This agreement applies to every customer of the hosted Vardion console and forms part of its service agreement. On a customer's own server Vardion processes no customer data and the agreement does not apply.
1. Parties and roles
The customer is the controller. Kartia IKE, Dorylaiou 10-12, 11521 Athens, ΓΕΜΗ 170727601000 ("Vardion"), is the processor under Article 28 of Regulation (EU) 2016/679 (GDPR).
2. Subject matter, duration and purpose
Vardion processes personal data only to provide the hosted console to the customer: storing its workspace's records, assessments and findings, running the passive checks the customer sets, sending the mail the console sends and giving the support the customer asks for. Processing lasts as long as the service agreement.
3. Categories of data and data subjects
| Data | What it contains | Data subjects |
|---|---|---|
| User accounts | Name, email address, role, workspaces, sign-in settings | The console users the customer sets up |
| Security programme records | Names and roles of owners, crisis team members with how to reach them, assigned work, comments, document sign-offs | The customer's staff and partners |
| Leaked-credential findings | Account (email address), source and date | The customer's staff |
| Privacy records and data subject requests | What the customer enters; a data subject request is recorded by a reference and not by an email address | The customer's data subjects |
| Audit log | Which account made which change and when | The console users |
| Evidence files | Whatever the documents the customer uploads contain | As the customer determines |
| Staff list and policy acknowledgements | Name, work email, department, when each policy link was sent, opened and acknowledged, training completed | The customer's staff |
| Evidence requests from the customer's trust page | Name, work email, organisation and what was asked for | The people who ask |
| Supplier tax standing from ΑΑΔΕ | ΑΦΜ, registered name, legal form, status and start and stop dates, with the person who asked | The customer's suppliers, sole traders included |
| Awareness training and phishing simulations | Which member of staff completed which lesson and when; phishing simulations keep only counts per department, never which person clicked | The customer's staff |
| Incident response cases | What the customer enters: events and decisions with the people who recorded them, communications with the authority, the police or the insurer with their references and who collected, received and checked each evidence item | The customer's staff and the people involved in the incident |
| File requests and shared links | Recipient's name and email address, what was asked for or shared, the files uploaded and when each link was used and each download made | The people at the customer and its clients they are sent to |
| Digest and vulnerability advisory recipients | The email addresses the customer, or the partner that provides its console, sets to receive the monthly digest and advisories about exploited vulnerabilities. Each send is recorded with its date and how many messages went | The customer's contacts |
The console stores no password or secret that a check finds; it records only that there is a finding and where.
With content checks on, the console reads samples of the customer's exposed data stores and keeps only counts of the personal data in them by kind, the number of objects read and their names.
4. Instructions
Vardion processes the data only on the customer's documented instructions. The agreement, the settings the customer makes in the console and its support requests are those instructions. Where Vardion considers that an instruction infringes the GDPR, it informs the customer at once.
5. Confidentiality
Only the people at Vardion who run the hosted console or answer a support request have access to the data, and each is bound by a duty of confidentiality.
6. Security measures
Vardion applies the Article 32 GDPR measures the security page sets out, among them:
- encryption in transit: the console is served over HTTPS only and its mail is always sent over TLS or STARTTLS;
- each workspace keeps its data apart, and each account sees only the workspaces it is granted;
- passwords stored as scrypt hashes, access tokens stored only as SHA-256 and two-step verification;
- an audit log chained by hash, which shows which entry was edited, deleted or inserted;
- the console loads no third-party scripts, fonts or images.
7. Subprocessors
The customer gives general authorisation for the subprocessors in the table. Vardion notifies the customer by email at least 30 days before it adds or replaces a subprocessor, and the customer may object on reasonable grounds. Each subprocessor is bound by a contract with the same data protection obligations.
| Subprocessor | Purpose | Location |
|---|---|---|
| OVH SAS (OVHcloud) | Hosting of the hosted console and the free domain check | EU |
| Sinch Mailjet SAS (Mailjet) | Sending the console's and the free check's email: invitations, password resets, reports and notices | France |
| Google Ireland Limited (Google Workspace) | Receiving and answering email to Vardion's addresses | Ireland |
| Cloudflare, Inc. | Hosting and delivery of the getvardion.com website and DNS for Vardion's domains | United States, delivered from the nearest data centre |
8. Sources queried
When the customer turns on the leaked-credential check for a domain in its scope, the console queries the sources below. They do not process data on Vardion's behalf: they receive only the domain and return what they themselves list.
| Source | What it answers | What it receives | What it returns |
|---|---|---|---|
| XposedOrNot | Accounts of a domain that appear in breaches | The domain | The accounts (email addresses) of the domain it lists |
| Hudson Rock | Accounts of a domain in infostealer logs | The domain | The accounts of the domain it lists |
| Have I Been Pwned | As XposedOrNot, only with a key the customer sets | The domain | The accounts of the domain it lists |
9. Assistance to the customer
Vardion assists the customer in answering data subject requests, in impact assessments and in consultations with the supervisory authority, as far as they concern the console's processing. Most of it the customer does itself in the console: export, correction and deletion.
10. Personal data breach
Vardion notifies the customer of a personal data breach in the hosted console without undue delay and no later than 48 hours after becoming aware of it. The notice carries whatever of the Article 33(3) GDPR information is known, and Vardion adds the rest as it becomes known.
11. End of the agreement: return and deletion
The customer can export its data from the console in open formats at any time. When the agreement ends, Vardion gives the customer, on request, a full export of its workspace and deletes the data within 30 days, unless the law requires it to be kept. It confirms the deletion in writing. Backups taken before the deletion keep the data until they are rotated out.
12. Audits
Vardion makes available to the customer the information that demonstrates compliance with Article 28 GDPR and allows audits by the customer or an auditor it appoints, on reasonable notice and at an agreed time, without exposing other customers' data.
13. Transfers
The console's data is stored in the EU. Where a subprocessor processes data outside the European Economic Area, the transfer is based on an adequacy decision of the European Commission or on the Standard Contractual Clauses.
14. Contact
For this agreement and any data protection matter: support@getvardion.com.