Data processing agreement

Version 1.0. Last updated: 2026-10-14.

This data processing agreement ("DPA") is part of the Terms of service of Pandus. It applies when a customer uses the Service to process personal data for which the customer is the controller, as required by Article 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR").

• Processor: Pandus, sole proprietor (ФОП), Ukraine, tax number 3699800070, Ukraine, Krolevets, Zelinskogo, 107, vadym.queensoft@gmail.com ("we").
• Controller: the customer who holds the account ("you").

You accept this DPA together with the Terms; no signature is needed. If you need a signed copy for your records, write to vadym.queensoft@gmail.com.

1. What this DPA covers

Personal data that we process for our own purposes (your account, billing, support, the website) is described in the Privacy policy; there we are the controller. This DPA covers only the data we process on your behalf (section 2).

2. Details of the processing

3. Your instructions

3.1. We process the data only on your documented instructions: these Terms, this DPA and the settings you choose in the Service. We do not use the data for our own purposes, do not sell it and do not use it for advertising.

3.2. If we are required by law to process the data otherwise, we tell you before we do, unless the law forbids it.

3.3. We tell you if we believe an instruction breaks the GDPR.

4. Confidentiality

Only staff who need the data to run the Service can access it, and they are bound to confidentiality.

5. Security (Art. 32 GDPR)

• Encrypted connections (HTTPS) to the website, the customer area and the API.
• Passwords stored as hashes; two-factor authentication required for staff.
• The scanner runs isolated from the database and secrets and checks only public addresses.
• Every customer's data is separated by team; automated tests check that one customer cannot see another's data.
• Logs keep shortened IP addresses; outgoing e-mail logs keep only the recipient and subject.
• Backups are overwritten within 14 days; restoring them is tested regularly.
• Servers in the European Union; more on the security page.

6. Sub-processors

6.1. You give us a general authorisation to use the sub-processors listed on the Sub-processors page.

6.2. We announce a new or replaced sub-processor on that page and by e-mail to the owners of customer teams at least 14 days before it starts processing your data. You may object on reasonable grounds within that time; if we cannot meet the objection, you may cancel the affected plan and receive a refund of the unused part of the paid period.

6.3. We bind each sub-processor by contract to data protection obligations no weaker than this DPA, and we remain responsible to you for its work.

7. Help with your obligations

7.1. Requests from data subjects. If a person contacts us about data we process for you, we pass the request to you and do not answer it ourselves unless you ask us to. You see the data in the customer area (sites, checks, reports, barrier reports) and can download the reports; deleting a site deletes its checks, reports and barrier reports. For anything else, write to vadym.queensoft@gmail.com.

7.2. We help you, as far as we reasonably can, with security, notification of breaches, data protection impact assessments and prior consultation (Art. 32–36 GDPR).

8. Personal data breaches

We notify you without undue delay after we become aware of a personal data breach affecting your data, with what we know: what happened, which data and how many people are affected, the likely consequences and what we are doing about it. We add details as they become known.

9. Deletion and return

When you delete a site, a team or your account, we delete the data processed for you at once in the Service and from backups within 14 days. Before that you can download your reports. We keep data longer only where the law requires it.

10. Audits

We make available the information needed to show that we meet this DPA. You, or an independent auditor bound to confidentiality whom you appoint, may audit us once a year with 30 days' notice, during business hours and at your cost; a breach or an order of a supervisory authority allows an audit at any time. We first try to answer through written questions and documents.

11. Transfers outside the EU

11.1. Your data is stored on servers in the European Union. We are established in Ukraine, for which the European Commission has not adopted an adequacy decision, and our staff access the servers from Ukraine.

11.2. Where this access is a transfer of personal data under Chapter V GDPR from you as a controller in the European Economic Area, the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor), apply and are incorporated into this DPA by reference, with these choices: clause 7 does not apply; clause 9(a) option 2 with the notice period of section 6.2; the optional wording in clause 11(a) does not apply; clause 17 option 2 and clause 18(b): the law and the courts of the EU Member State where you are established; the competent supervisory authority is the one of that Member State. Annex I is section 2 of this DPA, Annex II is section 5, and Annex III is the Sub-processors page. If this DPA and the clauses conflict, the clauses prevail.

11.3. Transfers by our sub-processors are described on the Sub-processors page.

12. Liability and order of documents

The limits of liability in the Terms apply to this DPA as far as the GDPR allows. If this DPA conflicts with the Terms on data protection, this DPA prevails.

Version history