Data Processing Agreement (DPA)
Public reference copy · BlackCrypt legal · Version 2026.2
This Data Processing Agreement (“DPA”) forms part of the BlackCrypt Online Service Terms (“OST”) between BlackCrypt and the Customer identified in the account and billing information. For Customer Data, Customer acts as controller or processor, as applicable, and BlackCrypt acts as processor or sub-processor as described below. Capitalised terms not defined here have the meaning given in the OST.
This DPA describes how BlackCrypt processes personal data on your behalf when you use the Service. It clarifies roles, subject matter, retention, sub-processing, international transfers, security measures and the allocation of responsibilities under GDPR.
- Roles: for Customer Data, Customer acts as controller or processor, as applicable. Where Customer acts as controller, BlackCrypt acts as processor. Where Customer acts as processor for an end customer, BlackCrypt acts as Customer’s sub-processor. For account, billing and platform telemetry, BlackCrypt may act as independent controller as described in its Privacy Policy.
- Subject matter: processing personal data contained in encrypted-traffic metadata in order to provide the Service, generate Results and reports, and operate and secure the platform.
- No training on Customer Data: Customer Data under this DPA is not used to train, retrain, fine-tune, benchmark or evaluate detection, AI or machine-learning models reused across customers; any such use would require a separate explicit written opt-in agreement.
- Sub-processors & transfers: BlackCrypt may use listed sub-processors (e.g. hosting, Geo-IP, TI providers) under GDPR-compliant contracts and international transfer mechanisms; you are informed of changes and may object on reasonable grounds.
- Retention & deletion: PCAPs and capture-derived raw artefacts are deleted after each analysis completes or irrecoverably fails. Derived Results and report artefacts are retained for 90 days by default while the analysis remains available in the Service, unless deleted earlier or retained longer where legally or operationally required. Operational logs are retained for up to 180 days by default, with deletion propagating to backups within 30 days according to the backup lifecycle.
- Assistance: BlackCrypt assists you, as far as reasonably possible, with data-subject requests, security, breach notifications and DPIAs given the nature of processing and information available.
- Liability framework: the liability limitations and caps agreed in the OST (including the Advanced vs Basic distinction) also apply to this DPA to the extent permitted by law.
Under this DPA, BlackCrypt processes personal data in Customer Data in connection with the provision of the Service, including analysis of encrypted network traffic and generation of Results and Reports, as described in the OST. Where Customer acts as controller, BlackCrypt acts as processor. Where Customer acts as processor for an end customer, BlackCrypt acts as Customer’s sub-processor.
BlackCrypt processes personal data under this DPA only for the following purposes:
- to ingest and analyse Customer Data (e.g. PCAPs and derived telemetry) and generate Results and reports;
- to provide, maintain and secure the Service (including logging, monitoring and abuse-prevention);
- to provide support and handle incidents or issues reported by Customer; and
- to comply with legal obligations applicable to BlackCrypt and respond to lawful requests from public authorities, where required by law.
Plain language — what we do with Customer Data
BlackCrypt uses Customer Data only to run analyses you request, keep the Service secure and reliable, assist you with support and incidents, and comply with legal obligations. There is no other hidden purpose for the data covered by this DPA.
This DPA applies for as long as BlackCrypt processes personal data in Customer Data under the OST, whether as processor or sub-processor, and remains in effect until deletion or return of such personal data in accordance with Section 9 (Deletion and Return of Data).
Where Advanced Analysis or enrichment features are used, BlackCrypt may enrich relevant public-routable destination IP addresses observed in Customer Data using Geo-IP and IP reputation or threat-intelligence providers. Enrichment is IP-centric and is used to provide security context, triage signals, and Results.
Private, reserved, invalid, or non-routable IP addresses are excluded from external enrichment where applicable. BlackCrypt does not send packet payloads to threat-intelligence providers. Third-party threat-intelligence data is provided by those sources as-is and may change after the analysis snapshot.
For Customer Data processed through the Service, Customer acts as controller or processor, as applicable. Where Customer acts as controller, BlackCrypt acts as processor. Where Customer acts as processor for an end customer, BlackCrypt acts as Customer’s sub-processor. Customer is responsible for ensuring that it has authority to appoint BlackCrypt and to issue processing instructions for the relevant Customer Data.
For account, billing, payment, support, abuse-prevention, security, and platform telemetry data processed for BlackCrypt’s own purposes, BlackCrypt may act as an independent controller as described in its Privacy Policy.
The Processor will process personal data only on documented instructions from the Controller, including with regard to transfers of personal data to a third country or international organisation, unless required to do so by Union or Member State law to which the Processor is subject. In that case, the Processor will inform the Controller of that legal requirement before processing, unless the law prohibits such information on important grounds of public interest.
The OST, this DPA, Customer’s use of the Service (including configuration in the dashboard) and any written instructions given through the support channels constitute Customer’s documented instructions. Customer is responsible for ensuring that its instructions comply with applicable law, including GDPR.
Customer is responsible for ensuring a lawful basis for processing Customer Data, providing required transparency to data subjects, handling data-subject rights, and ensuring that its use of the Service complies with employment, telecommunications, cybersecurity, sector-specific, and data-protection laws applicable to Customer.
If Customer shares Results, Reports, or personal data derived from Customer Data with its own vendors, consultants, MSSPs, incident-response providers, auditors, or other downstream processors, Customer remains responsible for ensuring that appropriate GDPR-compliant contracts, instructions, confidentiality obligations, and safeguards are in place.
In the context of the Service, Customer may submit or cause to be captured personal data including:
- network-level identifiers (e.g. public IP addresses, ports, protocol metadata, TLS handshake parameters);
- timestamps and session identifiers relating to network connections;
- domain names or hostnames that may be associated with natural persons (e.g. SNI fields);
- user identifiers or device identifiers where encoded in Customer Data; and
- any additional metadata the Controller chooses to include in Customer Data or support tickets.
The Service is designed for encrypted traffic metadata. BlackCrypt does not decrypt TLS payloads or reconstruct cleartext application content, and Customer should avoid intentionally submitting decrypted payloads, cleartext application content, or unrelated sensitive data.
Depending on how Customer uses the Service and captures traffic, data subjects may include:
- employees, contractors and other staff of the Controller or its affiliates;
- users of the Controller’s networks or services (e.g. customers, visitors); and
- third parties whose communications traverse the Controller’s networks.
The Service is not intended to process special categories of personal data within the meaning of Article 9 GDPR. Customer must not intentionally capture or submit such data to the Service. If such data is nevertheless incidentally present in network metadata, both parties will treat it with appropriate safeguards.
Plain language — scope of data
The Service is built for encrypted traffic metadata (IPs, ports, TLS parameters, etc.), not for payload contents or sensitive special-category data. You should avoid intentionally sending such special data to the Service.
BlackCrypt shall comply with the obligations of a processor or sub-processor under GDPR in relation to processing of personal data under this DPA, including Articles 28 and 32–36 where applicable.
BlackCrypt shall ensure that persons authorised to process personal data are subject to appropriate confidentiality obligations, whether contractual or statutory, and are informed of the confidential nature of the data and the obligations under this DPA.
Taking into account the state of the art, costs of implementation and the nature, scope, context and purposes of processing as well as the risks for data subjects, BlackCrypt shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:
- encryption of Customer Data in transit and at rest;
- access controls based on least privilege and multi-factor authentication;
- segregation of Customer environments where applicable;
- logging and monitoring of access and security-relevant events; and
- controlled deletion, backup lifecycle and business continuity measures.
BlackCrypt shall not use Customer Data, PCAPs, derived Results, Reports, or personal data contained in Customer Data to train, retrain, fine-tune, benchmark, or evaluate general-purpose detection, AI, or machine-learning models reused across customers, except under a separate explicit written opt-in agreement.
BlackCrypt may use aggregated and de-identified service analytics, such as uptime, error rates, capacity metrics, queue statistics, and non-identifying product telemetry, to operate, secure and improve the Service, provided that such analytics do not identify Customer, Customer users, data subjects, or Customer Data.
Important — no model training on your traffic
Under this DPA, Customer Data is processed only to provide the Service and related security/operations. It is not used as training, benchmarking, evaluation, retraining, or fine-tuning material for detection or AI models unless a separate explicit written opt-in agreement applies.
Taking into account the nature of processing and the information available to BlackCrypt, BlackCrypt shall assist Customer, in so far as reasonably possible, in:
- responding to data-subject requests under Chapter III GDPR (e.g. access, erasure, restriction);
- ensuring compliance with Articles 32–36 GDPR (security, breach notification, DPIAs and prior consultation); and
- meeting record-keeping and accountability obligations relating to the processing carried out under this DPA.
Customer grants BlackCrypt general written authorisation to engage sub-processors for the processing described in this DPA. Current categories of sub-processors for Customer Data may include infrastructure, hosting, storage, backup, logging, monitoring, email/support, Geo-IP, and IP reputation or threat-intelligence providers.
Geo-IP and IP reputation or threat-intelligence providers may process public-routable destination IP addresses from relevant Customer Data for enrichment purposes. Examples may include providers such as IPinfo, AlienVault OTX, and AbuseIPDB, where enabled or used by the Service.
BlackCrypt will maintain a sub-processor list or make sub-processor information available through the Service, legal documentation, or on request.
BlackCrypt shall impose on sub-processors data-protection obligations that are no less protective than those set out in this DPA, including with respect to security, confidentiality, data-subject rights and deletion. BlackCrypt remains responsible towards Customer for the acts and omissions of sub-processors in relation to processing of personal data under this DPA.
BlackCrypt shall inform Customer of intended changes concerning the addition or replacement of sub-processors (for example, via the Service, email, or a public list) and give Customer an opportunity to object on reasonable data-protection grounds. If Customer reasonably objects and the parties cannot find a mutually acceptable solution, Customer may terminate the affected Service to the extent it cannot be provided without the relevant sub-processor, without penalty, as Customer’s sole remedy.
Where BlackCrypt or its sub-processors transfer personal data to a third country or international organisation, BlackCrypt shall ensure that such transfers comply with GDPR Chapter V, including, where applicable:
- reliance on an adequacy decision by the European Commission, or
- implementation of appropriate safeguards such as EU Standard Contractual Clauses (SCCs) or equivalent instruments, together with supplementary measures where required.
Where required, BlackCrypt will take reasonably available supplementary measures appropriate to the transfer, the data involved, and the sub-processor service used.
Details of relevant transfer mechanisms and sub-processor locations are available from BlackCrypt on request and/or in the sub-processor list. Where a transfer mechanism used by the Processor is invalidated or modified, BlackCrypt will work in good faith with the Controller to update the mechanism or adopt an alternative solution.
Taking into account the nature of processing, BlackCrypt shall, to the extent reasonably possible, assist Customer by appropriate technical and organisational measures in fulfilling obligations to respond to requests to exercise rights of data subjects under GDPR (including rights of access, rectification, erasure, restriction, portability and objection).
If BlackCrypt directly receives a request from a data subject relating to Customer Data, BlackCrypt will, where reasonably identifiable, forward the request to Customer without undue delay and will not respond directly unless authorised or required by law.
In the event of a personal-data breach concerning personal data processed under this DPA, BlackCrypt shall notify Customer without undue delay after becoming aware of the breach. The notification shall include information that the Processor is reasonably able to provide at the time, including:
- a description of the nature of the breach, including, where possible, categories and approximate number of data subjects and records concerned;
- the likely consequences of the breach; and
- measures taken or proposed to address the breach and mitigate possible adverse effects.
Where not all information can be provided at once, it may be provided in phases without undue further delay. BlackCrypt will cooperate with Customer and provide reasonable assistance in relation to any required notifications to supervisory authorities or data subjects, taking into account Customer’s responsibilities under GDPR.
Unless Customer instructs earlier deletion, an agreed enterprise retention setting applies, or law requires longer retention:
- Inputs: uploaded PCAPs and capture-derived raw artefacts used solely for analysis are deleted automatically after the analysis completes or irrecoverably fails, subject only to technical backup cycles;
- Results: derived analysis outputs, metadata and generated report artefacts are encrypted at rest and retained for 90 days by default while the analysis remains available in the Service, unless deleted earlier by Customer or retained longer where required by law, security investigation, dispute handling, or an agreed enterprise retention setting;
- Reports: reports can be generated while the relevant analysis exists. Once an analysis is deleted or expires, new reports can no longer be generated and stored report artefacts are removed according to Results retention;
- Operational logs: security, abuse-prevention, support and audit logs that may contain IP addresses and technical identifiers are retained for up to 180 days by default, unless longer retention is required for legal, tax, security, incident-response, or dispute reasons; and
- Backups: deletion propagates to backups within 30 days according to the backup lifecycle, unless backup isolation is legally or operationally required.
Plain language — retention and deletion
PCAPs and capture-derived raw artefacts are deleted after each analysis. Results and report artefacts stay available for 90 days by default unless you delete them earlier or a different agreed retention rule applies. Operational logs are kept for up to 180 days by default, and backup deletion propagates within 30 days.
Upon termination of the Service or upon Customer’s written request, BlackCrypt shall delete (or, at Customer’s option and where technically feasible, return) personal data processed under this DPA, except where continued storage is required by Union or Member State law or is technically necessary in backups for a limited transition period according to the backup lifecycle described in Section 9.1. Where data is returned, it shall be provided in a commonly used machine-readable format.
BlackCrypt shall make available to Customer all information reasonably necessary to demonstrate compliance with the obligations set out in Article 28 GDPR and this DPA and, at Customer’s reasonable cost, shall allow for and contribute to audits, including inspections, conducted by Customer or another auditor mandated by Customer, subject to the following conditions:
- audits must be limited to information and facilities relevant to the processing under this DPA;
- audits must be conducted during normal business hours, upon reasonable prior written notice, and in a manner that minimises disruption to BlackCrypt’s operations; and
- Customer and any auditor must be bound by confidentiality obligations and security instructions specified by BlackCrypt.
Where possible, BlackCrypt may satisfy audit obligations by providing up-to-date third-party certificates, reports or attestations (for example, ISO certifications or independent security assessments) that demonstrate relevant controls.
The parties acknowledge that, as between them, Customer is responsible for:
- the lawfulness of the processing of personal data in Customer Data under GDPR and other applicable laws;
- obtaining all necessary notices, consents, authorisations and transparency notices required for the relevant processing;
- determining or ensuring the appropriate lawful basis for processing, including where Customer acts as processor for an end customer;
- ensuring that it has authority to appoint BlackCrypt as processor or sub-processor, as applicable; and
- ensuring that its use of the Service complies with employment, telecommunications, cybersecurity, sector-specific and data-protection rules.
BlackCrypt is responsible for complying with the obligations assigned to a processor or sub-processor under this DPA and GDPR. Liability limitations and exclusions agreed in the OST apply also to this DPA to the extent permitted by law, subject to the carve-outs and mandatory rights described in the OST and applicable data-protection law. Nothing in this DPA limits liability where such limitation is prohibited by law, including for wilful misconduct or gross negligence, or for data-subject rights and remedies mandated by GDPR.
Summary — allocation of responsibility
- You decide what Customer Data is captured and why, ensure a lawful basis, and handle notices, consents, transparency, and downstream processing responsibilities.
- BlackCrypt implements appropriate security and processes Customer Data only on documented instructions and for the purposes described in this DPA and the OST, acting as processor or sub-processor as applicable.
- The liability framework and caps agreed in the OST also apply to processing under this DPA, subject to the mandatory GDPR and local-law carve-outs.
This DPA is governed by the same law and subject to the same jurisdiction as the OST, as described in Section 16 of the OST, without prejudice to mandatory rules under GDPR, applicable data-protection law, consumer-protection law, or the habitual-residence law of relevant data subjects where such rules cannot be waived.
In case of conflict between this DPA and the OST, this DPA prevails for data-protection matters. For service, commercial, report-use, payment, IP, export-control, liability, non-reliance, and other non-data-protection matters, the OST prevails.
Report legal notices, dashboard help text, FAQs, generated reports, or other informational surfaces do not modify this DPA unless expressly incorporated into this DPA, the OST, or a separately signed agreement.
BlackCrypt may update this DPA to reflect changes in law, supervisory guidance, or sub-processing arrangements. Material changes will be communicated to Customer in advance, and if Customer reasonably objects on data-protection grounds and no resolution is found, Customer may terminate the affected Service as its sole remedy.
If any provision of this DPA is held invalid or unenforceable, the remaining provisions remain in full force and effect. This DPA, together with the OST, reflects the parties’ agreement regarding processing of personal data in the context of the Service, except where the parties have executed a more specific, signed data processing agreement that expressly supersedes it.
This DPA is concluded in writing, including electronic form, through the legal acceptance flow in the Service or another accepted written or electronic acceptance mechanism.