Data Processing Agreement (DPA)

Opsinel processes data about the Client’s employees, contractors and other lawfully included recipients only to provide phishing simulations, training, results, technical support and security. Annex A describes the processing and data categories.

The Client determines purposes, legal basis, recipients, notices and retention needs. Opsinel is a controller for its own account, billing, support and service security data as explained in its Privacy Policy.

Opsinel processes Client data only on documented Client instructions, including Platform settings and this Agreement, unless law requires otherwise. Opsinel will inform the Client of such a legal requirement before processing unless prohibited by law.

If an instruction appears to infringe data protection law, Opsinel will promptly inform the Client and may suspend the affected operation. The Client must not instruct Opsinel to collect real passwords, one-time codes or other secrets.

Persons authorised to access Client data are bound by confidentiality and receive only the rights needed for their duties. Access is granted, reviewed and revoked under a documented process.

Opsinel applies risk-appropriate technical and organisational measures described in Annex B and regularly assesses their effectiveness. Measures may change provided the overall protection level is not reduced. An up-to-date description is available on request.

The Client gives general written authorisation for the subprocessors listed in Annex C solely to deliver the service. Opsinel imposes substantially equivalent data protection duties by contract and remains responsible to the Client for their performance.

Opsinel will give at least 30 calendar days’ notice of a new subprocessor or a material change. The Client may object on reasonable data protection grounds during that period. The parties will seek a solution; failing that, the Client may terminate the affected service before the change. The current subprocessor list is published with this Agreement.

Transfers outside the European Economic Area require a valid GDPR Chapter V mechanism, such as an adequacy decision or applicable Standard Contractual Clauses, and supplementary measures where needed. Opsinel will provide the Client with information on the transfer and safeguards.

Taking account of the nature of processing, Opsinel assists the Client with access, rectification, erasure, restriction, portability and other data subject requests. A request received directly from an employee about Client data will be forwarded to the Client unless prohibited by law.

Opsinel provides information available to it that the Client reasonably needs for a data protection impact assessment or consultation with a supervisory authority. The Client decides whether an assessment is necessary and approves its outcome.

After becoming aware of a breach of Client personal data, Opsinel will notify the Client without undue delay using the account contact and/or agreed incident channel. The notice will include available information on the nature, affected data, likely consequences and measures taken; further details may follow in stages.

Opsinel documents the breach, limits harm, preserves evidence and assists the Client with its notification duties. The Client, as controller, assesses and submits any notification to a supervisory authority concerning Client-controlled data.

After service termination the Client may request an export of its core data within 30 calendar days. At the Client’s choice Opsinel returns or deletes data processed on its behalf within the agreed period, except where European Union or Member State law requires retention. Opsinel separately retains its own controller records for contract and accounting purposes under the Privacy Policy.

Residual backup data is isolated from ordinary use and removed under the backup lifecycle. Retention periods and exceptions are described in the Privacy Policy. Opsinel will confirm deletion on request.

Opsinel provides information necessary to demonstrate compliance with this Agreement and GDPR Article 28, allows for and contributes to audits including inspections by the Client or its mandated auditor. The parties agree proportionate timing and scope in advance, except where urgency follows a significant incident. Inspections protect other clients’ data and Opsinel confidential information; each party bears its ordinary audit costs.

This Agreement remains in effect while Opsinel processes personal data on the Client’s behalf. Version: 2026-10-03.v3. Requests and incidents: privacy@opsinel.com. The Client keeps its account contacts current.

Subject and duration: Client-instructed simulations, training and reporting during the service term and applicable return and deletion period.

Nature and purpose: importing, storing, sending, recording reactions, assigning training, calculating results, reporting, support and security.

Data subjects: Client employees, contractors, administrators and other lawfully included recipients. Data: name, work email, role, department, training assignments and results, simulation events, IP, browser and technical metadata. Real passwords and payment card data are not collected.

TLS encryption in transit; role and organisation-scoped access; server-side authorisation; database row-level policies; SMTP secret encryption; access and activity logs; input validation and sending limits; vulnerability and dependency management.

Backups, restoration tests, incident response, access reviews, administrator authentication controls and personnel confidentiality are governed by documented operations. Production settings must be confirmed in the security description; this contract alone does not prove they are active.

Core integrations: Supabase (database and authentication), Vercel (hosting and performance monitoring), Upstash (request limiting). Conditional integrations: Stripe (billing and training purchases), Google Analytics (public-site analytics according to visitor choice), the Client-selected SMTP provider (email delivery).

Supplier legal entities, contractual roles, regions, transfers and enabled status are maintained in the subprocessor register. The Client may request the current version before submitting data.