Data processing agreement

Document Owner	Privacy / Compliance
Version	1.0
Classification	Public
Last Reviewed	Feb 12 2026
Review Frequency	Annual or upon material change

Background

(A)

The Customer (the Controller) and Push Security Ltd (the Processor) entered into an agreement/terms (Agreement) that may require the Processor to process Personal Data on behalf of the Controller.

(B)

This Data Processing Agreement (DPA) sets out the terms, requirements and conditions on which the Processor will process Personal Data when providing services under the Agreement. This DPA contains the mandatory clauses required by Article 28(3) of the General Data Protection Regulation ((EU) 2016/679) for contracts between controllers and, if applicable, processors and the UK Addendum to the SCC’s.

Agreed terms

Definitions and interpretation

The following definitions and rules of interpretation apply in this DPA.

Affiliates: any entity that directly or indirectly controls, is controlled by, or is under common control with another entity.

Business Purposes: the services described in the Agreement.

Data Subject: an individual who is the subject of Personal Data.

Personal Data: any information relating to an identified or identifiable natural person that is processed by the Processor as a result of the provision of services under the Agreement; an identifiable natural person is one who can be identified.

Processing, processes and process: any activity that involves the use of Personal Data or as the Data Protection Legislation may otherwise define processing, processes or process.

Data Protection Legislation: all applicable data protection and privacy legislation in force from time to time in the UK including the General Data Protection Regulation ((EU) 2016/679); the Data Protection Act 2018; the Privacy and Electronic Communications Directive 2002/58/EC (as updated by Directive 2009/136/EC) and the Privacy and Electronic Communications Regulations 2003 (SI 2003/2426) as amended.

Personal Data Breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored or otherwise processed.

Privacy Policy: the Processor’s privacy policy, located here.

Standard Contractual Clauses (SCC): means one or both of the following, as the context requires:

the "2021 SCCs", defined as the clauses issued pursuant to the EU Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, available at https://data.europa.eu/eli/dec_impl/2021/914/oj and completed as described in ANNEX A; and
the "UK SCCs", defined as the United Kingdom Information Commissioner's International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (version B1.0, available at https://ico.org.uk/media2/migrated/4019539/international-data-transfer-addendum.pdf ), and completed as described in ANNEX A.

1.2

This DPA is subject to the terms of the Agreement and is incorporated into the Agreement. Interpretations and defined terms set forth in the Agreement apply to the interpretation of this DPA.

1.3

The Annexes form part of this DPA and will have effect as if set out in full in the body of this DPA.

1.4

A reference to writing or written includes email.

1.5

In the case of conflict or ambiguity between:

(a)

any provision contained in the body of this DPA and any provision contained in the Annexes, the provision in the body of this DPA will prevail;

(b)

the terms of any accompanying invoice or other documents annexed to this DPA and any provision contained in the Annexes, the provision contained in the Annexes will prevail;

(c)

any of the provisions of this DPA and the provisions of the Agreement, the provisions of this DPA will prevail.

Personal data types and processing purposes

2.1

The Controller and the Processor acknowledge that for the purpose of the Data Protection Legislation, the roles of Data Controller and Data Processor are as outlined in the Privacy Policy.

2.2

The Controller retains control of the Personal Data and remains responsible for its compliance obligations under Data Protection Legislation, including providing any required notices and obtaining any required consents, and for the processing instructions it gives to the Processor.

2.3

The subject matter, duration, nature and purpose of processing and the Personal Data categories and Data Subject types in respect of which the Processor may process to fulfill the Business Purposes shall be outlined in the Agreement and the Privacy Policy.

Processor's obligations

3.1

The Processor will only process the Personal Data to the extent, and in such a manner, as is necessary for the Business Purposes in accordance with the Privacy Policy. The Processor will not process the Personal Data for any other purpose or in a way that does not comply with this DPA or the Data Protection Legislation. The Processor must promptly notify the Controller if, in its opinion, the Controller's instruction would not comply with the Data Protection Legislation.

3.2

The Processor must promptly comply with any Controller request or instruction requiring the Processor to amend, transfer, delete or otherwise process the Personal Data, or to stop, mitigate or remedy any unauthorised processing.

3.3

The Processor will maintain the confidentiality of all Personal Data and will not disclose Personal Data to third parties unless the Controller or this DPA specifically authorizes the disclosure, or as required by law.

3.4

The Processor will reasonably assist the Controller with meeting the Controller's compliance obligations under the Data Protection Legislation.

3.5

The Processor shall promptly notify the Controller of any changes to Data Protection Legislation that may adversely affect the Processor's performance of the Agreement.

3.6

Notwithstanding the foregoing the Processor shall have the right, within law, to use the data generated in connection with its use of services to (i) analyze and improve services, and (ii) for statistical purposes. For such purposes, direct identifiers (such as name and email address) are removed prior to analysis. The Processor does not attempt to re-identify individuals from this data, and any incidental identifiers that may appear within URLs or other fields are not extracted or used for identification purposes. Once data has been processed in this manner, it is no longer treated as Personal Data.

3.7

The Processor shall not use Personal Data processed on behalf of the Controller for marketing, advertising, or promotional purposes, nor shall the Processor sell, rent, or otherwise commercially exploit such data.

3.8

If the Processor receives a request from a government authority, law enforcement agency, or court for disclosure of Personal Data processed on behalf of the Controller, the Processor shall (to the extent legally permitted) promptly notify the Controller before making any disclosure, to allow the Controller the opportunity to seek protective measures. Where prior notification is prohibited by law, the Processor shall notify the Controller as soon as the prohibition is lifted.

Processor's employees

4.1

The Processor will ensure that all employees:

(a)

are informed of the confidential nature of the Personal Data and are bound by confidentiality obligations and use restrictions in respect of the Personal Data;

(b)

have undertaken training on the Data Protection Legislation relating to handling Personal Data and how it applies to their particular duties; and

(c)

are aware of the Processor's duties and their personal duties under the Data Protection Legislation and this DPA.

4.2

The Processor will take reasonable steps to ensure the reliability, integrity and trustworthiness of and conduct background checks consistent with applicable law on all of the Processor's employees with access to the Personal Data.

Security

5.1

Security The Processor must at all times implement appropriate technical and organizational measures against unauthorized or unlawful processing, access, disclosure, copying, modification, storage, reproduction, display or distribution of Personal Data, and against accidental or unlawful loss, destruction, alteration, disclosure or damage of Personal Data.

5.2

The Processor shall implement measures to ensure a level of security appropriate to the risk involved, including as appropriate:

(a)

the pseudonymisation and encryption of personal data;

(b)

the ability to ensure the ongoing confidentiality, integrity, availability and resilience of the services;

(c)

the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident on its own systems; and

(d)

a process for regularly testing, assessing and evaluating the effectiveness of security measures.

Personal Data Breach

6.1

The Processor will without undue delay notify the Controller if any Personal Data is lost or destroyed or becomes damaged, corrupted, or unusable.

6.2

The Processor will without undue delay notify the Controller if it becomes aware of:

(a)

any accidental, unauthorized or unlawful processing of the Personal Data; or

(b)

a Personal Data Breach.

6.3

Following an unlawful Personal Data Breach, the parties will coordinate with each other to investigate the matter. The Processor will reasonably cooperate with the Controller in the Controller's handling of the matter.

6.4

The Processor agrees that the Controller has the sole right to determine:

(a)

whether to provide notice of the Personal Data Breach to any Data Subjects, supervisory authorities, regulators, or others, as required by law or regulation or in the Controller's discretion; and

(b)

whether to offer any type of remedy to affected Data Subjects, including the nature and extent of such remedy.

Cross-border transfers of personal data

7.1

Processor has the right to transfer data inside EEA and the UK to an extent necessary for efficient provisioning of the Services. Unless otherwise agreed in writing, Processor may also transfer or access personal data outside EEA. In case of transfer of personal data from European Union to destinations other than EEA countries and UK or countries which are recognized by the European Union with adequate level of legislation protecting Personal Data, Processor shall on behalf of the Controller implement proper safeguards and ensure that such transfers are subject to (i) the appropriate Module of the European Union Standard Contractual Clauses for The Transfer of Personal Data to Third Countries, version 2021 (attached as ANNEX A) or as superseded by European Commission implementing decision (“SCC”); or (ii) other appropriate transfer mechanisms that provide an adequate level of data protection in compliance with applicable data protection legislation.

7.2

Where the Processor relies on SCC’s for the purposes of justifying the transfer, the Processor will incorporate the mandatory part of the applicable Module of the SCC’s as set out in ANNEX A.

Subcontractors

8.1

Processor may make use of Sub-processors in providing the Services. This is outlined on the Push website. Processor will ensure that processing by its Sub-processors is always aligned with the purposes of the Agreement, this DPA, the Privacy Policy and any additional instructions agreed to by the parties.

8.2

Processor undertakes diligent vetting when choosing new Sub-processors. Processor’s Sub-processors are required to abide by the same level of data protection and security as Processor under this DPA. Processor has in place measures that are appropriate to the nature of the personal data and risks represented by the processing.

8.3

The Processor shall notify the Controller of any intended changes to Sub-processors (additions or replacements) by updating the Sub-processor list on the Push website and providing reasonable advance notice. The Controller may object to such changes on reasonable grounds related to data protection within 30 days of notification. If no objection is raised within that period, the change shall be deemed accepted.

Term and termination

9.1

This DPA will remain in full force and effect so long as:

(a)

the Agreement remains in effect; or

(b)

the Processor retains any Personal Data related to the Agreement in its possession or control (Term).

9.2

Any provision of this DPA that expressly or by implication should come into or continue in force on or after termination of the Agreement in order to protect Personal Data will remain in full force and effect.

9.3

If a change in any Data Protection Legislation prevents either party from fulfilling all or part of its obligations under the Agreement, the parties will suspend the processing of Personal Data until that processing complies with the new requirements. If the parties are unable to bring the Personal Data processing into compliance with the Data Protection Legislation within six (6) months, they may terminate the Agreement on written notice to the other party.

10.

Data return and destruction

10.1

At the Controller's request, the Processor will give the Controller a copy of or access to all or part of the Controller's Personal Data in its possession or control in the format and on media that is in accordance with standard industry practice.

10.2

On termination of the Agreement for any reason or expiry of its term, the Processor will securely delete or destroy or, if directed in writing by the Controller, return and not retain, all or any Personal Data related to this DPA in its possession or control, except for one copy that it may retain and use for as long as reasonably required for audit purposes only.

10.3

The Processor may retain any documents or materials where required to do so under any law, regulation, or government or regulatory body.

10.4

The Processor will certify in writing that it has destroyed the Personal Data following a written request from Controller.

11.

Records

11.1

The Processor will keep accurate and up-to-date written records regarding any processing of Personal Data it carries out for the Controller, including but not limited to, the access, control and security of the Personal Data, approved subcontractors and affiliates, the processing purposes and the technical and organizational security measures referred to in clause 5.1 (Records).

11.2

The Processor will ensure that the Records are sufficient to enable the Controller to verify the Processor's compliance with its obligations under this DPA and the Processor will provide the Controller with copies of the Records upon request.

11.3

The Controller and the Processor shall review the information listed in the Annexes to this DPA from time-to-time to confirm its current accuracy and update it when required to reflect current practices.

12.

Audit

12.1

During the validity of the Agreement, the Controller is permitted to audit Processor’s processes that are involved in processing personal data on behalf of the Controller. Any such audit shall be carried out via independent third party auditors reasonably acceptable to Processor and no more frequently than once every 12 months.

12.2

Any audit shall be conducted during regular business hours at Processor’s facilities and shall not unreasonably interfere with Processor’s business activities. The Controller needs to provide a minimum of thirty (30) day notice prior to the audit. The Controller or the auditor shall further provide an audit plan in advance to Processor. Processor shall provide the auditor with such cooperation and access to documents/records, properties and staff used in the performance of the Services as is reasonably necessary for an effective and efficient execution of the audit, and also subject to Processor’s right to refuse access to commercially or technically sensitive information, personal data, information regarding its customers or information that would be unlawful to disclose. Processor has the right of rejection to such portions of the plan that could potentially endanger Processor’s obligations to third parties or disrupt systems servicing other parties.

12.3

Controller will bear all of the costs of audit (including but not limited to costs of the auditor and costs arising from availability of requested Processor’s personnel). The Controller shall be liable for any and all damages caused by itself, or its third party auditor, when conducting the audit.

13.

Warranties

13.1

The Processor warrants that:

(a)

its employees, subcontractors, agents and any other person or persons accessing Personal Data on its behalf are reliable and trustworthy and have received the required training on the Data Protection Legislation relating to the Personal Data;

(b)

it and anyone operating on its behalf will process the Personal Data in compliance with the Data Protection Legislation;

(c)

it will take appropriate technical and organizational measures to prevent the unauthorized or unlawful processing of Personal Data and the accidental loss or destruction of, or damage to, Personal Data.

13.2

The Controller warrants that the Processor's expected use of the Personal Data for the Business Purposes and as specifically instructed by the Controller will comply with the Data Protection Legislation.

14.

Notice

14.1

Any notice or other communication given to a party under or in connection with this DPA must be in writing and delivered to:

For the Controller: The Customer point of contact who subscribes to the Service.

For the Processor: Please contact us through our web form or via email (privacy@pushsecurity.com) .

14.2

Clause 14.1 does not apply to the service of any proceedings or other documents in any legal action or, where applicable, any arbitration or other method of dispute resolution.

14.3

A notice given under this agreement is not valid if sent by email.

This Data Processing Agreement has been entered into on the date of the Agreement.

Annex A - Standard Contractual Clauses (“SCC”)
Annex B - UK Addendum to the EU SCC’s

ANNEX A Standard Contractual Clauses (“SCC”)

COVER LETTER TO THE SCC

This cover letter to the SCC sets out the Parties agreement to the applicable Module of SCC and the contents of Annexes I, II, and III to the SCC.

Applicable modules

The Parties agree that the Processor is located within the EEA or a country which is recognized by the European Union with adequate level of legislation protecting Personal Data, and that the Processor has been given authorisation by the Controller to transfer Personal Data to its Affiliate located outside the EEA or a country which is recognized by the European Union with adequate level of legislation protecting Personal Data. The Parties further agree and understand that the Controller acts as the data exporter and the Processor acts as the data importer within the meaning of and as set out below in this ANNEX A.

For the sake of clarity it is stated that the Parties have agreed that the applicable module of the SCC shall be the mandatory clause of MODULE TWO (Controller – Processor) excluding optional part of Clause 7 (‘Docking clause’) and Clause 11 (‘Redress’).

Annex I

A – List of Parties

MODULE TWO: Transfer controller to processor

Data exporter(s):

Name and address: The Customer, as set out in the Parties section to the Agreement. Contact person’s name, position and contact details: As outlined in the Notices section (clause 14).

Activities relevant to the data transferred under these Clauses: as outlined in the Agreement.

Role (controller/processor): Controller.

Data importer(s):

Name and address: Push Security Ltd, as set out in the Parties section to the Agreement.

Contact person’s name, position and contact details: As outlined in the Notices section (clause 14)

Activities relevant to the data transferred under these Clauses: As outlined in the Agreement.

Role (controller/processor): Processor.

Name and address: Push Security Inc.

Contact person’s name, position and contact details: As outlined in the Notices section (clause 14)

Activities relevant to the data transferred under these Clauses: As outlined in the Agreement.

Role (controller/processor): Processor.

B – Description of Transfer

Scope: For the purposes of providing the Service.

Nature and purpose of processing: To provide the Service in accordance with the Agreement, the scope and capabilities of which are configurable by the Customer's administrator.

Duration of processing: For the Term, and a backup retention period of up to 90 days thereafter.

Types of personal data: Personal Data that may be processed in delivery of the Service includes, but is not limited to: personal data of the Customer's employees, for example: name, corporate email address, browser client, web applications accessed. Also included is security metadata, including: identity security events and findings, as well as browser data and metadata related to attack detections. The Privacy Policy outlines comprehensive information about the types of Personal Data processed (see "Push as the data processor").

Categories of data subject: Any person authorised by the Customer to access the Customer's IT systems.

C – Competent Supervisory Authority

The competent supervisory authority is the Information Commissioner's Office (ICO).

Annex II – Technical and Organizational Measures including Technical and Organizational Measures to ensure the Security of the Data: As outlined in the Privacy Policy:

Annex III – List of Sub-Processors

A list of Sub-processors for delivery of the Service is here:

ANNEX B UK ADDENDUM TO EU SCC

This document contains the Standard Data Protection Clauses to be issued by the Commissioner under S119A(1) Data Protection Act 2018 in the form of the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (VERSION B1.0, in force 21 March 2022). The Addendum has been issued by the Information Commissioner for Parties making Restricted Transfers. The Information Commissioner considers that it provides Appropriate Safeguards for Restricted Transfers when it is entered into as a legally binding contract.

Part 1: Tables

Table 1: Parties

Start date	The Go Live Date, as outlined in the Order Form.
The Parties	Exporter (who sends the Restricted Transfer)	Importer (who receives the Restricted Transfer)
Parties’ details	Full legal name: Push Security Ltd Main address: 2 Kingdom Street, 6th Floor, London, UK, W2 6BD Company number: 12309408	Full legal name: As outlined in the Agreement br Main address: As outlined in the Agreement Registration number: As outlined in the Agreement
Key Contact	Full Name: Jacques Louw Contact: Jacques.Louw@PushSecurity.com	Full Name (optional): Contact details:

Table 2: Selected SCCs, Modules and Selected Clauses

Addendum EU SCCs

The Approved EU SCCs, including the Appendix Information and with only the following modules, clauses or optional provisions of the Approved EU SCCs brought into effect for the purposes of this Addendum:

	Module 1	Module 2	Module 3	Module 4
Module in operation	No	Yes	No	No
Clause 7 (Docking Clause)	N/A	No	N/A	N/A
Clause 11 (Option)	N/A	No	N/A	N/A
Clause 9a (Prior Authorisation or General Authorisation)	N/A	OPTION 2 (General)	N/A	N/A
Clause 9a (Time period)	N/A	90 days	N/A	N/A
Is personal data received from the Importer combined with personal data collected by the Exporter?	N/A	No	N/A	N/A

Table 3: Appendix Information

“Appendix Information” means the information which must be provided for the selected modules as set out in the Appendix of the Approved EU SCCs (other than the Parties), and which for this Addendum is set out in:

Annex 1A: List of Parties: The identity of the data exporter and data importer is populated with either Controller (the Client), Processor (Push Security Limited) and their contact details are set out in the DPA and this Addendum.

Annex 1B: Description of Transfer: MODULE TWO shall incorporate the description of processing in ANNEX A to the DPA.

Annex II: Technical and organisational measures including technical and organisational measures to ensure the security of the data: MODULE TWO shall incorporate the technical and organisational measures detailed in the DPA.

Annex III: List of Sub processors: MODULE TWO shall incorporate the list of Sub-Processors in the DPA.

Table 4: Ending this Addendum when the Approved Addendum Changes

Ending this Addendum when the Approved Addendum changes

Which Parties may end this Addendum as set out in Section 19:
Importer
Exporter

Part 2: Mandatory Clauses

Part 2: Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of those Mandatory Clauses.

Changelog

Date	Version	Comment
Feb 1 2021	0.1	Initial version.
Mar 21 2022	0.2	Incorporated ICO International Data Transfer Addendum (IDTA).
May 1 2025	0.3	Published DPA to website as standalone document. Clarified SCC definitions to distinguish EU and UK SCCs. Replaced UK Addendum Part 2 with updated ICO version.
Feb 12 2026	1.0	Adopted document control format