Data Processing Agreement

This DPA applies where we process personal data on your behalf, and forms part of the Terms of Service. It takes effect when you accept the Terms — you do not need to sign or return anything. If your procurement process needs a countersigned copy, ask and we will send one.

Version 1.0 · Effective 26 August 2026 · Article 28 GDPR · Governing language: English

1. Scope and roles

1. This DPA is between you ("Controller") and File Master LLC, Serena app., office C13, Golden Sands, Varna 9007, Bulgaria, VAT 180842207 ("Processor").
2. It covers personal data of visitors to your sites, which we receive through the snippet and your gateway and process to produce verdicts.
3. It does not cover your own account data — your name, email, team and billing. For that we are a controller in our own right and the Privacy Policy applies.
4. You confirm that you are the controller of the visitor data, or that you act with the authority of the controller, and that you have a lawful basis for the processing you instruct.

2. Subject matter of the processing

Set out in Annex 1. In summary: we receive signals about sessions on your sites, score each session, return a verdict, and retain the record for the period in Annex 1 so that you can investigate a disputed decision.

3. Processing on instructions

1. We process personal data only on your documented instructions. Your instructions are: this DPA, the Terms, and the configuration of your account — the sites you add, the capture rules you write, the lists you maintain, and the switches you set.
2. Changing your configuration changes your instruction. Enabling value-mode field capture on a selector instructs us to receive whatever that field contains. We cannot evaluate a selector for you.
3. If we believe an instruction infringes the GDPR or another applicable data protection law, we will tell you and may suspend that processing until it is resolved.
4. If we are required by law to process beyond your instructions, we will inform you first unless that law forbids it on important grounds of public interest.
5. We do not sell personal data, use it for our own advertising, or use it to build profiles of identified individuals. The one use beyond producing your verdicts is clause 13.

4. Confidentiality

Everyone we authorise to process personal data is bound by confidentiality obligations that survive the end of their engagement, and access is limited to those who need it for a defined purpose.

5. Security measures

We implement the measures in Annex 2, appropriate to the risk under Article 32. We may change them, provided the level of protection is not reduced.

6. Sub-processors

1. You give general authorisation to engage sub-processors.
2. Those engaged at the effective date are listed in Annex 3.
3. We will give at least 30 days' notice by email before adding or replacing one. You may object on reasonable data-protection grounds within that period; if we cannot resolve the objection, you may terminate the affected part of the service and receive a pro-rata refund of the unused prepaid term.
4. We impose data-protection obligations on each sub-processor no less protective than this DPA, and remain fully liable to you for their performance.

7. Assisting with data-subject rights

1. The panel lets you look up, export and delete records for a given address or session yourself, which will answer most requests without involving us.
2. Where it will not, we assist you by appropriate technical and organisational measures, taking into account the nature of the processing.
3. If a visitor contacts us directly, we will not act on their request. We will tell them to contact you, and pass the request on if they identify the site.

8. Assisting with security and impact assessments

We assist you, on request and taking into account the information available to us, with your obligations under Articles 32 to 36 — security, breach notification, data protection impact assessments and prior consultation. Annexes 1 and 2 are written to be usable directly in a DPIA.

9. Personal data breaches

1. We notify you without undue delay after becoming aware of a personal data breach affecting data processed under this DPA.
2. The notification describes the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, the measures taken or proposed, and a contact point. Where we cannot provide all of it at once, we provide it in phases without further undue delay.
3. Notifying your supervisory authority and the affected individuals is your responsibility as controller. We do not do it on your behalf, and we will not make a public statement identifying you without your agreement unless the law requires it.

10. Return and deletion

1. You can export your data from the panel at any time during the subscription.
2. On termination we delete personal data processed under this DPA within 30 days, unless law requires us to keep it — billing records, for instance.
3. Backups are on a rolling cycle and are overwritten within 90 days. Data in a backup is not restored to production except to recover from an incident.
4. Clause 13(4) states the one exception: observations already aggregated into the shared pool. Read it before you decide whether to leave contribution on.

11. Audits and information

1. We make available the information needed to demonstrate compliance with Article 28, starting with this DPA and its annexes.
2. You may audit no more than once in any 12 months, on 30 days' written notice, at your cost, during business hours, without unreasonable disruption, and subject to confidentiality. A more frequent audit is permitted after a breach affecting your data or where a supervisory authority requires it.
3. Where an auditor is a competitor of ours, we may reasonably require a different one.

12. International transfers

1. Processing and storage of verdict data take place in the European Union.
2. Where a sub-processor in Annex 3 is outside the EEA, the transfer relies on an adequacy decision or on the European Commission's Standard Contractual Clauses (Decision 2021/914), Module Three (processor to sub-processor), which are incorporated here by reference. Annexes 1 to 3 of this DPA populate the corresponding annexes of those Clauses, and the docking clause applies.
3. For the United Kingdom, the UK International Data Transfer Addendum applies to those Clauses. For Switzerland, references to the GDPR are read as references to the FADP.

13. The shared reputation pool

This clause describes personal data leaving your tenant. It is the part of Karma most likely to need a decision from your data protection officer, so it is stated plainly.

1. Contribution is enabled by default. Observations about network addresses seen on your sites — the address, signal-level facts about its behaviour, and the time — are added to a pool shared across accounts. You may disable contribution at any time in your Karma settings, on any plan including the free one, and detection on your own account does not degrade if you do.
2. Reading the pool is a separate switch, off by default, available from the Protect+ plan. The two switches are independent in both directions.
3. Contributed: network addresses and signal-level behavioural facts. Never contributed: your URLs or content, which of your pages an address visited, anything captured by field-capture rules, your customers' identities or form contents, and any indication that an observation came from you.
4. Aggregation is one-way. Once an observation is merged into the pool it cannot be attributed to you or extracted on your behalf. A deletion request under clause 10 therefore covers your own tenant's records; it cannot unwind the pool's aggregate state. If that is unacceptable for your assessment, disable contribution before you begin — not after.
5. For contributions we act as a controller of the pooled dataset, on the basis of legitimate interests in preventing automated abuse across the service (Article 6(1)(f), Recital 49). As the controller of the source data, you need your own basis for the disclosure.

14. Liability and precedence

1. The liability limits in the Terms apply to this DPA, save where the GDPR forbids it.
2. On the processing of personal data, this DPA prevails over the Terms if they conflict; the Standard Contractual Clauses prevail over this DPA.
3. This DPA is governed by the law of Bulgaria, except that the Standard Contractual Clauses are governed by the law they specify.

Annex 1 — Details of processing

Annex 2 — Technical and organisational measures

Annex 3 — Approved sub-processors

Sub-processors of visitor data, as at the effective date:

No other sub-processor receives visitor data. The payment providers, OAuth providers, analytics and email delivery listed in section 12 of the Privacy Policy handle your account and billing data, not your visitors' — and are therefore outside this annex.

The autonomous-system dataset used to derive network and country is the public iptoasn data (CC0), downloaded to our own infrastructure. No address is sent to a third party to be looked up, so no geolocation service is a sub-processor here.

Contact

File Master LLC · Serena app., office C13, Golden Sands, Varna 9007, Bulgaria · VAT 180842207
Email: tech.support@recoverytoolbox.com

See also the Terms of Service and the Privacy Policy.