Data processing agreement

under Article 28 of Regulation (EU) 2016/679 (GDPR)

1. Parties and conclusion

• Controller: the customer of the rexguard service.
• Processor: Datarex s. r. o., Trieda SNP 1534/22, 974 01 Banská Bystrica, Slovakia, Company ID 53058968.

The agreement is concluded by accepting it at sign-up or with an order, and is part of the contract for the rexguard service under the Terms of Service.

2. Subject matter and duration

The subject matter is the processing of the personal data of the visitors of the controller's sites in providing the rexguard service. The processing lasts for the duration of the service contract and, after it ends, until the retention periods in article 12 expire.

3. Nature and purpose of the processing

The processor's nodes receive visitors' requests to the controller's sites, check them (attack signatures, reputation lists, the controller's rules and limits, a browser check, detection of unusual traffic, the bot model), stop dangerous ones and pass the others on to the controller's server. They record the requests for the sites' security, statistics and troubleshooting for the controller, and obtain certificates for the sites' domain names.

4. Categories of personal data

• the visitor's IP address and port, and the country and network (ASN) derived from it,
• the time of the request, the parameters of the encrypted connection and their fingerprint (JA4),
• the domain name, the path and query, the browser (user agent), the referring page (referer),
• the sizes and status of the response and the protection's decision,
• the rexguard_pass cookie after a browser check (24 hours).

The content of requests and responses (including headers and cookies) passes through the nodes and is checked, but not stored. If the controller's sites process special categories of personal data, such data may pass through in this way.

5. Categories of data subjects

Visitors of the controller's sites, including its employees and the users of its sites.

6. The controller's instructions

The processor processes personal data only on the controller's documented instructions. The instructions are this agreement, the Terms of Service and the site settings the controller makes in the portal. If the processor considers an instruction to infringe the law, it tells the controller without delay. Transfers to third countries happen only under article 14.

7. Confidentiality

The persons at the processor with access to personal data are bound by confidentiality.

8. Security

The processor takes measures under Article 32 GDPR, in particular:

• encryption (TLS) between visitors and the nodes and, as the controller sets it, between the nodes and its server,
• access to data only for the service's administrators,
• encrypted storage of certificate keys,
• pseudonymization of data kept for more than 14 days (article 12),
• automatic deletion when retention periods end.

9. Sub-processors

The controller gives the processor general authorization to engage sub-processors. For processing visitors' data, the processor currently engages no one else; it operates the servers itself. The processor tells the controller at least 30 days in advance of an intended addition or replacement of a sub-processor; the controller may object and end the contract before the change takes effect. The processor binds a sub-processor to the same obligations as this agreement.

10. Assistance to the controller

The processor assists the controller:

• with data subjects' requests (records with IP addresses are available for 14 days),
• with the security of the processing, data protection impact assessments and prior consultation,
• with a personal data breach: it notifies the controller without undue delay after becoming aware of it, with the information under Article 33(3) GDPR available to it.

11. Data used to protect all sites

To protect all the sites the service protects, the processor also uses traffic data of the controller's sites:

• IP addresses attacking any site are blocked on all sites until 24 hours after their last attack,
• the bot model learns from pseudonymized data (article 12), and normal traffic is established to detect unusual traffic.

In this processing the processor sets the purpose itself and acts as a controller, on its legitimate interest in network and information security. [to confirm: Datarex's role in this processing]

12. Retention and the end of processing

• records of requests with IP addresses: 14 days,
• pseudonymized records: 1 year (the IP address replaced by a keyed hash whose key changes every month and is destroyed 3 days after the month ends; what remains is the /24 or /48 network, country, ASN, the connection's fingerprint, the browser, the domain name, the path, the names of query parameters without their values, and the referring page's domain),
• aggregate statistics without IP addresses: 1 year.

When the controller removes a site or the contract ends, the nodes stop serving the site at once and no new data arises. Data already recorded is deleted automatically when these periods end; earlier deletion or return of these records is not offered. [to confirm: compliance with Article 28(3)(g) GDPR] The protected sites' domain names remain in the public certificate logs (Certificate Transparency).

13. Information and audits

The processor makes available to the controller the information necessary to demonstrate compliance with Article 28 GDPR and allows audits, including inspections, by the controller or an auditor it mandates, with the date and scope agreed in advance.

14. Transfers to third countries

The service's servers are in Slovakia; the processor doesn't transfer visitors' data outside the European Economic Area.

15. Final provisions

The agreement is governed by the laws of the Slovak Republic. Changes to the agreement follow the procedure for changes to the Terms of Service. The processor's contact: info@rexguard.app.