Scope and roles
For personal information in Customer Data, the customer is the responsible party under POPIA (the controller under the GDPR) and DarkRisk is the operator (the processor). These terms meet section 21 of POPIA and Article 28 of the GDPR.
DarkRisk is the responsible party, and these terms do not apply, for information it processes for its own purposes: customer account, billing and security records, website visitors, and DarkRisk Data such as scan results, ratings and breach and exposure intelligence, as described in our privacy policy.
Processing on instructions
DarkRisk processes customer personal information only to provide the Services and on the customer’s documented instructions, which are the agreement, these terms and the customer’s use and configuration of the platform, unless the law requires otherwise. In that case we will tell the customer first unless the law prohibits it. We will tell the customer if we believe an instruction breaks the law, and may decline to follow it.
What is processed
- Purpose and nature. Hosting, storing, analysing and transmitting Customer Data to provide Cyber Risk Management, including third-party risk management, questionnaires, document review, reporting, support and, where enabled, AI-assisted features.
- People concerned. The customer’s users; staff of vendors and other third parties the customer invites or names; and people mentioned in questionnaire answers, documents and comments.
- Information. Names, business contact details, roles, sign-in and activity records, and any personal information contained in answers, documents and comments.
- Duration. The term of the agreement and the deletion period that follows, as set out below.
The customer must not submit special personal information, personal information of children, or account credentials unless the agreement expressly allows it.
Customer obligations
The customer warrants that it has a lawful basis for the processing it instructs, has given the people concerned any notice required, and has obtained any consent required, and that its instructions comply with the law. The customer is responsible for the accuracy of Customer Data and for responding to people who exercise their rights against it.
Confidentiality
Everyone authorised to process customer personal information is bound by confidentiality, and access is limited to those who need it to provide or support the Services.
Security
DarkRisk maintains appropriate technical and organisational measures, as section 19 of POPIA and Article 32 of the GDPR require, including encryption in transit; encryption at rest for databases, file storage, caches and backups; role-based access controls; multi-factor authentication; and audit logs of sign-ins, multi-factor checks and protected account actions. Details are available at trust.darkrisk.io. We may update these measures, provided the overall level of protection is not reduced.
Subprocessors
The customer authorises the subprocessors listed at trust.darkrisk.io, including AI model providers for features enabled for the customer. We impose data protection obligations on them that are no less protective than these terms, and remain responsible for their performance.
We will give notice of new subprocessors 60 days in advance. The customer may object on reasonable data protection grounds within that period. If we cannot address the objection, the customer may terminate the affected Service, and we will refund prepaid fees for the unused remainder of its term; that is the customer’s only remedy for the objection.
International transfers
Where personal information is transferred outside South Africa or the European Economic Area, we rely on a lawful transfer mechanism, as section 72 of POPIA and Chapter V of the GDPR permit, such as a recipient bound by a binding agreement providing adequate protection or the European Commission’s Standard Contractual Clauses, which are incorporated by reference where they are needed. The customer authorises transfers to the locations of the listed subprocessors.
Security compromises
Where there are reasonable grounds to believe that customer personal information has been accessed or acquired by an unauthorised person, DarkRisk will notify the customer immediately, as section 21(2) of POPIA requires, and in any case without undue delay. We will give the information reasonably available to us that the customer needs to meet its own obligations, including notifying the Information Regulator and the people concerned, update it as the investigation progresses, and take reasonable steps to contain the compromise. Notice of a compromise is not an admission of fault or liability.
Assistance and rights requests
Taking into account the nature of the processing, DarkRisk will help the customer respond to requests from people exercising their rights, and with impact assessments and consultations with regulators. Requests we receive directly will be passed to the customer and not answered by us unless the customer asks. The platform’s own tools are provided at no extra charge; other assistance may be charged at our standard rates.
Return and deletion
When the agreement ends and the customer’s organisation is deleted, DarkRisk keeps customer personal information for 180 days, during which the customer can ask for its organisation to be restored or its data exported, and then deletes it, unless the law requires it to be kept. Sign-in accounts of the customer’s users that give access to no other customer are deleted once they have given access to no customer for at least 120 days. DarkRisk keeps the billing records and support records the law or its legitimate interests require. Copies in backups are deleted or overwritten within 30 days and remain protected until then.
Information and audits
DarkRisk will make available the information reasonably needed to show compliance with these terms, including security documentation, and will answer reasonable written questions. Where that is not enough, or a regulator requires it, the customer may audit our compliance, no more than once in any 12 months, on at least 30 days’ written notice, during business hours, at its own cost, through an independent auditor bound by confidentiality, and without access to other customers’ data or to information that would compromise security. Contact compliance@darkrisk.io.
Liability
Each party’s liability under these terms is subject to the exclusions and limits in the terms of service.