, roles, groups); device and network data (device identifiers, IP addresses, locations derived from IP); activity data (sign-ins, audit logs, cloud and application events); security data (alerts, incidents, findings); and, only where the Client enables it, email and file metadata and content.
• Special categories. Not intended. Email and file content may contain them incidentally. They get the same protections, with access limited to specific investigations.
• Frequency. Continuous, for the term of the Agreement.
• Nature and purpose (business purposes). Monitoring, detection, investigation of and response to security threats in the Client’s systems; reporting through the dashboard; maintaining and securing the service. AI-assisted analysis is part of this.
• Retention. As set in the Agreement or our Privacy Policy, and deleted within 30 days after the end (section 10).
• Subprocessors. As in Annex 3, for hosting and AI-assisted analysis, for the term of the Agreement.

Annex 2: Security measures.

1. Least privilege. Read-only access by default; we request only the permissions the services need, and ask separately for any write permission needed for response actions.
2. Scoped connections. Cross-account roles with an external ID (AWS), admin-consented apps and delegations (Microsoft, Google, GitHub), and scoped tokens (Cloudflare and others). No shared passwords to client accounts.
3. Per-client secret vault. Each client’s credentials and tokens sit in a separate, encrypted vault, readable only by the services and people working on that client.
4. Encryption. TLS 1.2 or higher in transit. AES-256 or equivalent at rest, with keys in a managed key service.
5. Multi-factor authentication on every account that can reach client data or our infrastructure.
6. Access logging. We log who accessed which client’s data, when and what they did, keep those logs protected from change, and show actions on client systems in the dashboard.
7. Separation. Client data is separated by client in storage and in processing.
8. People. Confidentiality agreements, yearly security training, access removed the day someone leaves or changes role.
9. AI. Providers process data only to return results, with no training on it. Human review before any response action.
10. Hygiene. Managed, encrypted, patched staff devices; regular vulnerability scanning of our systems.
11. Incident response. A documented plan, tested yearly, including the 48-hour client notice.
12. Revocation at the end. Credentials disabled when an engagement ends; data deleted within 30 days, including backups.