Data Processing Agreement (DPA)
Annex to the Exposentry Terms and Conditions | Last updated: 4 June 2026
This is an English translation of the Dutch “Verwerkersovereenkomst”. Only the Dutch version is legally binding; if the two differ, the Dutch version prevails.
This Data Processing Agreement ("DPA") applies when Hasecon processes personal data on behalf of the Customer in performing the Exposentry service, and forms part of the agreement between the parties. Terms defined in the General Data Protection Regulation (GDPR, in Dutch: Algemene verordening gegevensbescherming, AVG) have the same meaning in this DPA.
1. Parties and roles
- Controller: the Customer.
- Processor: Hasecon (sole proprietorship, eenmanszaak; being converted into a B.V., see the Terms and Conditions), Eemwijkstraat 4, 2271 RE Voorburg-Leidschendam, KvK 55122434.
This DPA relates exclusively to scan data: personal data that may occur in the results of a Scan. For account data, Hasecon is an independent controller; that data is governed by the Privacy Statement, not by this DPA. The same applies to recording the consent for active tests (scan level 3): Hasecon keeps that record as controller, as evidence of the authorisation.
2. Subject matter and duration
Hasecon processes scan data solely for the purpose of performing the Service for the Customer. This DPA applies for as long as Hasecon processes scan data on behalf of the Customer and ends when the processing ends and the data has been deleted or returned in accordance with Article 9.
3. Nature and purpose of the processing; categories
| Item | Description |
|---|---|
| Purpose | Automated security scanning of domains validated by the Customer and the preparation of reports |
| Type of processing | Collecting, analysing, recording, storing, and making available to the Customer |
| Categories of data subjects | Persons whose data occurs in the scanned domains/infrastructure (e.g. employees, administrators) |
| Categories of personal data | Including: email addresses, names, technical identifiers, registration data (WHOIS), and anything else found in scan data |
| Special categories | Not intended; the Customer ensures that it does not unnecessarily bring special categories of personal data into scope |
4. Instructions
Hasecon processes scan data solely on the basis of documented instructions from the Customer, including the instruction implied by the use of the Service and the choice of the domains to be scanned. Hasecon informs the Customer if, in its opinion, an instruction infringes the GDPR, unless the law prohibits this.
5. Confidentiality
Hasecon ensures that persons who have access to the scan data are bound by confidentiality.
6. Security
Hasecon takes appropriate technical and organisational measures (Article 32 GDPR), including encryption in transit (TLS), access control and authentication, logical separation of scan data per Customer, monitoring and logging, and regular updates. A more detailed specification is included in Annex A.
7. Sub-processors
The Customer grants Hasecon general authorisation to engage sub-processors. The current sub-processors are listed in Annex B. Hasecon imposes on each sub-processor at least the same obligations as in this DPA, and informs the Customer of intended changes, so that the Customer can object to them. Transfers outside the EEA take place only on the basis of an appropriate transfer mechanism under the GDPR.
8. Data subject rights and incidents
Hasecon provides the Customer with reasonable assistance in handling requests from data subjects and in meeting obligations relating to security, personal data breaches and data protection impact assessments (DPIAs). Hasecon notifies the Customer of a personal data breach relating to scan data without undue delay, and in principle within 48 hours of discovery.
9. Return and deletion
After the processing ends, Hasecon deletes the scan data or returns it to the Customer, at the Customer's choice, unless a statutory retention obligation applies. Scan reports are kept for a maximum of 2 years in accordance with the Privacy Statement, unless the Customer requests earlier deletion.
10. Audit
On request, Hasecon makes available to the Customer the information necessary to demonstrate compliance with this DPA, and allows for audits. The parties may agree that an audit is carried out by an independent expert; the reasonable costs of this are borne by the Customer, unless the audit reveals a material failure on the part of Hasecon.
11. Liability and order of precedence
In the relationship between Hasecon and the Customer, the liability provisions of the Terms and Conditions apply to this DPA. This limitation is without prejudice to any liability that may exist directly towards data subjects or supervisory authorities under Article 82 GDPR and that cannot be excluded by contract. In the event of conflict between this DPA and the Terms and Conditions, this DPA prevails, solely insofar as it concerns the processing of personal data on behalf of the Customer.
Annex A: Security measures
- Encrypted connections (TLS) for all external communication
- Authentication and role-based access control
- Logical separation of scan data per Customer
- Automated monitoring and logging (logs kept for a maximum of 90 days)
- Regular security updates and patching
- Hosting within the EEA
Annex B: Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Mollie | Payment processing | EU (the Netherlands) |
| Gmail (Google Workspace) | Sending reports and transactional email | EU |
| Authentication service | Account authentication | EU / self-managed |
| Hosting provider | Hosting of the application and scan data | EU |
A current overview of sub-processors is available on request from scan@exposentry.io.