Data Processing Agreement (DPA)
Version: 1.0
Last updated: 30/10/2026
This Data Processing Agreement ("DPA") describes how Nulink Security OOD ("Nulink") processes personal data in connection with Nulink Cloud and Nulink Exposure Management (each a "Product").
This DPA forms part of the Master Subscription Agreement ("MSA") between Nulink and the Client, and applies where an Order Form states that it applies, or where Nulink processes personal data on the Client's behalf. Capitalized terms not defined here have the meaning given in the MSA.
1. Parties and Roles
1.1. Nulink as processor
With respect to Client Content that contains personal data, the Client is the controller and Nulink is the processor. Nulink processes that personal data only on the Client's behalf and in accordance with its instructions.
1.2. Nulink as independent controller
Nulink acts as an independent controller for the personal data it processes for its own purposes, including account administration, authentication, billing, service communications, security monitoring, product telemetry and legal compliance. That processing is described in the Privacy Policy, and Section 10.1 of the MSA refers to it.
1.3. Relationship between the two roles
The two roles are distinct and apply to different data. Nulink is a processor for what the Client and its Authorized Users put into, or have scanned by, the Product. Nulink is an independent controller for the data it needs to run its business and operate the platform. Where an Order Form applies this DPA, the processor terms in this DPA govern Client Content, and prevail over any general statement in the MSA to the contrary, in accordance with Section 1.3 of the MSA.
1.4. Partner and white-label arrangements
Where the Client has purchased through a Nulink Partner under a Partner Agreement, the Partner is the controller and Nulink is the processor with respect to Client Content that includes personal data. Nulink may be named as a sub-processor in the Partner's privacy notices and legal terms.
2. Details of Processing
| Item | Detail |
|---|---|
| Subject matter | Provision of the Product and related Services to the Client |
| Duration | The Subscription Term, plus the retention periods in Section 8 |
| Nature of processing | Collection, recording, organisation, storage, analysis, correlation, retrieval, disclosure to the Client, and erasure |
| Purpose | To provide the Product and Services to the Client, including discovery, scanning, risk analysis, alerting, reporting and support |
| Special categories | None. The Product is not intended for, and must not be used to process, special categories of personal data |
2.1. Categories of data subjects
- The Client's Authorized Users (employees, contractors and agents)
- Individuals whose data appears in the Client's monitored assets and scan results
2.2. Categories of personal data
Authorized Users: names, business email addresses, job titles, and login and authentication data.
Incidentally contained in scan results: personal data appearing in the Client's assets and in the results of scanning those assets, such as email addresses, IP addresses, and domain registration contact details.
Nulink Exposure Management additionally processes: staff email addresses and associated credentials appearing in breach corpora already in public circulation, searched against domains the Client has verified; and contact details contained in WHOIS and RDAP registration records and in crawled or archived web content for those domains.
Nulink Exposure Management only scans root domains that the Client has verified by publishing a DNS TXT record issued by Nulink. That record is the Client's proof of ownership and authorisation. Removing the record takes the domain out of scope. Scanning is unauthenticated and read-only: the Product does not log in, does not submit forms, and does not hold the Client's credentials.
3. Nulink's Obligations as Processor
Nulink will:
3.1. Process Client Content containing personal data only on the Client's documented instructions, including as set out in the MSA, the applicable Order Form and this DPA, and as required to provide the Product and Services.
3.2. Notify the Client if, in Nulink's opinion, an instruction infringes applicable data protection law, unless prohibited from doing so by law.
3.3. Ensure that personnel authorised to process personal data are bound by confidentiality obligations and receive appropriate data protection training, and grant access only on a need-to-know basis.
3.4. Implement and maintain the technical and organisational measures described in Section 5.
3.5. Assist the Client, at the Client's cost where the assistance is more than minimal, in responding to data subject requests and in meeting its obligations relating to security, breach notification, data protection impact assessments and prior consultation with supervisory authorities.
3.6. Comply with applicable privacy and personal data protection laws, including, where relevant, the EU General Data Protection Regulation ("GDPR").
4. Client's Obligations as Controller
The Client will:
4.1. Ensure it has a valid legal basis for the collection and processing of all Client Content it submits to, or has scanned by, the Product, and for Nulink's processing of it on the Client's behalf.
4.2. Only add domains, cloud accounts and repositories that it owns or is authorised to assess, in accordance with the Acceptable Use Policy and Section 7 of the MSA.
4.3. Not collect, access, use or share sensitive personal data without proper authorisation and lawful basis, or in violation of applicable data protection laws, as set out in Section 7.7 of the MSA.
4.4. Provide any notices and obtain any consents required from data subjects, including its own personnel whose credentials may appear in breach data.
4.5. Be responsible for the integrity and completeness of its Client Content, and for the accuracy of the instructions it gives Nulink.
As set out in Section 13.3 of the MSA, the Client indemnifies Nulink against third-party claims arising from Client Content, including its collection and use in the Product without a proper legal basis.
5. Security Measures
Nulink maintains appropriate technical and organisational measures designed to protect Client Content against unauthorised access, loss, alteration or corruption, including:
- Encryption of data in transit and at rest
- Access control, including role-based access, least-privilege provisioning and multi-factor authentication for administrative access
- Logical segregation of Client Content between tenants
- Logging and monitoring of access to production systems
- Backup and recovery procedures
- Vulnerability management and patching of Nulink's own infrastructure
- Secure development practices and change management through release and version control
- Personnel measures, including confidentiality undertakings and security training
Nulink may update these measures over time, provided the overall level of protection is not reduced.
6. Sub-processors
6.1. Authorisation. The Client authorises Nulink to engage sub-processors to process Client Content.
6.2. Current sub-processors.
| Sub-processor | Purpose | Processing location |
|---|---|---|
| Amazon Web Services, Inc. | Cloud hosting and infrastructure | Hosting region as stated in the Order Form |
| Google LLC | Business productivity, email and identity administration | United States / global |
Additional or Client-specific sub-processors may be listed in the applicable Order Form.
6.3. Notice of changes. Where Nulink decides to use a new sub-processor, it will notify the Client in advance, as set out in Section 15.6 of the MSA. If the Client has a reasonable, documented data protection objection, the parties will discuss it in good faith; if it cannot be resolved, the Client may terminate the affected Order Form.
6.4. Flow-down and responsibility. Nulink imposes data protection obligations on each sub-processor that are no less protective than those in this DPA, and remains responsible for its sub-processors' performance.
7. International Transfers
7.1. Hosting region. Client Content is hosted in the region stated in the applicable Order Form. Available regions include regions outside the European Economic Area, including in the United States.
7.2. EEA transfers. For EU and EEA clients, any transfer of personal data outside the EEA will comply with the GDPR, as set out in Section 10.4 of the MSA. Where no adequacy decision applies, Nulink relies on the European Commission's Standard Contractual Clauses, together with supplementary measures where required following a transfer impact assessment.
7.3. The Client should select its hosting region on the Order Form in line with its own data residency requirements.
8. Retention, Return and Deletion
8.1. During the Subscription Term, Client Content is retained to provide the Product and Services.
8.2. On termination or expiry, for 30 days the Client may retrieve or receive a copy of its Client Content upon request. Nulink will delete Client Content from its active systems within 90 days after termination, unless applicable data protection law stipulates a different retention period. This reflects Section 9.7 of the MSA.
8.3. Spending Cap (pay-as-you-go plans). When scanning stops because a Spending Cap has been reached, existing Client Content remains visible in read-only mode for 30 days. If the Spending Cap has not been increased by the end of that period, Nulink will delete all Client Content collected by scanning from its active systems. Deleted Client Content cannot be restored. This reflects Section 8.7 of the MSA.
8.4. Partner wind-down. In white-label arrangements, during the Wind-Down Period and for 30 days afterwards the Client may retrieve a copy of its Client Content, and Nulink will delete it from active systems within 90 days after the Wind-Down Period.
8.5. Backups are overwritten on their ordinary rotation cycle.
9. Personal Data Breaches
9.1. Nulink will notify the Client without undue delay, and in any event within 48 hours, after becoming aware of a confirmed personal data breach or security incident affecting Client Content, as set out in Section 10.3 of the MSA and Section 10.4 of the Partner Agreement.
9.2. The notification will include the information reasonably available to Nulink at the time, including the nature of the incident, the categories and approximate volume of data affected, the likely consequences, and the measures taken or proposed.
9.3. Nulink will provide reasonable cooperation in the investigation and remediation of the incident.
9.4. Notification does not constitute an acknowledgement of fault or liability.
To report a suspected vulnerability or incident, see Security & Responsible Disclosure.
10. Data Subject Requests
10.1. The Product provides the Client with the means to access, correct, export and delete Client Content.
10.2. Where Nulink receives a request directly from a data subject relating to Client Content, it will not respond substantively but will refer the request to the Client without undue delay, unless legally required to respond.
10.3. Nulink will provide reasonable assistance to the Client in responding to such requests.
For requests relating to data for which Nulink is the independent controller, see the Privacy Policy.
11. Audits and Information
11.1. Nulink will make available to the Client the information reasonably necessary to demonstrate compliance with this DPA, including documentation of its technical and organisational measures and any available third-party assessment reports.
11.2. Where that information is not sufficient, the Client may request an audit of Nulink's policies, procedures, documents and records that directly relate to the processing of Client Content. Audits are subject to reasonable advance written notice, are limited to once in any 12-month period unless required by a supervisory authority or following a personal data breach, take place during business hours, must not unreasonably disrupt Nulink's operations, and are subject to the confidentiality obligations in Section 11 of the MSA.
11.3. Audit findings are the Confidential Information of both parties.
12. Liability
12.1. Each party's liability under or in connection with this DPA is subject to the exclusions and the liability cap in Section 14 of the MSA.
12.2. Nothing in this DPA limits any liability that cannot be limited under applicable data protection law, including liability to data subjects.
13. General
13.1. Precedence. In case of conflict, the Order Form prevails over this DPA and the MSA, in accordance with Section 1.3 of the MSA. In case of conflict between this DPA and the MSA on the processing of personal data as described in Section 1.3 above, this DPA prevails.
13.2. Governing law. This DPA is governed by the laws of the Republic of Bulgaria, and disputes are subject to the exclusive jurisdiction of the competent courts of Bulgaria, as set out in Sections 15.2 and 15.3 of the MSA.
13.3. Changes. Nulink may update this DPA in accordance with Section 15.8 of the MSA. Material changes will be delivered to the Client for acknowledgement and acceptance.
13.4. Survival. This DPA survives termination of the MSA for as long as Nulink processes Client Content containing personal data.
14. Contact
For data protection enquiries, data subject requests, or to request an audit or sub-processor information:
Nulink Security OOD
Bul. Svoboda 79, floor 4, Plovdiv 4001, Bulgaria
Registration number: 208781115
Clients and data subjects in the EU may also lodge a complaint with their local supervisory authority, or with the Bulgarian Commission for Personal Data Protection (CPDP).