Data Processing Addendum (Overview)

When an enterprise customer uses the Service, the enterprise is the data controller (or business under CCPA) for personal data it submits through the Service, and IDLeakCheck is the data processor (or service provider under CCPA) for that data. Personal data that IDLeakCheck independently collects from public sources is processed under IDLeakCheck’s own Privacy Policy as data controller.

IDLeakCheck processes personal data submitted by the enterprise for the duration of the enterprise’s subscription and for a defined return-or-deletion period after termination (see § 10).

Processing is limited to providing the Service to the enterprise: receiving search inputs, returning search results, returning profile reports, supporting API access, generating audit logs, and providing customer support.

Categories submitted by enterprise customers typically include: identifiers (name, email, account ID, IP address), subject identifiers (name, address, telephone, date of birth), and any additional identifiers the enterprise chooses to submit through the API.

Categories include: the enterprise’s own personnel using the Service, the enterprise’s own customers, and individuals who are the subject of the enterprise’s search activity.

IDLeakCheck’s current sub-processors are listed at /legal/subprocessors. We provide at least 30 days’ advance notice of any addition or change. Sub-processors are bound by data-protection obligations no less protective than this DPA.

IDLeakCheck maintains technical and organisational measures to protect personal data, including: encryption in transit (TLS 1.2+), encryption of payload envelopes (AES-256-GCM) for browser-facing endpoints, encryption of database backups, role-based access controls with mandatory two-factor authentication for personnel access, audit logging of all personnel access to customer data, network isolation, vendor-vetted hosting (see /legal/subprocessors), and an incident response programme.

IDLeakCheck will reasonably assist the enterprise in responding to data-subject requests (access, deletion, correction, restriction, portability, objection) where the requested information is within IDLeakCheck’s control as processor. Standard assistance is provided at no additional charge; bespoke engineering work may be quoted separately.

IDLeakCheck will notify the enterprise without undue delay, and in any event within 72 hours of becoming aware, of any personal-data breach affecting personal data processed on the enterprise’s behalf. Notification will include the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed.

On termination of the enterprise’s subscription, IDLeakCheck will, at the enterprise’s choice and within 30 days of written request, either (a) return all personal data processed on behalf of the enterprise in a commonly used machine-readable format, or (b) delete all such personal data. Audit logs and backups retained for security or legal compliance are exempt and will be deleted in accordance with our standard retention schedule.

Where personal data is transferred from the European Economic Area, the United Kingdom, or Switzerland to a jurisdiction not recognised as providing adequate protection, the transfer is governed by the European Commission’s Standard Contractual Clauses (2021/914) Module 2 (controller-to-processor), the UK International Data Transfer Addendum, or the Swiss FDPIC-approved version, as applicable. These clauses are incorporated by reference into the executable DPA.

IDLeakCheck will provide reasonable cooperation with the enterprise’s audit and inspection rights under applicable data-protection law. In lieu of an on-site audit, IDLeakCheck may provide third-party audit reports (SOC 2 Type II once available) and written responses to security questionnaires. Audit requests must be submitted with at least 30 days’ notice except in connection with a regulatory investigation or actual breach.

Liability under this DPA tracks the limitation of liability set out in the enterprise’s Service Agreement.

This DPA is governed by the same law and dispute-resolution provisions as the enterprise’s Service Agreement (typically the laws of the State of Delaware and the dispute-resolution provisions of our Terms of Service § 15).

• To request the executable DPA: legal@idleakcheck.com
• Data Protection Officer (DPO): dpo@idleakcheck.com