1. Parties, subject matter and roles
1.1 This Data Processing Agreement (the "DPA") is concluded between the business that accepts the Kernwatch Terms of Service (the "Customer", controller) and Strandfors Oy, Teollisuuskatu 6, 64260 Kaskinen, Finland, Business ID 3542266-8 (the "Provider", processor). Terms defined in the Terms of Service (the "Terms") have the same meaning here; "GDPR" means Regulation (EU) 2016/679.
1.2 This DPA applies to personal data that the Provider processes on the Customer's behalf when providing the Service, in particular personal data in the Customer's Workspace ("Customer Personal Data"). The details of the processing are set out in Annex 1.
1.3 This DPA does not apply to personal data that the Provider processes as a controller for its own purposes - for sign-up, login, billing, communication about the Service and the security of its systems. That processing is described in the privacy policy.
1.4 The Customer is responsible for the lawfulness of the processing, including the legal basis for collecting the Customer Personal Data and for the notices it decides to send through the Service, and for informing data subjects.
2. Instructions
2.1 The Provider processes Customer Personal Data only on documented instructions of the Customer, including with regard to transfers to third countries, unless EU or Member State law requires otherwise; in that case the Provider informs the Customer of that legal requirement before processing, unless the law prohibits this.
2.2 The Terms, this DPA and the Customer's use and configuration of the Service (for example inviting Users, approving notices, publishing advisories) are the Customer's complete instructions at the time the DPA is concluded. Further instructions must be given in writing (email is sufficient) and must be compatible with the Service.
2.3 The Provider informs the Customer without undue delay if, in its opinion, an instruction infringes the GDPR or other data protection law.
3. Confidentiality
The Provider ensures that persons authorised to process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that they process the data only as necessary to provide the Service.
4. Security of processing
4.1 The Provider implements the technical and organisational measures described in Annex 2 to ensure a level of security appropriate to the risk (Art. 32 GDPR).
4.2 The Provider may develop the measures further, provided that the overall level of security is not reduced.
5. Sub-processors
5.1 The Customer gives the Provider general authorisation to engage the sub-processors listed in Annex 3.
5.2 The Provider informs the Customer by email to the Workspace owner at least 30 days before adding or replacing a sub-processor, and updates Annex 3. The Customer may object to the change on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may terminate the affected Service before the change takes effect; fees paid in advance for the period after the termination are refunded.
5.3 The Provider imposes on each sub-processor, by contract, data protection obligations that offer at least the same level of protection as this DPA, and remains liable to the Customer for the performance of the sub-processor's obligations.
6. Transfers outside the EEA
The Provider itself processes Customer Personal Data in Finland. Where a sub-processor processes Customer Personal Data outside the European Economic Area, the transfer takes place in accordance with Chapter V GDPR - where applicable, on the basis of the European Commission's standard contractual clauses or an adequacy decision.
7. Assistance with data subject requests
7.1 Taking into account the nature of the processing, the Provider assists the Customer by appropriate technical and organisational measures in responding to requests from data subjects exercising their rights under Chapter III GDPR. The Service lets the Customer view, correct and delete most Customer Personal Data itself.
7.2 If a data subject contacts the Provider directly about Customer Personal Data, the Provider refers them to the Customer and informs the Customer without undue delay, without responding to the request itself unless the Customer instructs it to.
8. Further assistance
Taking into account the nature of the processing and the information available to it, the Provider assists the Customer in ensuring compliance with its obligations under Articles 32 to 36 GDPR - security of processing, notification of personal data breaches, data protection impact assessments and prior consultation of the supervisory authority. For assistance that goes beyond providing the information available to the Provider, the Provider may charge reasonable costs agreed with the Customer in advance.
9. Personal data breaches
9.1 The Provider notifies the Customer of a personal data breach concerning Customer Personal Data without undue delay and no later than 48 hours after becoming aware of it, by email to the Workspace owner.
9.2 The notification describes, as far as the information is available, the nature of the breach including the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed to address the breach and mitigate its effects, and a contact point. Information that is not yet available is provided as soon as it is.
9.3 The Provider takes the measures necessary to contain the breach and mitigate its effects without delay. Notifying the supervisory authority and the data subjects remains the Customer's responsibility as controller; the Provider supports it as described in section 8.
10. Audits
10.1 The Provider makes available to the Customer the information necessary to demonstrate compliance with Art. 28 GDPR, in particular this DPA, the description of the measures in Annex 2 and written answers to reasonable questions.
10.2 If that information is not sufficient, or if a supervisory authority requires it, the Customer may carry out an audit, including an inspection on site, itself or through an independent auditor bound to confidentiality. Audits are announced in writing at least 30 days in advance, take place during normal business hours, are limited to once per year unless there has been a personal data breach or an authority requires it, and must not give access to other customers' data or unduly disrupt the Provider's operations. The Customer bears the costs of the audit, including the Provider's reasonable internal costs.
11. Deletion and return
11.1 Until the contract ends, the Customer can export Customer Data with the export functions of its Plan, and request it in a common machine-readable format as described in section 12.1 of the Terms.
11.2 The Provider deletes the Customer Personal Data 7 days after the contract ends, unless EU or Member State law requires the Provider to store it.
12. Term, liability and precedence
12.1 This DPA applies for as long as the Provider processes Customer Personal Data under the Terms.
12.2 The liability of the parties under this DPA is governed by section 14 of the Terms. The liability of the parties towards data subjects under Art. 82 GDPR is not affected.
12.3 In the event of a conflict between this DPA and the Terms regarding the processing of Customer Personal Data, this DPA prevails. Changes to this DPA are made as described in section 17 of the Terms. Governing law and jurisdiction follow section 19 of the Terms.
13. Contact
Data protection questions and notices under this DPA: Strandfors Oy (Kernwatch), info@kernwatch.com, Teollisuuskatu 6, 64260 Kaskinen, Finland.
Annex 1 - Details of the processing
| Subject matter | Provision of the Kernwatch Service under the Terms. |
|---|---|
| Duration | The term of the Terms, plus the 7-day deletion period after the contract ends. |
| Nature of the processing | Storage, organisation, retrieval, display and comparison of data; sending emails; publishing content on the Customer's instruction; erasure. |
| Purposes | Providing the Service to the Customer: managing the members of the Workspace and their roles; SBOM and vulnerability management; the CRA reporting workflow with deadlines, sign-off and record of filing; receiving vulnerability reports through the Customer's disclosure page; sending notifications, invitations and the notices to customers and users that the Customer has approved; keeping an audit trail; support. |
| Categories of data subjects | Users of the Customer's Workspace and invited persons; the Customer's customers, users and other contacts entered in the Service; persons who report vulnerabilities through the Customer's disclosure page; other persons named in Customer Data (for example authors, suppliers' contacts or persons named in reports and documents). |
| Categories of personal data | Names, email addresses, company and role; Workspace membership, role and invitation data; audit trail entries (who did what and when), approvals and sign-offs; the content of vulnerability reports and of notices; other personal data contained in the files and texts the Customer stores (for example SBOMs and technical documentation). |
| Special categories of data | None. The Service is not intended for special categories of personal data (Art. 9 GDPR) and the Customer must not enter them. |
| Place of processing | Finland (the Provider); sub-processors as listed in Annex 3. |
Annex 2 - Technical and organisational measures
- Encryption in transit: the website, the application and the API are only available over HTTPS (TLS).
- Separation of customers: all customers share one multi-tenant environment; every Workspace is separated by access checks on every query, so that Users can only see the data of the Workspaces they are members of.
- Access control: role-based permissions within the Workspace (owner, admin, editor, viewer); members, invitations and API keys are managed by the owner and admins and can be revoked at any time.
- Authentication: passwords are stored only as bcrypt hashes and must meet a password policy; optional two-factor authentication for every User; email confirmation codes are stored only as salted hashes, expire after 15 minutes and allow a limited number of attempts; API keys and share-link tokens are stored only as SHA-256 hashes.
- Protection against abuse: rate limits on sign-up, invitation lookups and public forms; automated form submissions are filtered.
- Integrity and traceability: an audit trail records the steps of the CRA reporting workflow (for example changes of deadlines, sign-offs, filings and notices); filing and publishing require an approval in the Service.
- Availability: the data is replicated to a second server operated by the Provider.
- Data minimisation: public vulnerability sources receive only identifiers of software components and vulnerabilities, never personal data; the website uses no tracking cookies or analytics; server logs are deleted after 7 days; card data is handled only by the payment provider.
- Organisational measures: access to the production systems is limited to authorised personnel of the Provider who are bound to confidentiality; personal data breaches are handled as described in section 9.
Annex 3 - Sub-processors
| Sub-processor | Purpose | Location and transfer safeguards |
|---|---|---|
| Google (Google Workspace) | Delivery of the emails sent by the Service: sign-up codes, invitations, notifications, digests and the notices the Customer has approved (recipient addresses, names and email content). | EU/EEA and other countries where Google operates; where applicable, standard contractual clauses or an adequacy decision. |
| Stripe Payments Europe, Limited (Ireland) | Card payments for paid Plans (name, email address, company and billing details of the paying Customer). | Ireland; where Stripe processes data outside the EEA, standard contractual clauses or an adequacy decision, where applicable. |
Public vulnerability sources (OSV, the CISA Known Exploited Vulnerabilities catalogue, the ENISA EU Vulnerability Database) are not sub-processors: they receive only identifiers of software components or vulnerabilities and no personal data.