Legal
Data processing agreement
Where Revelion processes personal data on your behalf, this is the agreement that governs it.
01
Scope
What the DPA covers
Where Revelion processes personal data on your behalf, it does so as a processor and you remain the controller.
- Subject matter
- Processing carried out to deliver security testing against the estates you authorise.
- Categories of data
- Account and contact data, plus any personal data incidentally encountered during authorised testing.
- Duration
- For the term of the agreement, plus the retention period set out in the privacy policy.
- Instructions
- Processing happens on your documented instructions and within the scope you declared.
02
Commitments
What we undertake
- Confidentiality
- Personnel with access are bound by confidentiality obligations.
- Security measures
- Technical and organisational measures appropriate to the risk, described in the Trust Centre.
- Sub-processors
- Published and maintained on the sub-processors page, with notice available on request.
- Assistance
- Reasonable assistance with data subject requests, impact assessments and breach notification.
- Deletion and return
- On termination, data is deleted or returned according to your instruction.
- Audit
- Information necessary to demonstrate compliance, made available on request.
Executing it
How to get the DPA in place
The DPA is available on request and can be executed as part of onboarding or alongside an existing agreement. Most procurement teams want it reviewed before access is granted, which is fine and expected.
If your organisation requires its own paper rather than ours, send it over. We would rather review your template than delay a security assessment over document preference.
Contact us and we will send the current version. Testing an estate that contains personal data should not begin before this is settled.