Data Processing Agreement

Parties

• Processor: Jean-Vincent QUILICHINI, an entrepreneur individuel (EI, a sole trader) under French law trading as isMalicious, SIREN 798 480 406 ("isMalicious").
• Controller: the customer that accepts this DPA, identified in its order, its account or its acceptance (« Customer »).

01Definitions

Terms such as « controller », « processor », « personal data », « processing », « data subject » and « personal data breach » have the meaning given in the GDPR. « Customer Personal Data » means the personal data that isMalicious processes on behalf of Customer when providing the Services, as described in Annex 1. « Services » and « Terms » have the meaning given in the isMalicious Terms of Service.

02Roles and scope

Customer is the controller and isMalicious the processor of Customer Personal Data. isMalicious acts as an independent controller, outside this DPA, for the personal data it processes for its own purposes: billing and accounting, the security of the Services and the prevention of abuse, the measurement and improvement of its services, and its threat-intelligence data, built from indicator values without any link to Customer. Those processing operations are described in the Privacy Policy.

03Instructions

isMalicious processes Customer Personal Data only on Customer’s documented instructions, including with regard to transfers to a third country, unless European Union or Member State law requires it to do otherwise; in that case it informs Customer of that legal requirement before processing, unless that law prohibits it. The Terms, this DPA and Customer’s use and configuration of the Services are Customer’s complete instructions; any further instruction must be agreed in writing. isMalicious immediately informs Customer if, in its opinion, an instruction infringes the GDPR or other data protection law.

04Confidentiality

isMalicious ensures that every person authorised to process Customer Personal Data has committed to confidentiality or is under an appropriate statutory obligation of confidentiality.

05Security

isMalicious implements the technical and organisational measures described in Annex 2 to ensure a level of security appropriate to the risk, as required by Article 32 of the GDPR. It may update them, provided the overall level of security does not decrease.

06Subprocessors

Customer gives isMalicious a general authorisation to engage the subprocessors listed on the subprocessors page. isMalicious informs Customer by email at least thirty days before adding or replacing a subprocessor. Within that period, Customer may object on reasonable grounds relating to data protection; if the parties cannot resolve the objection, Customer may terminate the affected Services, and fees prepaid for the period after termination are refunded. isMalicious imposes on each subprocessor, by contract, data protection obligations that provide sufficient guarantees within the meaning of Article 28(4) of the GDPR, and remains fully liable to Customer for the performance of its subprocessors’ obligations.

07Data subject requests

Taking into account the nature of the processing, isMalicious assists Customer by appropriate technical and organisational measures, insofar as possible, in responding to requests from data subjects exercising their rights. It forwards to Customer without undue delay any request it receives concerning Customer Personal Data, and does not answer it itself unless Customer instructs it to.

08Assistance

isMalicious assists Customer in ensuring compliance with Articles 32 to 36 of the GDPR (security of processing, notification of personal data breaches, data protection impact assessments and prior consultation), taking into account the nature of the processing and the information available to it.

09Personal data breaches

isMalicious notifies Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. The notification describes, to the extent known, the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences and the measures taken or proposed; information not yet available is provided as soon as it is.

10Transfers

Customer Personal Data is hosted in the European Union. Where a subprocessor processes it outside the European Economic Area, the transfer relies on a safeguard provided by Chapter V of the GDPR, such as an adequacy decision of the European Commission, including the EU-U.S. Data Privacy Framework for certified providers, or the standard contractual clauses adopted by the European Commission.

11Deletion and return

Customer may export its data while its account is active, where the Services allow it. At the end of the provision of the Services, isMalicious deletes Customer Personal Data within thirty days, or returns it if Customer asks for it before the end of the Services, unless European Union or Member State law requires its storage.

12Information and audits

isMalicious makes available to Customer all information necessary to demonstrate compliance with Article 28 of the GDPR, and allows for and contributes to audits, including inspections. Customer first sends a written questionnaire, which isMalicious answers within thirty days. Where the answers are not sufficient, or where a supervisory authority requires it, Customer may have an inspection carried out by itself or by an independent auditor bound by confidentiality, on thirty days’ written notice, at most once a year except after a personal data breach, during business hours and at Customer’s expense.

13Liability and precedence

Each party’s liability under this DPA is subject to the limitations of liability of the Terms, to the extent permitted by the GDPR. In the event of a conflict between this DPA and the Terms on the processing of Customer Personal Data, this DPA prevails.

14Term and governing law

This DPA applies for as long as isMalicious processes Customer Personal Data. It is governed by French law, and the courts of Paris, France, have exclusive jurisdiction over any dispute arising out of it, subject to any mandatory rule to the contrary.

Annex 1. Description of the processing

• Subject matter and duration. The provision of the Services to Customer, for the term of Customer’s subscription or agreement, followed by the deletion period of section 11.
• Nature and purpose. Hosting, storage, analysis, enrichment, retrieval and transmission of the data Customer submits to or configures in the Services, to deliver lookups, monitoring, alerts, case management, organisation blocklists and feeds to Customer.
• Categories of data subjects. Customer’s authorised users and the people Customer designates in the Services (for example alert recipients); individuals whose identifiers appear in the data Customer submits, such as the senders and recipients of emails submitted for analysis, or the holders of email addresses, IP addresses or domain names that Customer checks or monitors.
• Types of personal data. Names, business email addresses, roles and authentication identifiers of Customer’s users; IP addresses, browser user agents and request metadata of Customer’s use of the Services; identifiers contained in submitted content (email addresses, IP addresses, domain names, URLs, email messages and their headers, comments and case notes).
• Special categories. None intended. Customer will not submit special categories of personal data, health data or payment card data to the Services.
• Frequency. Continuous, for as long as Customer uses the Services.

Annex 2. Technical and organisational measures

• Hosting. The Services, their databases and their backups run on servers operated by Hetzner Online GmbH in the European Union.
• Encryption in transit. The website, the API and the feeds are served over HTTPS (TLS).
• Credentials. Passwords are stored only as bcrypt hashes. Payment card data is entered on Stripe’s page and never reaches isMalicious’s servers.
• Access control. Customer data is scoped to Customer’s organisation; roles within the organisation (owner, administrator, member) govern who manages billing and members; API access uses keys issued per organisation; administrative access to production systems is limited to the operator.
• Abuse prevention. Rate limits and automated-traffic detection protect the public endpoints.
• Monitoring. Errors and service health are monitored continuously.
• Backups. Databases are backed up regularly.

Annex 3. Subprocessors

The subprocessors authorised at the date of this DPA are those listed on the subprocessors page, as updated under section 6.

Acceptance

To accept this DPA, sign it and send it to contact@ismalicious.com, or write to that address naming this version (2026-10-19) and the legal entity that accepts it. We countersign and return a copy.

Customer (legal entity):

Name and title of the signatory:

Date:

Signature: