Data Processing Agreement

1. Parties and roles

You are the controller (or a processor for your own customer) of the personal data of visitors to the domains you add to GuardX. GuardX, the publisher identified in the Legal Notice, is your processor.

2. Subject matter and duration

GuardX processes personal data to provide the reverse-proxy, DDoS-mitigation and web-application-firewall service described in the Terms. The processing lasts as long as the domains are active on your account.

3. Nature and purpose, data and people concerned

• Purpose: receive, inspect, filter and forward web traffic; detect and block attacks and bots; show you security events and analytics.
• Data: IP addresses, requested URLs, request headers and cookies needed for filtering, user agents, TLS and browser fingerprints, behavioural signals, and challenge results. Request bodies are not stored unless you enable payload logging for attack requests on a plan that offers it.
• People: visitors to your websites and applications.

4. Our obligations

• Process the data only on your documented instructions, which are these terms and your settings in the dashboard, unless the law requires otherwise; in that case we tell you first when allowed.
• Make sure the people authorised to process the data are bound by confidentiality.
• Apply appropriate technical and organisational measures, including encryption in transit, access control, mandatory two-factor authentication for administrative access, logging of administrative actions, and separation between customers.
• Use only the subprocessors listed on the Subprocessors page, bound by equivalent obligations. We tell you of any addition or replacement at least 30 days in advance by email or in the dashboard. You may object on reasonable data-protection grounds in that period; if we cannot accommodate the objection, you may terminate the affected service.
• Help you answer requests from data subjects, and help you with security, breach notification, impact assessments and consultation with authorities, taking into account the nature of the processing.
• Notify you without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting your data.
• At the end of the service, delete the personal data processed for you, or return it on request, unless the law requires us to keep it. Security logs are removed at the end of their retention period.
• Give you the information needed to show compliance and allow audits by you or an auditor you appoint, with reasonable notice, during business hours, no more than once a year unless a breach requires otherwise, and subject to confidentiality and to the protection of other customers’ data.

5. Your obligations

You must have a lawful basis for the processing, inform your visitors (for example in your privacy policy), and give us lawful instructions. You are responsible for the content of your sites.

6. International transfers

Where a subprocessor operates outside the European Economic Area, the transfer is covered by an adequacy decision or by the European Commission’s standard contractual clauses, which are incorporated here by reference.

7. Liability and law

The liability terms of the Terms of Service apply. This agreement is governed by French law.

8. Contact

Data-protection questions: contact@guardx.fr.