Data Processing Agreement

The DPA applies where a customer instructs ICTL CORP to monitor identifiers belonging to its own personnel or users, for example corporate email addresses added to a DarkStream account. In this relationship, the customer is the data controller and ICTL CORP acts as a processor on the customer's documented instructions. It is provided as a standalone signed document alongside your subscription agreement, rather than as part of the standard Terms of Service.

• Scope and roles. A description of the processing, its purpose, duration, and the categories of data and data subjects involved.
• Confidentiality and security. Obligations to protect personal data with appropriate technical and organisational measures, consistent with our Security page.
• Sub-processing. A current list of sub-processors, with notice of material changes and the ability to object on reasonable grounds.
• International transfers. The lawful transfer mechanisms we rely on where data moves across borders, such as Standard Contractual Clauses or DIFC-equivalent safeguards.
• Assistance with data-subject requests. Our obligation to help you respond to access, correction, deletion, and portability requests from individuals.
• Breach notification. Timelines and process for notifying you of a personal-data breach affecting data we process on your behalf.
• Deletion or return of data. What happens to personal data at the end of the relationship.

Enterprise and Business-plan customers can request the current DPA for legal review ahead of signature. We will return a version with your entity details and effective date completed, ready for signature.