Data Processing Agreement

1. Scope and order of precedence

This DPA applies when Shadow Corp (“Processor”) processes personal data on behalf of the client (“Controller”) while providing the services described in the master services agreement, statement of work, or order (together, the “Agreement”). It covers penetration testing, red teaming, incident response and digital forensics, managed detection and response, and related services. If this DPA conflicts with the Agreement on the protection of personal data, this DPA prevails. Where the EU Standard Contractual Clauses apply (section 7), they prevail over both.

2. Definitions

“Personal data”, “processing”, “controller”, “processor”, “data subject”, and “personal data breach” have the meanings given in the Applicable Data Protection Law. “Applicable Data Protection Law” means the laws that apply to the processing, which may include Peru’s Personal Data Protection Law (Law 29733) and its Regulation (Supreme Decree 016-2024-JUS), the EU General Data Protection Regulation (GDPR), the UK GDPR, Brazil’s LGPD, and other national laws named in the Agreement. “Subprocessor” means any third party engaged by the Processor that processes Controller personal data.

3. Roles of the parties

• The Controller (in Peruvian law, the titular del banco de datos personales or responsable) determines the purposes and means of the processing and is responsible for having a lawful basis for it and for informing data subjects.
• The Processor (in Peruvian law, the encargado del tratamiento) processes Controller personal data only to provide the services and only on the Controller’s documented instructions, which are the Agreement, this DPA, the rules of engagement, and written instructions given during the engagement.
• The Processor acts as an independent controller only for its own business data about the Controller’s representatives (contact, billing, and contract management), as described in its privacy policy.

4. Subject matter, duration, nature, and purpose

• Subject matter: processing of personal data that the Processor accesses, receives, or generates while performing the services.
• Duration: the term of the Agreement plus the period needed to return or delete the data under section 11.
• Nature: access, collection, recording, analysis, storage, and deletion, mostly incidental to security testing, investigation, and monitoring. The Processor does not seek out personal data beyond what the agreed scope requires.
• Purpose: to deliver the services and reports defined in the Agreement. The Processor does not use Controller personal data for its own purposes, to train models, or for marketing, and does not sell or share it.
• Categories of data subjects and personal data: see Annex 1.

5. Processor obligations

The Processor shall:

1. Process Controller personal data only on documented instructions, including for international transfers, unless the law requires otherwise; in that case it will inform the Controller first, unless the law prohibits it. It will tell the Controller promptly if it believes an instruction infringes Applicable Data Protection Law.
2. Ensure that everyone authorized to process the data is bound by confidentiality, has received relevant training, and accesses only what the engagement needs.
3. Implement the technical and organizational measures in Annex 2 and keep them appropriate to the risk.
4. Respect the conditions in section 6 for engaging subprocessors.
5. Assist the Controller as described in section 10.
6. Not keep, copy, or disclose Controller personal data beyond what the services require, and minimize it: for example, by redacting or truncating personal data and credentials in reports and evidence, and by not exfiltrating real data sets when proof of access is enough.
7. Keep a record of the processing activities carried out on behalf of the Controller where the law requires it.
8. Make available the information needed to demonstrate compliance with this DPA (section 12).

6. Subprocessors

• The Controller gives general authorization for the Processor to use the subprocessors listed on our subprocessors page (Annex 3) and any listed in the Agreement.
• The Processor will notify the Controller at least 30 days before adding or replacing a subprocessor that will process Controller personal data. The Controller may object on reasonable data protection grounds within that period; the parties will then discuss in good faith, and if they cannot agree, the Controller may terminate the affected services without penalty.
• The Processor will impose on each subprocessor, by written contract, data protection obligations no less protective than this DPA, and remains responsible to the Controller for its subprocessors’ performance.
• Unless agreed in writing, engagement data such as reports, forensic images, and credentials are not stored with the website providers listed on the subprocessors page.

7. International transfers

The Processor is established in Peru, and some of its subprocessors are in the United States. Personal data may be transferred only with a valid transfer mechanism:

• From Peru: contractual safeguards that ensure a level of protection consistent with Law 29733 and its Regulation, and the communication of cross-border flows to Peru’s National Authority for Personal Data Protection where required.
• From the EU or EEA (option): if the Controller is subject to the GDPR and the transfer is not covered by an adequacy decision, the parties incorporate the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914: Module 2 (controller to processor) between the Controller and the Processor, and Module 3 (processor to processor) or another valid mechanism for onward transfers to subprocessors. The annexes of the clauses are completed with Annexes 1 to 3 of this DPA. Clause 7 (docking) applies; for Clause 17 and Clause 18, the law and courts of [EU member state chosen by the Controller] apply.
• From the UK or Switzerland: the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or the clauses with the amendments required by Swiss law, as applicable.
• From Brazil: the standard contractual clauses approved by Brazil’s data protection authority (ANPD), where applicable.
• Other countries: the mechanism required by the local law, agreed in the Agreement.

If a client requires data residency in a specific region, it must be agreed in the Agreement before the engagement starts.

8. Security measures

The Processor implements the measures summarized in Annex 2, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of the processing, as well as the risk to data subjects. The Processor may update the measures as long as the overall level of protection is not reduced.

9. Personal data breaches

• The Processor will notify the Controller without undue delay, and in any case within [48] hours, after becoming aware of a personal data breach affecting Controller personal data.
• The notice will describe, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences, the measures taken or proposed, and a contact point. Information may be provided in phases.
• The Processor will take reasonable steps to contain and remedy the breach, preserve evidence, and cooperate with the Controller’s notifications to authorities and data subjects. The Processor will not notify authorities or data subjects on the Controller’s behalf unless instructed or required by law.
• Notifying a breach is not an admission of fault or liability.

10. Assistance to the Controller

• Data subject requests: the Processor will forward to the Controller, without undue delay, any request received from a data subject about Controller personal data, and will help the Controller answer it. It will not respond directly unless authorized.
• Impact assessments and consultations: the Processor will provide reasonable information for the Controller’s data protection impact assessments and prior consultations with authorities.
• Authority requests: unless prohibited by law, the Processor will inform the Controller of any request from an authority for Controller personal data and will disclose only what is legally required.

11. Deletion or return at the end of the services

When the services end, or earlier at the Controller’s written request, the Processor will, at the Controller’s choice, return or securely delete Controller personal data, including copies held by subprocessors, within [30] days, and confirm the deletion in writing. Exceptions: data the law requires the Processor to keep, which remains protected by this DPA, and evidence held under a documented chain of custody for as long as agreed in the Agreement. Final reports are kept for the period agreed in the Agreement with personal data minimized.

12. Audits and information

• The Processor will make available the information reasonably needed to demonstrate compliance with this DPA, such as its security policies, answers to security questionnaires, and any independent certifications or reports it holds.
• If that information is not sufficient, or an authority requires it, the Controller (or an independent auditor bound by confidentiality and not a competitor of the Processor) may audit, with at least 30 days’ notice, during business hours, no more than once every 12 months, except after a breach or at an authority’s request. Each party bears its own costs unless the audit reveals a material breach of this DPA.
• Audits must not compromise the security of the Processor’s other clients or their confidential information.

13. Liability and general terms

• Each party’s liability under this DPA is subject to the limitations and exclusions in the Agreement, except where the law or the Standard Contractual Clauses do not allow them.
• This DPA remains in force while the Processor processes Controller personal data. Sections that by their nature should survive termination survive it.
• Governing law and jurisdiction are those of the Agreement, unless the Standard Contractual Clauses require otherwise.
• If any provision is invalid, the rest remains in force, and the parties will replace it with a valid provision as close as possible to its intent.

Annex 1: Description of the processing

Controller

[Client legal name, registered address, tax ID, contact person and email]

Processor

Shadow Corp (legal name: registration in progress; RUC registration in progress), Peru. Contact: contact@sh4dowcorp.com.

Data subjects

Controller’s employees, contractors, and users; customers and other individuals whose data is held in the systems in scope; in social engineering engagements, the individuals targeted with the Controller’s authorization.

Categories of data

Identification and contact data; account identifiers and credentials (including password hashes) encountered during testing; system, network, and security logs (IP addresses, device identifiers, activity records); email and file content in forensic images or evidence; any other data present in the systems in scope. Special categories of data are processed only if incidentally present in those systems, and are not sought out.

Frequency

[One-off for the duration of the engagement / continuous for managed services]

Retention

[As set in section 11 and the Agreement]

Subprocessors

See Annex 3.

Annex 2: Technical and organizational security measures

• Access control: named accounts, least privilege, multi-factor authentication on all systems that hold Controller data, and access removed at the end of each engagement.
• Encryption: encryption in transit (TLS) and at rest for engagement data, evidence, and reports; reports shared through access-controlled channels, never by unencrypted email attachment.
• Segregation: each client’s data is kept separate from other clients’ data.
• Minimization: redaction of personal data and credentials in reports; proof of access without bulk extraction of real data.
• Logging and monitoring: activity on systems holding Controller data is logged, and logs are protected from tampering.
• Evidence handling: documented chain of custody for forensic evidence, with integrity hashes.
• Personnel: confidentiality agreements, security training, and background checks where lawful and appropriate.
• Incident management: documented procedure for detecting, containing, assessing, and notifying personal data breaches (section 9).
• Secure deletion: deletion of data and media at the end of the engagement with written confirmation (section 11).
• Review: periodic review of these measures and of access privileges.

Annex 3: Subprocessors

The current list, with each provider’s purpose, location, and data processing terms, is published on our subprocessors page. Engagement-specific subprocessors, if any, are listed in the Agreement: [none / list].