Data Processing Agreement

1. Parties & Relationship

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Slawomir Kuprowski, trading as ARRAC.IO ("Processor", "ARRAC", "we"), and the Customer identified in the applicable order ("Controller", "Customer", "you"). In respect of the personal data described in this DPA, the Customer is the data controller and ARRAC is the data processor, each within the meaning of the UK GDPR and the Data Protection Act 2018.

2. Subject Matter & Duration

ARRAC processes personal data on the Customer's behalf solely to provide the Platform — automated security monitoring, threat investigation, and containment services for the Customer's Microsoft 365 environment. Processing continues for the duration of the Subscription Term and for any period afterwards required to fulfil ARRAC's deletion or return obligations under Section 11.

3. Nature & Purpose of Processing

ARRAC's Platform connects to the Customer's Microsoft 365 tenant via permissions the Customer explicitly grants during onboarding. The Platform ingests security-relevant signals (sign-in activity, identity risk events, email threat detections, compliance alerts, and similar), analyses them — including via AI-assisted investigation — to identify genuine threats, and, depending on the autonomy tier the Customer has configured, recommends or automatically executes containment actions (for example, revoking a session or an application's permissions). Processing is limited to what is reasonably necessary for these security purposes.

4. Categories of Data & Data Subjects

Categories of personal data processed typically include: user principal names and email addresses, IP addresses and sign-in metadata, device and location information associated with sign-in events, and the content of security alerts generated by Microsoft's own security services (which may incidentally reference message metadata or file names, but not, in the ordinary course, the substantive content of emails or documents).

Categories of data subjects are the Customer's employees, contractors, and other individuals with accounts in the Customer's Microsoft 365 tenant.

5. Processor Obligations

ARRAC shall: process personal data only on the Customer's documented instructions (including as set out in this DPA), unless required otherwise by law; ensure that any person authorised to process personal data (including ARRAC itself, acting as a sole trader) is bound by an obligation of confidentiality; implement appropriate technical and organisational security measures as described in Section 8; not engage a further sub-processor without providing the Customer notice as described in Section 6; assist the Customer as described in Section 10; and, at the Customer's choice, delete or return all personal data at the end of the Subscription Term as described in Section 11.

6. Sub-Processors

The Customer provides general authorisation for ARRAC to engage the sub-processors listed below, each engaged solely for the specific function stated. ARRAC will notify the Customer of any intended change to this list (addition or replacement) with at least 14 days' notice, during which the Customer may object on reasonable data protection grounds.

This list reflects ARRAC's sub-processors as of the date at the top of this page and will be kept current on this page.

7. International Transfers

Certain sub-processors listed above are located outside the United Kingdom, including in the United States. Where personal data is transferred to such a sub-processor, ARRAC relies on an appropriate transfer mechanism recognised under UK data protection law — such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses — with that sub-processor.

8. Security Measures

ARRAC maintains technical and organisational measures appropriate to the risk, including: encryption of data in transit and, where applicable, at rest; a least-privilege, dual-credential access model separating read-only monitoring from write-capable containment actions, with write access held only for the duration a specific approved action requires; an immutable audit log of all actions the Platform takes within the Customer's environment; and access controls restricting ARRAC's own personnel access to Customer Data to what is necessary to provide and support the Platform. Further detail is available on the Security page.

9. Breach Notification

ARRAC will notify the Customer without undue delay, and in any event within 72 hours of becoming aware, of any personal data breach affecting the Customer's data, providing such information as is available to enable the Customer to meet its own notification obligations under applicable law.

10. Assisting the Controller

ARRAC will provide reasonable assistance to the Customer in responding to data subject requests (access, rectification, erasure, and similar), and in the Customer's own data protection impact assessments and consultations with supervisory authorities, to the extent these relate to ARRAC's processing under this DPA.

11. Deletion & Return of Data

On termination of the Subscription Term, ARRAC will, at the Customer's written election, delete or return all personal data processed under this DPA within 30 days, save to the extent retention is required by law, in which case ARRAC will continue to protect the data and process it only for that retention purpose.

12. Audit Rights

ARRAC will make available to the Customer such information as is reasonably necessary to demonstrate compliance with this DPA, and will permit and contribute to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer, on reasonable notice and no more than once per year absent a specific concern.