When we process personal data on your behalf, this agreement sets out how we protect it under UK GDPR — our security measures, sub-processors, breach notification and your audit rights. A signed copy is available on request.
Summary. When NetInsightPro processes personal data on your behalf (i.e. you are the data controller), this DPA governs that processing under UK GDPR Art. 28. This page is a plain-language preview — a countersigned PDF is available on request.
1. Roles
- Controller: You (the customer / license holder)
- Processor: TechProf Ltd trading as NetInsightPro
- Sub-processors: we engage a tightly-scoped set of vendors in the following categories — (a) cloud infrastructure provider, (b) payment processor, (c) source-control / artifact-distribution provider, (d) web-font CDN, (e) AI assistance provider (where applicable for support chat). The named list of sub-processors, their roles, sub-processing locations, and applicable transfer mechanisms is available on request under NDA: privacy@netinsightpro.com.
2. Data we process on your behalf
- Account email addresses, license keys, activation HWID hashes, audit logs
- NOT: on-device network traffic (stays on your device)
- NOT: browser cookie data. The desktop app's optional Cookie & Tracker Privacy feature reads browser cookie metadata on-device only, never reads cookie values, and transmits no cookie data to us
3. Your instructions
We process data only on documented instructions from you, including those implicit in these terms + the Privacy Policy. We will not sell, share, or secondary-process your data.
4. Security measures (UK GDPR Art. 32)
- Encryption at rest (customer-managed encryption keys, auto-rotation)
- Encryption in transit (TLS 1.2+)
- MFA + least-privilege for admin access
- WAF + rate limiting + DDoS absorption via global CDN
- Audit logging: platform audit trail + admin actions + 7-year retention
- PITR backups on all databases
- Quarterly DR drill
5. Personnel
All staff with data access are bound by written confidentiality. Access to production data gated on role + need-to-know + MFA.
6. Sub-processor approval
We'll notify you 30 days before onboarding any new sub-processor (email: privacy@netinsightpro.com to subscribe). You may object; if unresolved, you may terminate pro-rata.
7. International transfers
UK → US transfers governed by UK-IDTA. EU → US covered by SCCs + DPF where applicable.
8. Data subject rights
We assist you in responding to access, erasure, portability, and objection requests within 30 days of your written request, matching the Privacy Policy and UK GDPR Art. 12 (complex or multiple requests may extend by a further two months with prior notice to the data subject).
9. Breach notification
We notify you within 48 hours of confirming a personal-data breach affecting your data. Notification includes: nature, scope, likely consequences, measures taken.
10. Return / deletion
On termination, we delete or return your personal data within 30 days (except where retention is legally required — e.g. tax). Certified deletion report available on request.
11. Audit rights
You may audit our compliance once per year on 30-day notice, at your cost. We also provide our current security posture document (SOC 2 Type II audit in progress, target 2026; ISO 27001 in progress, target 2027) and annual penetration-test executive summary in lieu under NDA.
12. Signed copy
Email legal@netinsightpro.com to request a countersigned DPA PDF for your records.