Data processing agreement for the beta

Parties

On the one part, HODEITEK S.L., with NIF B56478027, registered office at Markole, Aretxabaleta, 20550, Gipuzkoa, Spain, registered in the Commercial Registry of Gipuzkoa, Sheet SS-46529, Volume 3121, Folio 144, represented by the person who signs on its behalf. Hereinafter, “Hodeitek” or “the Processor”.

Data protection contact: privacy@hodeitek.com. Security and incident contact: security@hodeitek.com.

On the other part, the organisation that has applied to take part in the beta, with the identification, representation and contact details (company name, NIF, registered office, representative, contact email for this agreement and, where applicable, data protection officer) given in its beta application and in Hodeitek's admission email. Hereinafter, “the Customer”.

The Customer signs in one of these two capacities (tick one):

• ☐ Direct route. The Customer is an end organisation and acts as controller. Hodeitek acts as processor.
• ☐ MSSP route. The Customer is an MSSP partner acting as processor for its own customers (who are the controllers). Hodeitek acts as sub-processor. Part II also applies.

Hodeitek and the Customer acknowledge that they have the capacity to sign this agreement and, to that end, state the following:

Recitals

1. Hodeitek runs the beta programme of the HodeiShield platform, the terms of which are published at hodeishield.com (hereinafter, “the Beta Terms”). The Beta Terms, Hodeitek's admission email and this agreement form the participation agreement.

2. The Beta Terms provide that the data the participant uploads to the platform is processed by Hodeitek as processor, under a processing agreement compliant with Article 28 of Regulation (EU) 2016/679 (“GDPR”), signed when the beta account is created and before personal data is uploaded.

3. This agreement fulfils that commitment. It is governed by the GDPR, Organic Law 3/2018 (“LOPDGDD”) and any other applicable legislation.

1.Definitions

The terms of the GDPR (controller, processor, personal data, processing, personal data breach, etc.) have the meaning given in Article 4 GDPR. In addition:

• Platform: the HodeiShield service, accessible at app.hodeishield.com, with its APIs, the endpoint agent and the other components that Hodeitek makes available to the Customer during the beta.
• Customer Data: the personal data that the Customer, its users or its systems enter into the Platform, or that the Platform generates from such data on behalf of the Customer, described in clause 5.
• Beta: the period of the Customer's participation in the programme, which according to the Beta Terms lasts 3 months from acceptance of the Customer's place, and never before 2 November 2026; applications close on 31 December 2026.
• Sub-processor: the third party that Hodeitek uses to process Customer Data (Annex II).
• Documented Instructions: those in clause 6.

2.Subject matter and scope

2.1. This agreement governs the processing of Customer Data that Hodeitek carries out on behalf of the Customer in order to provide the Platform during the beta, and the subsequent return and deletion period.

2.2. Outside the subject matter. The following data is not part of this engagement, because Hodeitek processes it as controller, as stated in the Beta Terms and in the console's privacy notice:

• the data in the application to take part in the beta (governed by the hodeishield.com privacy policy);
• the data of the console's user accounts, authentication, access and security logs and, if the service is purchased from the console, billing (governed by the console's privacy notice, app.hodeishield.com/privacy);
• the error and crash reports that the endpoint agent (and, separately, the console) sends to Sentry (Functional Software, Inc.). Hodeitek processes them as controller, to diagnose and fix faults in the Platform, on the basis of its legitimate interest in the continuity and quality of the service (Article 6(1)(f) GDPR). Those of the agent contain the error message and stack trace, the agent version, the environment, the operating system and kernel version and the architecture; the IP address of the connection reaches Sentry's servers, and the reports do not include the results of the checks. Those of the console are described in Annex I, section I.11. They are kept for 90 days. The agent's reports are on by default in the published binaries, and each machine can switch them off with the marker file /etc/hodei-shield/telemetry-off (Linux and macOS) or %ProgramData%\Hodei-Shield\telemetry-off (Windows), or with HODEI_SENTRY_DSN=off, as the agent documentation describes; the console's reports have no per-customer switch (Annex II, Sentry detail). Hodeitek gives information about this processing in the console's privacy notice. For these reports Sentry is a provider of Hodeitek, not a sub-processor of the Customer (Annex II, rows 5 and 6).

2.3. If any of the data described in 2.2 also appears within Customer Data (for example, the name of a user as the author of an item of evidence or as the person responsible for a risk, or an audit log entry that records a change to Customer Data), that specific use is processed in accordance with this agreement.

3.Duration

3.1. This agreement enters into force on the date of the last signature and, in any case, before the Customer uploads real personal data. Without a signed agreement, the Customer may only use test data that involves no real persons.

3.2. It lasts for the duration of the Customer's beta, plus the return and deletion period in clause 15.

3.3. The obligations of confidentiality, security and deletion remain in force for as long as Hodeitek or its Sub-processors retain any Customer Data, including backups until they expire.

3.4. Relationship with the paid-service contract. This agreement governs the processing of Customer Data during the beta and the 30 days after it ends (clause 15.1). If the Customer moves to a paid contract, processing during the paid service is governed by the processing agreement for that service, the one that Hodeitek signs directly with the paying customer, which replaces this agreement from the moment the Customer accepts it; until then this agreement continues to apply to Customer Data. This agreement does not regulate the paid service.

4.Nature and purpose of the processing

4.1. Nature: hosting, storage, organisation, consultation, analysis, cross-referencing with public security sources, calculation of scores and reports, sending of notifications that the Customer configures, backup, export and deletion of Customer Data, within the functions of the Platform.

4.2. Sole purpose: to provide the Customer with the Platform during the beta so that it can measure its security and compliance posture and that of its suppliers. HodeiShield measures that posture and does not certify or guarantee compliance with any framework.

4.3. Hodeitek does not use Customer Data for its own purposes, for advertising, or to train artificial intelligence models. Nor does it include it in aggregate indicators across customers (comparisons or benchmark, observatory) unless the Customer expressly enables this from the Platform. The only exception to these two sentences is the aggregation and anonymisation that the Customer instructs in clause 6.5, for the purpose and within the limits set there. Comments and suggestions that the Customer communicates about the Platform are governed by the Beta Terms, and do not include its data.

5.Types of data and categories of data subjects

5.1. Depending on the functions the Customer uses, the Platform may process the following Customer Data:

5.2. Special categories. The Platform is not designed for special categories of data (Article 9 GDPR) or for criminal data (Article 10 GDPR). The Customer undertakes not to upload them. If an item of evidence or a document were to contain them, the Customer will notify Hodeitek beforehand so that it can assess whether they can be processed with the measures in Annex I.

5.3. The Beta Terms oblige the Customer to register only domains, assets and suppliers that it has the right or authorisation to analyse.

6.Documented instructions

6.1. Hodeitek processes Customer Data only on documented instructions from the Customer, including with regard to transfers to third countries or international organisations (Article 28.3(a) GDPR), unless required to do otherwise by Union or Member State law. In that case, Hodeitek will inform the Customer of that legal requirement before the processing, unless that law prohibits such information on important grounds of public interest.

6.2. The following are Documented Instructions: (a) this agreement and its annexes; (b) the configuration that the Customer or its authorised users make in the Platform (for example, which suppliers they register, which questionnaires they send, which alert destinations they configure, whether they enable HodeiAI); (c) any additional instructions that the Customer sends in writing to privacy@hodeitek.com and that Hodeitek confirms.

6.3. Hodeitek will immediately inform the Customer if, in its opinion, an instruction infringes the GDPR or other data protection provisions (Article 28.3, last subparagraph, GDPR).

6.4. HodeiAI. The HodeiAI assistant sends content to a Sub-processor (Annex II). In the beta it is enabled by default, and a Customer administrator (tenant_admin or org_admin) can disable it at any time in Settings, HodeiAI section: with the switch set to “disabled”, no request is sent to the Sub-processor. Keeping the switch enabled is a Documented Instruction of the Customer. End Customer tenants onboarded by an MSSP (Part II, M7). In those tenants HodeiAI is also enabled by default in the beta, on the instruction of the MSSP, which acts as processor of its End Customers and has obtained from each of them, before uploading data, the general written authorisation under Article 28.2 GDPR for Hodeitek and its Sub-processors, including the AI provider (clause M7); the administrator of each End Customer can disable it in Settings, HodeiAI section. The Documented Instruction for those tenants is given by the MSSP as processor of its End Customer (the controller), and Hodeitek acts as sub-processor. With the switch off, the risk analysis of supplier scans is also not sent to OVHcloud AI Endpoints, either in scans launched by a user or in scheduled rescans.

6.5. Aggregated and anonymised metrics for public funding. By signing this agreement, the Customer gives Hodeitek the documented instruction (Article 28.3(a) GDPR) to aggregate and anonymise Customer Data for the sole purpose of obtaining usage and results metrics of the beta programme for Hodeitek's public funding applications (programmes of public funding at European, national or regional level) and for the follow-up reports that the funding body requests, as provided in the Beta Terms. The instruction is limited to that purpose and to these conditions:

• a) Which metrics. Only usage and results metrics for the participants as a whole, for example the number of participating organisations, the assessments carried out, the suppliers monitored, the remediation time or the adoption of each module.
• b) No personal data. The result contains no personal data.
• c) No organisation identified. The result does not identify the Customer or any other organisation, either directly or by combining data such as sector, size or region.
• d) Minimum group. Each figure aggregates data from at least 5 participating organisations, so that none of them can deduce from it the data of another; the figure for a smaller group is not used on its own.
• e) Excluded content. The result includes no Customer content (evidence, documents, answers to questionnaires, HodeiAI conversations), findings about specific suppliers or details of vulnerabilities.
• f) Calculation. The calculations are carried out in the systems and with the measures in Annex I, only by the personnel referred to in clause 8, and no intermediate data that does not meet items b) to e) leaves Hodeitek.
• g) Accountability. For each application or report, Hodeitek keeps the list of the metrics used and the description of how they were calculated, and provides it to the Customer on request (clause 16.1).

Once the result meets items b) to e), it is anonymous information: it falls outside the GDPR (recital 26 GDPR) and outside this agreement.

6.6. The Customer's name. Neither clause 6.5 nor any other clause of this agreement authorises Hodeitek to name or identify the Customer, by its name, its logo, a testimonial or a success story, in any medium, including in a funding application or in a report to the body that grants it. That requires the Customer's consent, which must be prior, in writing and revocable, and is requested separately; it is not part of signing this agreement or of accepting the Beta Terms. Refusing to give it or withdrawing it does not affect the Customer's participation in the beta. Withdrawal takes effect for new uses: from that moment Hodeitek does not use the Customer's name in new applications, reports or materials, but is not obliged to withdraw what it had already submitted to a funding body before the withdrawal. If that material contains personal data (for example, the name or a quotation of a person in a testimonial), Hodeitek processes it as controller, with its own information to that person and its own legal basis, and not as processor under this agreement. The natural person whose words, name or image would appear in a testimonial or success story gives their own consent; they may refuse or withdraw it without any consequence for them, and if they refuse the Customer keeps its place and its discounts, because it can provide the testimonial without naming any individual or through another spokesperson.

7.Obligations of the Processor (Art. 28.3 GDPR)

Hodeitek undertakes to:

• a) Instructions. Process Customer Data only on the Documented Instructions in clause 6.
• b) Confidentiality. Ensure that the persons authorised to process Customer Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality (clause 8).
• c) Security. Apply the measures required under Article 32 GDPR described in clause 9 and in Annex I.
• d) Sub-processors. Respect the conditions in paragraphs 2 and 4 of Article 28 GDPR for engaging another processor (clause 10 and Annex II).
• e) Data subjects' rights. Assist the Customer, by appropriate technical and organisational measures and insofar as this is possible, so that it can respond to requests to exercise data subjects' rights (clause 11).
• f) Articles 32 to 36. Assist the Customer in ensuring compliance with the obligations in Articles 32 to 36 GDPR, taking into account the nature of the processing and the information available to it (clauses 12 and 13).
• g) End of the engagement. At the choice of the Customer, delete or return all Customer Data at the end of the provision of services and delete existing copies, unless Union or Member State law requires storage of the data (clause 15).
• h) Demonstration and audits. Make available to the Customer all information necessary to demonstrate compliance with these obligations and allow for and contribute to audits, including inspections, conducted by the Customer or another auditor mandated by it (clause 16).

In addition, Hodeitek will keep the record of processing activities as processor (Article 30(2) GDPR), which already exists in its initial form, and will cooperate with the supervisory authority on request (Article 31 GDPR).

8.Confidentiality of personnel

8.1. Only those persons at Hodeitek who need to do so to provide, maintain or secure the Platform, or to handle a request from the Customer, have access to Customer Data.

8.2. Those persons are subject to a written confidentiality undertaking or an equivalent statutory duty, which continues after their relationship with Hodeitek ends.

8.3. Operational access to the Platform with platform privileges is recorded in the audit log (see Annex I).

8.4. Exception for the metrics in clause 6.5. The confidentiality in this clause and in clause 7.b) does not prevent Hodeitek from submitting to a funding body the aggregated and anonymised metrics of clause 6.5, for the purpose and within the conditions set there, because they contain no Customer Data. The exception does not extend to any intermediate data or to any other information of the Customer.

9.Security of processing

9.1. Hodeitek applies the technical and organisational measures in Annex I, appropriate to the risk in accordance with Article 32 GDPR.

9.2. Hodeitek S.L. is certified under ISO/IEC 27001 and the National Security Framework (Esquema Nacional de Seguridad, ENS), MEDIUM category (ENS certificate no. 34/5704/26/09103, issued by OCA Instituto de Certificación), with a scope that includes the HodeiShield SaaS service. HodeiShield does not hold CPSTIC qualification and does not appear in the CPSTIC Catalogue, and Hodeitek does not certify the Customer's compliance.

9.3. Hodeitek may update the measures in Annex I provided that the resulting level of security is not lower than that described. A reduction in the level of security requires the agreement of the parties.

10.Sub-processors

10.1. General authorisation. The Customer gives Hodeitek a general written authorisation (Article 28.2 GDPR) to engage the Sub-processors in the first part of Annex II, which is the complete list at the date of signature, as promised in the Beta Terms.

10.2. Prior notice and objection. Hodeitek will notify the Customer in writing, at the contact email of this agreement, of any addition or replacement of a Sub-processor at least 15 days in advance. The notice will state who the Sub-processor is, what service it provides, where it processes the data and with what transfer safeguard.

10.3. The Customer may object within that period on reasonable data protection grounds. If Hodeitek cannot offer a reasonable alternative, the Customer may leave the programme and clause 15 applies (30 days to export or request deletion).

10.4. Updating Annex II through this procedure is not an amendment of the agreement for the purposes of clause 19.2.

10.5. Same obligations. Hodeitek imposes on each Sub-processor, by contract, data protection obligations equivalent to those of this agreement, in particular sufficient guarantees to implement appropriate technical and organisational measures (Article 28.4 GDPR). If a Sub-processor fails to fulfil its obligations, Hodeitek remains liable to the Customer for the performance of that Sub-processor's obligations.

10.6. Destinations chosen by the Customer. The services that the Customer connects on its own account are not Hodeitek's Sub-processors: alert destinations (Slack, Microsoft Teams, PagerDuty, Opsgenie, its own webhooks, its SIEM, Jira and ServiceNow) and identity providers for single sign-on (Google, Microsoft Entra, Okta, OneLogin or its own). The Customer chooses the destination and is responsible for it; Hodeitek sends only what the Customer configures.

10.7. Public data sources. To analyse the exposure of the Customer's suppliers, the Platform queries public data services (Shodan, Have I Been Pwned, OSV.dev, Logo.dev, NVD and others, listed in the second part of Annex II, “Public data sources”) and sends them only identifiers of what is being analysed: domains, server addresses and package, product or vulnerability identifiers; it does not send them user accounts. They are not Sub-processors and do not process personal data on behalf of Hodeitek; they are listed separately so that the Customer knows what leaves the Platform. A company domain is not usually personal data, but it is if it identifies a natural person.

11.Assistance with the exercise of rights

11.1. If a data subject contacts Hodeitek to exercise a right over Customer Data, Hodeitek will forward the request to the Customer without undue delay and, at the latest, within 5 working days, and will not respond on its own account unless instructed by the Customer. The console's notice already tells data subjects to contact the organisation that uploaded their data.

11.2. The Customer can consult and rectify most Customer Data from the Platform itself, and delete much of it. Two deletions in the Platform are logical and do not erase the data: that of a supplier, which can be restored for 30 days and has no final deletion task (and with it the name and email of its contact person remain), and that of a member of the management body. To genuinely delete that data, or when the Customer cannot do so by itself, Hodeitek will help it locate, export, rectify, restrict or delete the data subject's data within a period that allows the Customer to respond within the month provided for in Article 12(3) GDPR.

12.Assistance under Articles 32 to 36 GDPR

Hodeitek will provide the Customer, on request and with the information available to it, with:

• the description of the measures in Annex I and its updates;
• information so that the Customer can carry out a data protection impact assessment (Article 35 GDPR) when it needs one, and for prior consultation of the supervisory authority (Article 36 GDPR);
• the assistance in clause 13 in the event of a personal data breach.

13.Notification of personal data breaches

13.1. Hodeitek will notify the Customer, without undue delay and within a maximum of 48 hours of becoming aware of it, of any personal data breach affecting Customer Data (Article 33(2) GDPR).

13.2. The notification will be sent to the Customer's contact email and will include, as a minimum and to the extent known: the nature of the breach, the categories and approximate number of data subjects and of records concerned; the name and contact details of the person at Hodeitek from whom more information can be obtained; the likely consequences; and the measures taken or proposed, including measures to mitigate its possible adverse effects. If it is not possible to provide all the information at the same time, it will be provided in phases without undue further delay.

13.3. Hodeitek will help the Customer to notify the supervisory authority and, where applicable, the data subjects (Articles 33 and 34 GDPR). The decision to notify and the notification itself are for the Customer as controller.

13.4. Hodeitek will document each breach (the facts, its effects and the remedial action taken).

14.International transfers

14.1. The Platform is hosted in the EU, at OVHcloud (Gravelines, France).

14.2. Cloudflare, Inc. (USA) provides DNS, content delivery network, firewall and TLS termination on the path of each request, and therefore sees the traffic in clear and may process data in the United States. The transfer is covered by the EU-U.S. Data Privacy Framework (Implementing Decision (EU) 2023/1795), for as long as Cloudflare, Inc. is listed as an active participant, and, should it cease to apply, by the Standard Contractual Clauses of Implementing Decision (EU) 2021/914 incorporated into the contract with Cloudflare.

14.3. Sentry (Functional Software, Inc., USA): Hodeitek's Sentry organisation stores the data in the EU region, so the storage region does not involve an international transfer. Functional Software, Inc. may access or process data from the United States (support and its own sub-processors); its public data processing agreement (version 5.1.0, of 29 May 2024, https://sentry.io/legal/dpa/) covers those transfers under the EU-U.S. Data Privacy Framework and, if this does not apply, under the Standard Contractual Clauses (modules 2 and 3). In these error reports Sentry acts as a provider of Hodeitek, which is the controller (clause 2.2), and not as a sub-processor of the Customer; the safeguards above are those Hodeitek has with Sentry. See Annex II.

14.4. For the other Sub-processors in Annex II, any processing outside the EEA will be covered by an adequacy decision or by the safeguards of Article 46 GDPR, which Annex II indicates for each one. In particular, Resend (Plus Five Five, Inc., USA) states in its data processing agreement that its main processing takes place in the United States, with Standard Contractual Clauses and adherence to the EU-U.S. Data Privacy Framework (Annex II, row 4; sending region: eu-west-1 (Ireland), measured by the console (2026-10-14); transfer basis: DPF/SCC). The public data sources in the second part of Annex II are not Sub-processors: they are third-party public services that the Platform queries and that receive only the identifiers of what is being analysed shown in that table (supplier domains and IP addresses, software package identifiers, CPE names and CVE identifiers), not user accounts. Hodeitek will make no new transfers without the procedure in clause 10. The Customer may ask for a copy of the safeguards at privacy@hodeitek.com.

15.Return and deletion at the end

15.1. 30-day period. At the end of the beta, or of the Customer's participation for any reason (including early closure), the Customer has 30 days to ask Hodeitek, by writing to privacy@hodeitek.com, to export its data, to delete it, or both. That period coincides with the 30 days of read-only grace of the licence.

15.2. Return. The Customer obtains the copy of the Customer Data in two complementary ways:

• (a) Self-service. While the Customer's licence is in its grace period, an administrator of the Customer can download, using the console's “Export my data” function, a JSON file with the basic details of the workspace (name, sector and creation date) and the inventories of suppliers (name, domain, category, status and creation date) and assets (name, criticality, status and creation date). The function does not include the rest of the Customer Data, for example users, supplier contacts, questionnaires and answers, evidence, incidents, risks, policies, agent inventory, SBOM, audit log or HodeiAI conversations.
• (b) Manual procedure. At the Customer's written request, made by writing to privacy@hodeitek.com within the period in clause 15.1, Hodeitek delivers to it a copy of the Customer Data that the function in point (a) does not cover, in a structured, commonly used and machine-readable format (JSON or CSV), through a manual procedure carried out by Hodeitek staff, within 30 days of the request.
• (c) Independence. The manual procedure does not depend on the function in point (a). If that function is not available to the Customer (for example, because the licence's grace period has ended or the licence has been suspended) or does not work, Hodeitek also delivers through the manual procedure, within the same period, the data the function would cover.

15.3. Deletion. Deletion is not done from the Platform. At the Customer's written request, made by writing to privacy@hodeitek.com, Hodeitek deletes the Customer Data from the active systems through the same manual procedure carried out by its staff, within 30 days of the request; if the Customer requests both return and deletion, Hodeitek deletes after delivering the copy, within the same period. If, at the end of the period in clause 15.1, the Customer has not moved to a paid plan or requested anything, Hodeitek deletes the Customer Data from the active systems through the same procedure, within 30 days of the end of that period. Clauses 15.3 bis, 15.4 and 15.6 are reserved.

15.3 bis. Audit log and data subject rights records. (a) The audit log entries that record changes to Customer Data (clause 2.3) are append-only, are kept for 365 days in the database and are then archived in object storage. (b) The entries that record actions on data subject rights that the Customer manages in the Platform, in its rights-request module (opening and closing of each request), are kept for 5 years in the database and are then archived; they are Customer Data that Hodeitek keeps on the Customer's documented instructions and they are not deleted together with the rest of Customer Data. (c) The records that Hodeitek keeps, as controller, of rights requests addressed to Hodeitek itself (access or export, rectification, restriction and erasure of the data of console users) are not Customer Data: they are blocked once 1 year has passed since the request was resolved and are destroyed once 3 years have passed, without being archived, in accordance with Articles 32 and 72.1.k of the Spanish LOPDGDD.

15.4. Backups. Customer Data that is in backups is not restored or used and is deleted when those backups expire. In particular, once Customer Data has been deleted from the active systems under clause 15.3, the Customer Data remaining in the backups of the database managed by the hosting provider (OVHcloud) expires with those backups, within 2 days at most, according to the backup retention applied by that provider (Annex I, I.2).

15.5. Certificate. At the Customer's request, Hodeitek will confirm the deletion to it in writing, once it has taken place.

15.6. Legal retention. Hodeitek will retain Customer Data after those periods only if a rule of Union or Member State law so requires, blocked and only for that purpose.

15.7. Move to a paid plan. If the Customer moves to a paid plan within the 30 days, its data continues in the paid service. If it does so afterwards, it starts without the beta data.

16.Audits and inspections

16.1. First route: documentation. Hodeitek will make available to the Customer, on request, the information necessary to demonstrate compliance with this agreement. As a first route, Hodeitek will provide the current ISO/IEC 27001 and ENS MEDIUM category certificates of Hodeitek S.L. (ENS no. 34/5704/26/09103; https://hodeitek.com/docs/certificado-ens-34-5704-26-09103.pdf), with their scope, and reasonable answers to a Customer security questionnaire.

16.2. Audit. If that documentation is not sufficient for a specific purpose, or a supervisory authority so requests, the Customer may carry out an audit, itself or through an independent auditor bound by confidentiality, under these conditions: reasonable prior written notice, at most once during the beta except in the event of a personal data breach or a requirement from an authority, during working hours, limited to what is necessary and without access to other customers' data or to information that would compromise the security of the Platform.

16.3. Each party bears its own audit costs.

16.4. The Beta Terms prohibit security testing on the Platform except by reporting vulnerabilities to security@hodeitek.com. An intrusive technical test within an audit requires prior written agreement on its scope.

17.Obligations of the Customer

The Customer:

• is responsible for the lawfulness of the processing of Customer Data and for having informed data subjects (Articles 13 and 14 GDPR), and for having a legal basis for uploading it;
• informs the people who use the machines on which it installs the endpoint agent that the agent checks the machine's configuration and sends to the Platform the machine name, the operating system, its version and architecture, the IP addresses of its interfaces and the results of the checks, and that, if it fails, it can send an error report (clause 2.2), and has a legal basis for doing so. Hodeitek makes available the description of what leaves the machine, in the agent documentation;
• gives instructions that comply with the GDPR;
• uploads only data of suppliers, domains and assets that it has the right or authorisation to analyse;
• in the MSSP route, also complies with Part II;
• keeps its own copies of the information it considers important;
• diligently manages its users' accounts and their permissions within the Platform.

18.Liability

18.1. Each party is liable to data subjects in accordance with Article 82 GDPR.

18.2. As between the parties, each is liable for the damage it causes to the other by breaching this agreement or the GDPR.

18.3. As between the parties, Hodeitek's total liability for damage arising from this agreement, including the protection of personal data, is limited: (a) while the Customer uses the Platform in the free beta, to the direct damage the Customer proves, as in the Beta Terms; and (b) from the move to a paid plan, to the fees the Customer has paid to Hodeitek for the Platform in the 12 months before the event giving rise to the liability. In both cases the cap does not apply in cases of wilful misconduct (dolo) or gross negligence (culpa grave). This cap applies only between the parties and does not affect the rights of data subjects against either of them under Article 82 GDPR.

19.Precedence, amendment and partial invalidity

19.1. Precedence. In matters of data protection, this agreement prevails over the Beta Terms, as they themselves provide, and, by agreement of the parties in this agreement, over the admission email. In all other matters, the Beta Terms govern.

19.2. Amendment. This agreement is amended only by written agreement of both parties. Changes that Hodeitek makes to the Beta Terms do not amend this agreement. The Sub-processor procedure (clause 10) and the updating of measures without reducing the level of security (clause 9.3) are unaffected.

19.3. If any clause is void, the remainder stays in force and the parties will replace it with a valid one having the closest possible effect.

20.Governing law and jurisdiction

This agreement is governed by Spanish law. For any dispute, the parties submit to the courts and tribunals of Donostia-San Sebastián, as in the Beta Terms. This does not limit the powers of the supervisory authorities.

Part II. Clauses specific to the MSSP route

They apply when the Customer signs as an MSSP partner. They reflect what the Beta Terms say.

M1. Role of each party

• Each end customer that the MSSP onboards to the beta (hereinafter, “End Customer”) is the controller of its data.
• The MSSP acts as processor of the End Customer.
• Hodeitek acts as sub-processor of the MSSP.
• Each MSSP may onboard up to 3 End Customers to the beta.

M2. Authorisation of the End Customer (Art. 28.2 GDPR)

The MSSP warrants that, before uploading data of an End Customer, it holds the prior written authorisation of that End Customer to engage Hodeitek as sub-processor, and that this authorisation covers the Sub-processors in Annex II. The MSSP will give Hodeitek a copy of that authorisation if Hodeitek asks for it.

M3. Mirror obligations (Art. 28.4 GDPR)

The MSSP declares that the data protection obligations in Part I are the same as those the MSSP has with each End Customer in its processing agreement. If the MSSP's agreement with an End Customer imposes stricter obligations that affect Hodeitek, the MSSP will communicate them in writing before uploading data and, if Hodeitek accepts them, they will be incorporated as an annex. If they are not accepted, that End Customer is not onboarded through this route.

M4. Communication chain

• The End Customer's instructions reach Hodeitek through the MSSP. The MSSP is responsible for ensuring that they reflect the End Customer's instructions.
• Hodeitek's notifications (personal data breaches, changes of Sub-processors, data subject requests) are sent to the MSSP, which forwards them to the End Customer without undue delay.
• Objection to a new Sub-processor (clause 10.3). The MSSP forwards the notice in clause 10.2 to each End Customer in time for it to be able to object within the 15-day period, and exercises the objection on its behalf. If Hodeitek does not offer a reasonable alternative, the effect of clause 10.3 (leaving the programme and applying clause 15) may be limited to the tenant of that End Customer, without affecting the MSSP or its other End Customers.
• Audit (clause 16). The audit right under Article 28.3(h) GDPR extends to the End Customer: it is exercised by the MSSP on its behalf or by the End Customer itself, under the conditions of clause 16, and an audit requested by several End Customers of the same MSSP may be carried out jointly.
• If the MSSP ceases to exist, becomes insolvent or leaves the programme, Hodeitek may contact the End Customer directly to enable it to export or delete its data within the period in clause 15.

M5. End of the End Customer's beta

The trial licences of End Customers expire on the day the MSSP's beta ends. The 30 days of clause 15 are counted from that day for each End Customer.

M6. Direct signature option

If the End Customer prefers, it may sign this agreement directly with Hodeitek in the direct route. In that case Hodeitek is processor of the End Customer for its data, the MSSP's relationship with that data is governed by the agreement between the MSSP and the End Customer, and the MSSP's access to the End Customer's tenant is a Documented Instruction of the End Customer.

M7. HodeiAI in End Customer tenants

• In the beta, End Customers onboarded by the MSSP inherit the beta terms, including HodeiAI enabled by default in their tenants (clause 6.4). It is the MSSP that decides for them.
• The Documented Instruction to keep HodeiAI enabled in those tenants is given by the MSSP as processor of its End Customer (the controller), and Hodeitek acts as sub-processor.
• The MSSP obtains from each End Customer the general written authorisation (Article 28.2 GDPR) for Hodeitek and its Sub-processors, including the AI provider, before uploading data. Informing the End Customer is not enough: without that prior authorisation, the MSSP does not upload its data. The authorisation (M2) must expressly cover that HodeiAI is enabled by default, that it sends content to the Sub-processor OVH SAS through OVHcloud AI Endpoints (AI inference; Annex II, row 7) and that the End Customer's administrator can disable it in Settings, HodeiAI section.
• The mirror obligations under Article 28.4 GDPR (M3) extend to this processing: the MSSP is responsible for ensuring that its agreement with each End Customer permits this chain of sub-processors.
• If an End Customer administrator disables HodeiAI, Hodeitek stops sending requests to the Sub-processor from that tenant.
• The MSSP can change it and this is recorded in the customer's history: the MSSP's org_admin acts on the tenants of its customers, org_admin can change the HodeiAI setting, and the change is recorded in the tenant's history with the author.

M8. Aggregated metrics and the name of End Customers

• The instruction in clause 6.5 for the data of End Customers is given by the MSSP as processor of its End Customer, with Hodeitek as sub-processor, and the MSSP warrants that its agreement with each End Customer allows it to give it (M3).
• In the figures of clause 6.5, each End Customer counts as an organisation distinct from the MSSP. A figure in which all the organisations but one are the MSSP and its End Customers is not used, because the MSSP, which sees the data of its End Customers, could deduce the data of the remaining one.
• Naming or identifying an End Customer (clause 6.6) requires that End Customer's separate consent; the MSSP's is not enough. Refusing or withdrawing it does not affect the participation of the End Customer or of the MSSP.

M9. Information to the users of the machines

Before installing the endpoint agent on an End Customer's machines, the MSSP makes sure that this End Customer, which is the controller of its data (M1), has informed the people who use those machines of what clause 17 says about the agent, and has a legal basis for doing so. The MSSP may give them that information on the End Customer's behalf if the End Customer asks it to. Hodeitek makes available the description of what leaves the machine, in the agent documentation.

Annex I. Technical and organisational measures

This annex describes, in general terms, the categories of technical and organisational measures that Hodeitek applies to Customer Data, and does not assert those it cannot support. The detailed technical description of these measures is available to customers on request, by writing to privacy@hodeitek.com.

Certified framework

• Hodeitek S.L. (the company) is certified under ISO/IEC 27001 and the National Security Scheme (ENS), MEDIUM category, with a scope that includes the HodeiShield SaaS service.
• HodeiShield holds no CPSTIC qualification and no product certification. This annex asserts neither.

Isolation between customers

• Each customer's data is isolated from that of other customers in the database, and queries run within the context of the customer they belong to.
• This measure protects against an application fault that forgets to filter by customer. It is not a barrier against someone who can choose which queries run, so it is combined with access control and with the audit log.

Encryption in transit

• All console traffic is encrypted with TLS. Cloudflare terminates TLS at the edge (Annex II) and the origin only accepts authenticated connections coming from Cloudflare.
• The application connects to the managed database over TLS and verifies the server certificate.
• The endpoint agent only sends data over encrypted connections.

Encryption and protection of secrets at rest

• Passwords are stored with a hashing algorithm designed for that purpose, never in clear.
• Second-factor material, session signing private keys and integration secrets (for example SSO, OAuth or webhooks) are stored encrypted.
• API keys are stored only as a hash, and their secret part is shown only once, when it is created.
• Object storage encrypts files on the server side.
• The managed database encrypts its volumes and backups, according to the documentation of the infrastructure provider (OVHcloud, Annex II).

Access control and authentication

• Access is role-based, with separate read and write permissions.
• The second factor (TOTP) and passkeys are available to all users. The Customer's administrator can require the second factor of all its users through the tenant policy; by default it is not required, and Hodeitek recommends that the Customer enable it.
• Sign-in and second-factor attempts are rate-limited.
• Sessions have a maximum duration, and unused accounts are suspended after a period the Customer can adjust.

Backups

• The managed database has automatic backups, with continuous transaction logging to recover to a point in time, operated by the infrastructure provider (OVHcloud, Annex II) and kept within the European Economic Area.
• This contract does not promise high availability or recovery time or recovery point objectives.

Logging and monitoring

• Actions in the console are recorded in an audit log with user, date, IP and browser.
• The log is append-only: it does not allow changes, and only a dedicated purge process can delete entries that have already been archived. Entries are kept for a defined period and then archived.
• The error reports and logs that the Platform sends to the diagnostics service (Sentry, Annex II) go through a filter that removes user, cookies and request headers and redacts secrets, tokens, email addresses and IP addresses.
• That filter does not recognise people's names, so this contract does not assert "no personal data" in error diagnostics. The endpoint agent only reports errors and failures and redacts its identifiers before sending.

Minimisation and pseudonymisation

• The endpoint agent only collects the minimum technical data of the device, and does not collect user names, serial numbers or MAC addresses.
• There are automatic deletions by period, including the HodeiAI history and expired sessions. They do not include the erasure of Customer data at the end of the beta, which is governed by this contract.
• Before sending text to the AI provider (Annex II), the Platform pseudonymises email addresses, phone numbers, identity documents, IBANs and the names in the tenant's dictionary, in the HodeiAI and policy drafting flows. It does not apply to every flow and does not recognise every person's name, postal address or free-form identifier, which may go out as they are.

Integrity and vulnerability management

• The observations sent by the agent are signed, and the console rejects those that do not verify.
• Dependencies are updated in an automated way, with a waiting period before new versions are adopted. Production images and code are rescanned every week with vulnerability and static analysis, and a software bill of materials (SBOM) is generated when images are published.
• Vulnerabilities can be reported to security@hodeitek.com.