Data Processing Agreement

This Data Processing Agreement ("DPA") forms an integral part of the Terms and Conditions of Cruxa and applies to every Scan performed by Cruxa on behalf of Client.

1. Parties and roles

1. Data Controller: Client (the party requesting and confirming the Scan).
2. Data Processor: Cruxa, a sole proprietorship operating under the name Cruxa, registered in the Netherlands and listed in the Dutch Commercial Register (Chamber of Commerce) under number 42044115.
3. Cruxa processes personal data exclusively on behalf of and for the benefit of Client, in accordance with this DPA and Client's written instructions.
4. If, in Cruxa's opinion, an instruction from Client infringes the GDPR or other applicable data protection legislation, Cruxa will inform Client thereof without delay.

2. Purpose and legal basis

1. Processing takes place for the execution of the automated security scan as described in the Terms and Conditions.
2. The legal basis is the performance of the agreement between Cruxa and Client (Article 6(1)(b) GDPR) and Client's legitimate interest in securing their systems (Article 6(1)(f) GDPR).

3. Categories of personal data

The processing concerns the following categories of data subjects: (i) the contact person(s) of Client, and (ii) data subjects whose personal data is inadvertently encountered in Client's tested systems, such as end users, customers, or employees of Client.

3.1 Client contact data

Processed for the execution of the agreement:

3.2 Data encountered during the Scan

During a security scan, Cruxa may inadvertently encounter personal data in Client's systems, such as:

4. Sub-processors

Cruxa uses the following sub-processors:

1. By accepting this DPA, Client consents to the use of the above sub-processors.
2. Cruxa will inform Client of changes to the sub-processor list. Client has the right to object within 14 days of notification.
3. Cruxa ensures each sub-processor is bound by an agreement containing at minimum the same obligations as this DPA.

5. Security measures

Cruxa implements the following technical and organizational measures to protect personal data:

5.1 Technical

• Encrypted connections (TLS 1.2+) for all communication
• Encrypted storage of sensitive data (at-rest encryption)
• Separation of client data per Scan (no shared storage between engagements)
• Automatic deletion of scan data after the retention period
• Secured access to systems via SSH keys and two-factor authentication
• Regular updates of all software and dependencies
• Technical PII redaction on scan data sent to external processors (including AI models): personal data in scan results is automatically replaced with typed placeholders before leaving the processing environment. This reduces exposure but does not guarantee complete elimination of all personal data

5.2 Organizational

• Access to client data is limited to Cruxa staff who require it for execution
• All staff are bound by confidentiality obligations
• No use of client data for training AI models — contractually agreed with all sub-processors, supplemented by technical PII redaction (see 5.1)
• Annual review of security measures

6. Retention periods

7. Data subject rights

1. Client, as data controller, is the primary point of contact for data subjects wishing to exercise their rights (access, rectification, erasure, restriction, portability, objection).
2. Cruxa will assist with data subject requests forwarded by Client, within 10 business days.
3. If a data subject contacts Cruxa directly, Cruxa will refer them to Client and inform Client accordingly.

8. Data breach notification

1. Cruxa will report any data breach involving personal data of Client or their data subjects within 24 hours of discovery, via email to the address provided during onboarding.
2. The notification will include at minimum:
   1. the nature of the breach;
   2. the (estimated) categories and numbers of personal data records affected;
   3. the likely consequences;
   4. the measures taken or proposed by Cruxa to mitigate the breach.
3. Notification to the supervisory authority and/or data subjects is the responsibility of Client as data controller.

9. Audits

1. Client has the right, upon written notice with a reasonable period of at least 14 days, to audit compliance with this DPA.
2. Cruxa will cooperate with such an audit and provide all relevant information.
3. Audit costs are borne by Client, unless the audit reveals a material breach by Cruxa.

10. International transfers

1. Personal data is preferably processed within the European Economic Area (EEA).
2. For sub-processors outside the EEA (Resend, Anthropic), EU Standard Contractual Clauses (SCCs) apply in accordance with Commission Implementing Decision (EU) 2021/914.
3. Cruxa conducts a Transfer Impact Assessment for each non-EEA sub-processor and applies supplementary technical measures where necessary (encryption, pseudonymization).

11. Termination

1. Upon termination of the agreement, Cruxa will delete all personal data in accordance with the retention periods in article 6, unless statutory retention obligations apply.
2. Client may request a copy of their data at any time (subject to the retention period) via [email protected].
3. Cruxa will confirm deletion in writing upon Client's request.

12. Final provisions

1. In case of conflict between this DPA and the Terms and Conditions, this DPA prevails with regard to the processing of personal data.
2. This DPA is governed by Dutch law.
3. Amendments to this DPA are communicated in the same manner as amendments to the Terms and Conditions. The version in effect at the time of Client's confirmation remains applicable to that specific agreement.
4. The current version is always available at cruxa.io/dpa.