Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of and is incorporated into the Sentinel Shield Terms of Service. It applies to the processing of personal data by Sentinel Shield Ltd ("Processor", "we", "us") on behalf of the customer ("Controller", "you") in connection with your use of the Sentinel Shield platform (the "Service").

1. Scope and Roles

You are the data controller and determine the purposes and means of processing personal data submitted to the Service. Sentinel Shield Ltd acts as your data processor, processing personal data only on your documented instructions — namely, to provide and operate the Service as described in the Terms of Service. This DPA applies to all personal data you submit to the Service for processing under your account.

2. Processing Purposes

We process customer personal data solely to provide, maintain, and secure the Service — including hosting your compliance records, generating audit trails, producing reports, and delivering the features you configure. We will not process your personal data for our own purposes, nor will we use it to train any model, without your prior consent.

3. Data Categories

The personal data we process on your behalf includes: (a) customer account data — names, email addresses, and role assignments for users you invite; and (b) customer content — the personal data you upload or create within the Service for compliance workflows, such as records of processing activities, data subject request details, incident reports, and training records.

4. Sub-processors

We engage sub-processors to deliver components of the Service (such as cloud hosting, email delivery, and analytics). Our current sub-processor list is available on our Sub-processors page. We notify customers in advance of any new sub-processor and offer the right to object. All sub-processors are bound by written agreements providing an equivalent level of data protection.

Customer-activated integrations — Google LLC (Gmail API, Google Drive API) and Microsoft Corporation / Microsoft Ireland Operations Ltd (Microsoft Graph for Outlook and OneDrive) — constitute authorised sub-processors engaged only when the customer affirmatively connects that integration. Processing by these sub-processors is limited to running the Incident Response Bot remediation actions the customer configures and approves, using the minimum metadata necessary (mailbox and file metadata, sharing permissions) under the customer's own OAuth2 authorisation.

5. International Transfers

Where personal data is transferred outside the UK or EEA, we rely on recognised transfer mechanisms — such as UK adequacy decisions, EU Standard Contractual Clauses, or other lawful mechanisms — to ensure a level of data protection equivalent to the UK GDPR / EU GDPR. We will, on request, make available the relevant transfer mechanisms.

6. Security Measures

We implement appropriate technical and organisational measures to protect personal data, including: encryption in transit (TLS 1.2+) and at rest (AES-256); role-based access control with least-privilege principles; tamper-evident, hash-chained audit trails; regular security monitoring; and documented incident response procedures. Further detail is available on our Security page.

7. Confidentiality

All personnel authorised to process customer personal data are bound by confidentiality obligations and receive data protection training appropriate to their role. Access to personal data is restricted to personnel who need it to deliver the Service.

8. Assistance with Data Subject Requests

We assist you in responding to data subject requests — including access, rectification, erasure, restriction, portability, and objection — by providing tools within the Service (such as the DSAR workflow and data export) and by making customer content available for export. Where a request is sent directly to us, we will promptly forward it to you and advise the data subject to contact you directly.

9. Breach Notification

If we become aware of a personal data breach affecting your data, we will notify you without undue delay and provide the information necessary for you to meet your own breach notification obligations under the UK GDPR / EU GDPR (Article 33). We will cooperate with you in investigating and mitigating the breach and document the incident in line with our incident response procedures.

10. Deletion or Return of Data

On termination of the Service, and at your choice, we will delete or return your customer content within 30 days, unless a longer retention period is required by law. You may export your data at any time during the subscription term using the in-app export tools.

11. Audit Rights

You may audit our compliance with this DPA, subject to reasonable notice and confidentiality obligations. Where we make available independent audit reports (such as SOC 2 or ISO 27001 attestations, where available), these may satisfy your audit requirements in whole or in part.

12. Contact

To execute this agreement for your account, contact us at sentinelshield-help@mail.uk. Our Data Protection Officer can be reached at the same address for any questions about this DPA or our processing activities.