Summary. When NetInsightPro processes personal data on your behalf (i.e. you are the data controller), this DPA governs that processing under UK GDPR Art. 28. This page is a plain-language preview — a countersigned PDF is available on request.
1. Roles
- Controller: You (the customer / license holder)
- Processor: TechProf Ltd trading as NetInsightPro
- Sub-processors: we engage a tightly-scoped set of vendors in the following categories — (a) cloud infrastructure provider, (b) payment processor, (c) source-control / artifact-distribution provider, (d) web-font CDN, (e) AI assistance provider (where applicable for support chat). The named list of sub-processors, their roles, sub-processing locations, and applicable transfer mechanisms is available on request under NDA: privacy@netinsightpro.com.
2. Data we process on your behalf
- Account email addresses, license keys, activation HWID hashes, audit logs
- NOT: on-device network traffic (stays on your device)
3. Your instructions
We process data only on documented instructions from you, including those implicit in these terms + the Privacy Policy. We will not sell, share, or secondary-process your data.
4. Security measures (UK GDPR Art. 32)
- Encryption at rest (customer-managed encryption keys, auto-rotation)
- Encryption in transit (TLS 1.2+)
- MFA + least-privilege for admin access
- WAF + rate limiting + DDoS absorption via global CDN
- Audit logging: platform audit trail + admin actions + 7-year retention
- PITR backups on all databases
- Quarterly DR drill
5. Personnel
All staff with data access are bound by written confidentiality. Access to production data gated on role + need-to-know + MFA.
6. Sub-processor approval
We'll notify you 30 days before onboarding any new sub-processor (email: privacy@netinsightpro.com to subscribe). You may object; if unresolved, you may terminate pro-rata.
7. International transfers
UK → US transfers governed by UK-IDTA. EU → US covered by SCCs + DPF where applicable.
8. Data subject rights
We assist you in responding to access, erasure, portability, and objection requests within 30 days of your written request, matching the Privacy Policy and UK GDPR Art. 12 (complex or multiple requests may extend by a further two months with prior notice to the data subject).
9. Breach notification
We notify you within 48 hours of confirming a personal-data breach affecting your data. Notification includes: nature, scope, likely consequences, measures taken.
10. Return / deletion
On termination, we delete or return your personal data within 30 days (except where retention is legally required — e.g. tax). Certified deletion report available on request.
11. Audit rights
You may audit our compliance once per year on 30-day notice, at your cost. We also provide SOC 2 / ISO 27001 certificates + pentest summaries in lieu where available.
12. Signed copy
Email legal@netinsightpro.com to request a countersigned DPA PDF for your records.