This document sets out the terms on which Lockpick Networks processes personal data on behalf of its clients, in accordance with Article 28 of the GDPR. It forms part of, and is subject to, the services agreement between us.
LAST UPDATED: 25 AUGUST 2026
This agreement is between the client (the “Controller”) and Lockpick Networks S.R.L., VAT RO45283616, Strada Nicolae G. Caranfil 49, Sector 1, Bucharest, Romania (the “Processor”).
Where we manage infrastructure or systems on your behalf and in doing so process personal data for which you are responsible, you act as Controller and we act as Processor within the meaning of Article 4 of the GDPR.
This agreement takes effect on the date the underlying services agreement takes effect and continues for as long as we process personal data on your behalf.
Subject matter: the provision of managed IT, network engineering, system administration, cybersecurity and related services as described in the applicable Statement of Work.
Duration: the term of the services agreement, plus any agreed return or deletion period.
Nature and purpose: hosting, administration, monitoring, backup, security operations and technical support of systems that may contain personal data.
Categories of data subject: typically the Controller’s employees, contractors, customers and end users, as determined by the Controller.
Types of personal data: as determined by the Controller and by the content of the systems concerned. We do not select what personal data is placed into those systems.
We will process personal data only on your documented instructions, including with regard to international transfers, unless required to do otherwise by EU or Member State law, in which case we will inform you before processing unless that law prohibits it.
We will ensure that persons authorised to process personal data are bound by an appropriate duty of confidentiality.
We will implement appropriate technical and organisational measures as required by Article 32 of the GDPR, as described in the Security section below.
We will not engage another processor without your prior authorisation, in accordance with the Subprocessors section below.
Taking into account the nature of the processing, we will assist you by appropriate technical and organisational measures in fulfilling your obligation to respond to requests from data subjects exercising their rights.
We will assist you in ensuring compliance with your obligations under Articles 32 to 36 of the GDPR, including security of processing, breach notification and data protection impact assessments, taking into account the nature of the processing and the information available to us.
At your choice, we will delete or return all personal data at the end of the provision of services, and delete existing copies unless EU or Member State law requires storage.
We will make available to you all information necessary to demonstrate compliance with Article 28 and allow for and contribute to audits, including inspections, conducted by you or another auditor mandated by you.
We maintain, at minimum, the following technical and organisational measures:
Role-based access control across all client environments, with access limited to personnel who require it for the delivery of services.
Encryption of personal data in transit, and at rest where the system concerned supports it.
A documented incident response process, tested and reviewed on a regular basis.
Backup procedures with periodic restore testing, not backup configuration alone.
Segmentation of client environments and, where applicable, of scoped regulatory environments such as cardholder data environments.
Documented change control, with named and described firewall rules and a maintained change history.
Centralised logging with time synchronisation across managed devices.
Further detail is set out in our security overview document, available on request.
You give general authorisation for us to engage subprocessors for the performance of the services. Our current subprocessors are: [LIST YOUR SUBPROCESSORS, e.g. hosting providers, monitoring platforms, backup providers, or state “none” if all processing is carried out within your own infrastructure and the client’s].
We will inform you of any intended addition or replacement of a subprocessor at least thirty days in advance, giving you the opportunity to object on reasonable grounds relating to data protection.
Where we engage a subprocessor, we impose on it the same data protection obligations as are set out in this agreement, and we remain fully liable to you for the performance of that subprocessor’s obligations.
We will notify you without undue delay, and in any event within [NOTIFICATION PERIOD, e.g. 24 hours] of becoming aware, of any personal data breach affecting personal data processed on your behalf.
That notification will describe the nature of the breach, the categories and approximate number of data subjects and records concerned so far as known, the likely consequences, and the measures taken or proposed to address it.
We will cooperate with you and take reasonable commercial steps as directed by you to assist in the investigation, mitigation and remediation of the breach.
We will not transfer personal data outside the European Economic Area without your prior written authorisation.
Where such a transfer is authorised, it will be carried out under an adequacy decision of the European Commission or under Standard Contractual Clauses, together with any supplementary measures required following a transfer impact assessment.
Infrastructure under our management is kept within the European Union by default.
On termination or expiry of the services agreement, and at your choice, we will return all personal data processed on your behalf in a commonly used format, or securely delete it.
Deletion will be completed within [DELETION PERIOD, e.g. 30 days] of your instruction, save where retention is required by EU or Member State law, in which case we will inform you of the requirement and the retention period.
On request we will provide written confirmation that deletion has been carried out.
The liability provisions of the services agreement apply to this agreement.
In the event of a conflict between this agreement and the services agreement in relation to the processing of personal data, this agreement prevails.
This agreement is governed by Romanian law and, where applicable, by Regulation (EU) 2016/679.
