Snapshot 877
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Legal & Online Data Protection
Compliance: Addendum
Effective: 08 December 2022
ONLINE DATA PROTECTION ADDENDUM
You should download a copy for future reference.
This Data Processing Addendum and its Schedules and Annexes (“DPA”) reflect the parties’
agreement with respect to the Processing of Personal Data between HackTheBox Ltd., a company
registered in England & Wales under company number 10826193 with offices at Plexal Here East,
Queen Elizabeth Olympic Park, Stratford, London, England, E15 2GW (“HackTheBox”) and the
Subscriber in connection with the Subscription Agreement to the Services.
This DPA applies where and only to the extent that HackTheox processes Personal Data on behalf
of the Subscriber in the course of providing the Services. This DPA is supplemental to, and forms an
integral part of, the Subscription Agreement and is effective upon its incorporation into the
Subscription Agreement, which may be specified in the Subscription Agreement, an Order or an
executed amendment to the Subscription Agreement. In case of any conflict or inconsistency (a)
any of the provisions of this DPA and the provisions of the Subscription Agreement, the provisions of
this DPA will prevail; and (b) the Standard Contractual Clauses and any other terms in this DPA, the
provisions of the Standard Contractual Clauses will prevail.
HackTheBox may update this DPA from time to time, with such updated version available at
https://resources.hackthebox.com/hubfs/Legal/DPA.pdf or a successor website link designated by
HackTheBox; provided, however, that no such update shall materially diminish the privacy or
security rights of Subscriber.
The term of this DPA will follow the term of the Subscription Agreement. Terms not otherwise defined
in this DPA will have the meaning as set forth in the Subscription Agreement.
“Data Subject” means the individual to
whom Personal Data relates.
1. DEFINITIONS AND INTERPRETATION
"Europe" means the European Union, the
1.1 Definitions. The following terms have the European Economic Area and/or their
meanings set forth below. member states, Switzerland and the United
“Anonymized Data” means a data set that Kingdom.
does not contain any Personal Data. “European Data” means Personal Data that
Aggregated data is Anonymized Data. is subject to the protection of European Data
“Data Controller” or “Controller” means the Protection Laws.
natural or legal person that alone or jointly "European Data Protection Laws" means
with others determines the purposes and data protection laws applicable in Europe,
means of the Processing of Personal Data. including: (i) Regulation 2016/679 of the
“Data Protection Laws” means all applicable European Parliament and of the Council on
worldwide legislation relating to data the protection of natural persons with regard
protection and privacy which applies to the to the processing of personal data and on
respective party in the role of Processing the free movement of such data (General
Personal Data in question under the Data Protection Regulation) ("GDPR"); (ii)
Agreement, including without limitation Directive 2002/58/EC concerning the
European Data Protection Laws, in each processing of personal data and the
case as amended, repealed, consolidated protection of privacy in the electronic
or replaced from time to time. communications sector; and (iii) applicable
national implementations of (i) and (ii); or (iii)
1
GDPR as it forms parts of the United Kingdom “Processes” and “Processed” will be
domestic law by virtue of Section 3 of the construed accordingly.
European Union (Withdrawal) Act 2018 ("UK
GDPR"); and (iv) Swiss Federal Data
“Processor” means a natural or legal person
Protection Act on 19 June 1992 and its
that processes Personal Data on behalf of
Ordinance ("Swiss DPA"); in each case, as
the Controller.
may be amended, superseded or replaced.
“Special Category Data” means Personal
“EEA” means the European Economic Area.
Data revealing racial or ethnic origin,
“Instructions” means the written, political opinions, religious or philosophical
documented instructions issued by a beliefs, or trade union membership, and the
Controller to a Processor, and directing the processing of genetic data, biometric data
same to perform a specific or general action for the purpose of uniquely identifying a
with regard to Personal Data (including, but natural person, data concerning health or
not limited to, depersonalising, blocking, data concerning a natural person’s sex life or
deletion, making available). sexual orientation.
“Personal Data” means any information “Standard Contractual Clauses” means,
relating to an identified or identifiable Data means the standard contractual clauses
Subject where (i) such information is annexed to the European Commission’s
contained within Subscriber Data; and (ii) is Decision (EU) 2021/914 of 4 June 2021
protected similarly as personal data, personal currently found at
information or personally identifiable https://ec.europa.eu/info/law/law-topic/dat
information under applicable Data a-protection/international-dimension-data-pr
Protection Laws. otection/standard-contractual-clauses-scc/st
“Personal Data Breach” means a breach of andard-contractual-clauses-international-tra
security leading to the accidental or unlawful nsfers_en, as may be amended, superseded
destruction, loss, alteration, unauthorized or replaced..
disclosure of, or access to, Personal Data “Subprocessor” means a Processor engaged
transmitted, stored or otherwise Processed by by HackTheBox as a Processor to assist in
HackTheBox and/or our Sub-Processors in fulfilling our obligations with respect to the
connection with the provision of the Services. provision of the Subscription Services under
"Personal Data Breach" will not include the Agreement. Sub-Processors may include
unsuccessful attempts or activities that do third parties but will exclude any HackTheBox
not compromise the security of Personal employee or consultant.
Data, including unsuccessful log-in attempts,
“Subscription Agreement'' means the
pings, port scans, denial of service attacks,
relevant agreement or terms of service
and other network attacks on firewalls or
governing Subscriber’s access and use of the
networked systems.
Services. HackTheBox’s standard terms and
“Processing” means any operation or set of conditions can be found at
operations which is performed on Personal https://resources.hackthebox.com/hubfs/Leg
Data or on sets of Personal Data, whether or al/B2BT.pdf
not by automated means, such as collection,
“UK Addendum” means the International
recording, organization, structuring, storage,
Data Transfer Addendum issued by the UK
adaptation or alteration, retrieval,
Information Commissioner under section
consultation, use, disclosure by transmission,
119A(1) of the Data Protection Act 2018
dissemination or otherwise making available,
currently found at
alignment or combination, restriction, erasure
https://ico.org.uk/media/for-organisations/d
or destruction. The terms “Process”,
ocuments/4019539/international-data-transfe
2
r-addendum.pdf, as may be amended, has the right to transfer, or provide access to,
superseded, or replaced. the Personal Data to HackTheBox for
Processing in accordance with the terms of
the Subscription Agreement (including this
2. RELATIONSHIP OF THE PARTIES DPA); and (v) complying with all applicable
laws related to the use of the Services.
2.1 The parties acknowledge and agree that
with regard to the Processing of Personal 3.2 The parties agree that the Subscription
Data, Subscriber is the Data Controller and Agreement (including this DPA), together
HackTheBox is the data Data Processor. with Subscriber’s use of the Service in
accordance with the Subscription
2.2 Unless another data processing
Agreement, constitute Subscriber’s complete
agreement is signed by the parties, by
Instructions to HackTheBox in relation to the
signing the Subscription Agreement,
Processing of Personal Data, so long as
Subscriber enters into this DPA (including,
Subscriber may provide additional written
where applicable, the Standard Contractual
instructions during the subscription term that
Clauses) on behalf of itself and in the name
are consistent with the Subscription
and on behalf of its Affiliates using the
Agreement, the nature and lawful use of the
Services. The person or entity entering into
Service.
this DPA as a Subscriber represents that it is
authorized to agree to and enter into this 3.3 Subscriber is responsible for
DPA for and on behalf of itself, and as independently determining whether the data
applicable, each of its Affiliates. For the security provided for in the Service
avoidance of a doubt only Subscriber shall adequately meets its obligations under
be entitled to provide instructions, exercise applicable privacy and data protection
any rights or seek any remedies under this laws.
DPA. 3.4 Subscriber will retain control of the
Personal Data and remain responsible for its
compliance obligations under the
3. CONTROLLER RESPONSIBILITIES applicable privacy and data protection
requirements. Without limitation, Subscriber
3.1 Within the scope of the Subscription
agrees that is solely responsible for providing
Agreement and in its use of the Services,
any required notices and obtaining any
Subscriber will be responsible for complying
required consents for the processing
with all requirements that apply to it under
instructions it gives to HackTheBox and its
applicable Data Protection Laws with
secure use of the Services, including (a)
respect to its Processing of Personal Data
making appropriate use of the Services to
and the instructions it issues to HackTheBox. In
ensure a level of security appropriate to the
particular but without prejudice to the
risk in respect of the Personal Data; (b)
generality of the foregoing, Subscriber
securing the account authentication
acknowledges and agrees that will be solely
credentials, systems and devices Subscriber
responsible for (i) the accuracy and legality
and its Authorised Users use to access and
of Subscriber Data and the means by which
use the Services; (c) securing Subscriber’s
Subscriber acquired Personal Data; (ii)
systems and devices that it uses to access
complying with all necessary transparency
and use the Services; and (d) maintaining its
and lawfulness requirements under
own backups of Personal Data.
applicable Data Protection Laws for the
collection and use of the Personal Data, 3.5 Subscriber agrees to immediately notify
including obtaining any necessary consents HackTheBox if it becomes aware of any
and authorizations; (iii) ensuring Subscriber unauthorized or unlawful processing of the
Personal Data; or any security breach.
3
3.6 Subscriber acknowledges that confidential; (b) have undertaken training
HackTheBox is under no duty to investigate on the handling of Personal Data; and (c)
the completeness, accuracy, or sufficiency are aware both of the HackTheBox’s duties
of any specific Subscriber instructions or the and their personal duties and obligations
Personal Data other than as required under under this DPA.
applicable law. 4.5 HackTheBox will implement and maintain
technical and organisational security
measures to protect Personal Data from
4. PROCESSOR OBLIGATIONS
security incidents as described at
4.1 HackTheBox will Process Personal Data for https://resources.hackthebox.com/hubfs/Leg
the purposes described in this DPA or as al/DSM.pdf. Notwithstanding any provision to
otherwise agreed within the scope of the contrary, HackTheBox may modify or
Subscriber’s lawful instructions, except where update the security measures at its discretion
and to the extent otherwise required by provided that such modification or update
applicable law or in order to verify does not result in a material degradation in
compliance with applicable legislation. If the protection offered by the security
applicable law requires HackTheBox to measures.
process Personal Data other than in 4.6 HackTheBox will conduct audits of its
accordance with the instructions, Personal Data processing practices and the
HackTheBox shall notify Subscriber of any information technology and information
such requirement before processing the security controls for all facilities and systems
Personal Data (unless Applicable Law used in complying with its obligations under
prohibits such information on important this DPA, including, but not limited to,
grounds of public interest); and HackTheBox obtaining a vulnerability assessment
shall promptly inform Subscriber if it becomes performed by a third-party audit firm based
aware of an instruction that, in HackTheBox’s on recognized industry best practices.
opinion, infringes Data Protection Laws. HackTheBox shall further provide written
4.2 Subscriber acknowledges and agrees responses to information security and audit
that such instruction authorises HackTheBox questionnaires that Subscriber (acting
to Process Subscriber Data (a) to perform its reasonably) considers necessary to confirm
obligations and exercise its rights under the HackTheBox’s compliance with this DPA,
Subscription Agreement; and (b) to perform provided that Subscriber shall not exercise
its legal obligations and to establish, exercise this right more than once per year.
or defend legal claims in respect of the 4.7 HackTheBox will notify Subscriber without
Subscription Agreement. undue delay, upon becoming aware of any
4.3 To the extent Subscriber is unable to Personal Data Breach, affecting Personal
amend, transfer, or delete the Personal Data, Data HackTheBox Processes in connection
or to stop, mitigate, or remedy any with the provision of Services to Subscriber.
unauthorized processing, HackTheBox will Upon request, HackTheBox will promptly
promptly comply with any Subscriber’s provide Subscriber with reasonable
request or instruction, to perform such actions assistance as necessary to enable Subscriber
on its behalf. to notify relevant Personal Data Breaches to
competent authorities and/or affected Data
4.4 HackTheBox will ensure that any
Subjects, if it is required under applicable
personnel authorized to Process Personal
privacy and data protection laws.
Data (a) are informed of the Personal Data’s
confidential nature and use restrictions and 4.8 Hackthebox will delete any Subscriber
are obliged to keep the Personal Data Data within 2 months from the termination or
expiration of the Subscription Agreement. This
4
term shall apply except where HackTheBox is replacements of its Subprocessor list via email
required by applicable law to retain some or if Subscriber has added his email at the
all of Subscriber Data or where HackTheBox relevant field that can be found at
has archived Subscriber Data on back-up https://www.hackthebox.com/legal.
systems, which data are isolated and
protected from any further processing or in
order to defend any legal claims in regard to 6. INTERNATIONAL DATA TRANSFERS
the Subscription Agreement.
6.1 Subscriber acknowledges and agrees
4.9 The Service provides Subscriber with a that HackTheBox may access and Process
number of controls that can be used to Personal Data on a global basis as necessary
correct, delete or restrict Personal Data. To to provide the Services in accordance with
the extent that Subscriber is unable to the Subscription Agreement, and in particular
independently address a Data Subject that Personal Data may be transferred to
request via the Service, HackTheBox will and Processed by HackTheBox in EU, UK, US in
provide Subscriber with commercially its primary processing facilities and to other
reasonable assistance, upon request, to help jurisdictions where HackTheBox and its
Subscriber to respond to a Data Subject’s Sub-Processors has operations. Wherever
request or a request from data protection Personal Data is transferred outside its
authorities. If a Data Subject request or other country of origin, each party will ensure such
communications in regard to the Processing transfers are made in compliance with the
of Personal Data is made directly to requirements of Data Protection Laws.
HackTheBox, HackTheBox will promptly inform
6.2 Parties further agree that they will
the Subscriber and will redirect the Data
execute all necessary documents in order to
Subject to Subscriber. Subscriber will be solely
comply with applicable data protection
responsible for responding to such requests or
laws.
communications.
7. ADDITIONAL PROVISIONS FOR EUROPEAN
5. SUB-PROCESSORS
DATA
5.1 Existing Subprocessors. HackTheBox’s
7.1 This “Additional Provisions for European
appointed Sub-Processors are available at
Data” section shall apply only with respect to
https://resources.hackthebox.com/hubfs/Leg
the processing of European Personal Data.
al/SPL.pdf.
7.2 When processing European Data
5.2 Subscriber specifically authorises
Subscriber is the Controller and HackTheBox is
HackTheBox to use these Subprocessors, and
the Processor.
grants HackTheBox a general authorization to
engage Subprocessors, provided that: (a) 7.3 If we believe that Subscriber’s Instruction
HackTheBox enters into a written contract infringes European Data Protection Laws
with the Subprocessor that contains terms (where applicable), we will inform Subscriber
substantially the same as those set out in this without delay.
DPA and (b) HackTheBox remains liable for 7.4. Subscriber will have the opportunity to
any acts or omissions of such Sub-Processor object to the engagement of new
that cause us to breach any of its obligations Sub-Processors on reasonable grounds
under this DPA. relating to the protection of Personal Data
5.3 Subprocessor list may be updated by within 30 days of notice in accordance with
HackTheBox from time to time. HackTheBox the ‘Sub-Processors’ section, (or of the
will notify Subscriber of any additions to or update to the Subprocessor list, where no
email address for notice has been provided).
5
If Subscriber does notify HackTheBox of such Laws, or to a recipient that has executed
an objection, the parties will discuss its appropriate standard contractual clauses in
concerns in good faith with a view to each case as adopted or approved in
achieving a commercially reasonable accordance with applicable European data
resolution. If no such resolution can be protection laws.
reached, HackTheBox will, at its sole The parties agree that the Standard
discretion, either not appoint the new Contractual Clauses will be incorporated by
Sub-Processor, or permit Subscriber to reference and form part of the Agreement
suspend or terminate the affected as follows:
Subscription Service in accordance with the
(a) EEA Transfers. In relation to European
termination provisions of the Agreement
Data that is subject to the GDPR (i) Subscriber
without liability to either party (but without
is the "data exporter" and HacktheBox, is the
prejudice to any fees incurred by Subscriber
"data importer"; (ii) the Module Two terms
prior to suspension or termination). The parties
apply to the extent the Subscriber is a
agree that by complying with this sub-section
Controller of European Data and the Module
(7.4), HackTheBox fulfils its obligations under
Three terms apply to the extent the
Sections 9 of the Standard Contractual
Subscriber is a Processor of European Data;
Clauses.
(iii) in Clause 7, the optional docking clause
7.5 To the extent that the required does not apply; (iv) in Clause 9, Option 2
information is reasonably available to applies and changes to Sub-Processors will
Hackthebox, and Subscriber does not be notified in accordance with the
otherwise has access to the required ‘Sub-Processors’ section of this DPA; (v) in
information, we will provide reasonable Clause 11, the optional language is deleted;
assistance to Subscriber with any data (vi) in Clauses 17 and 18, the parties agree
protection impact assessments, and prior that the governing law and forum for
consultations with supervisory authorities or disputes for the Standard Contractual
other competent data privacy authorities to Clauses will be determined in accordance
the extent required by European Data with the 'Contracting Entity; Applicable Law;
Protection Laws. Notice’ section of the Jurisdiction Specific
7.6 Transfer Mechanism. HackTheBox shall not Terms or, if such section does not specify an
transfer European Data to any country or EU Member State, Greece (without reference
recipient not recognized as providing an to conflicts of law principles); (vii) the
adequate level of protection for Personal Annexes of the Standard Contractual
Data (within the meaning of applicable Clauses will be deemed completed with the
European data Protection Laws), unless it first information set out in the Annexes of this
takes all such measures as are necessary to DPA; and (viii) if and to the extent the
ensure the transfer is in compliance with Standard Contractual Clauses conflict with
applicable European Data Protection Laws. any provision of this DPA the Standard
Such measures may include (without Contractual Clauses will prevail to the extent
limitation) transferring such data to a of such conflict.
recipient that is covered by a suitable (b) UK Transfers. In relation to European Data
framework or other legally adequate transfer that is subject to the UK GDPR, the Standard
mechanism recognized by the relevant Contractual Clauses will apply in
authorities or courts as providing an accordance with sub-section (a) and the
adequate level of protection for Personal following modifications (i) the Standard
Data, to a recipient that has achieved Contractual Clauses will be modified and
binding corporate rules authorization in interpreted in accordance with the UK
accordance with European Data Protection Addendum, which will be incorporated by
6
reference and form an integral part of the have incurred prior to such suspension or
Agreement; (ii) Tables 1, 2 and 3 of the UK termination).
Addendum will be deemed completed with
the information set out in the Annexes of this
DPA and Table 4 will be deemed completed 8. Additional Terms
by selecting “neither party”; and (iii) any
8.1 Severability. If any individual provisions of
conflict between the terms of the Standard
this DPA are determined to be invalid or
Contractual Clauses and the UK Addendum
unenforceable, the validity and
will be resolved in accordance with Section
enforceability of the other provisions of this
10 and Section 11 of the UK Addendum.
DPA will not be affected.
(c) Swiss Transfers. In relation to European
8.2 Limitation of Liability. Each party and
Data that is subject to the Swiss DPA, the
each of their Affiliates' liability, taken in
Standard Contractual Clauses will apply in
aggregate, arising out of or related to this
accordance with sub-section (a) and the
DPA (and any other DPAs between the
following modifications (i) references to
parties) and the Standard Contractual
"Regulation (EU) 2016/679" will be interpreted
Clauses (where applicable), whether in
as references to the Swiss DPA; (ii) references
contract, tort or under any other theory of
to "EU", "Union" and "Member State law" will
liability, will be subject to the limitations and
be interpreted as references to Swiss law;
exclusions of liability set out in the 'Limitation
and (iii) references to the "competent
of Liability' section of the Subscription
supervisory authority" and "competent courts"
Agreement and any reference in such
will be replaced with the "the Swiss Federal
section to the liability of a party means
Data Protection and Information
aggregate liability of that party and all of its
Commissioner " and the "relevant courts in
Affiliates under the Agreement (including this
Switzerland".
DPA).
7.7 The parties acknowledge and agree to
8.3. This DPA will be governed by and
abide by and process European Data in
constructed in accordance with the Laws of
compliance with the Standard Contractual
England and Wales, unless required
Clauses.
otherwise by Data Protection Laws.
7.8 If for any reason HackTheBox cannot
8.4 The legal entity agreeing to this DPA as
comply with its obligations under the
Subscriber represents and agrees that: (a) it is
Standard Contractual Clauses or is breach of
authorized to agree to and enter into this
any warranties under the Standard
DPA for and on behalf of itself and, as
Contractual Clauses, and Subscriber intends
applicable, each of its Affiliates (b) if
to suspend the transfer of European Data to
applicable, it solely, will be entitled to
HackTheBox or terminate the Standard
exercise any right or seek any remedy any of
Contractual Clauses, Subscriber agrees to
its Affiliates may have under this DPA on
provide HackTheBox with reasonable notice
behalf of its Affiliates, and not separately for
to enable HackTheBox to cure such
each Affiliate individually but in a combined
non-compliance and reasonably cooperate
manner for itself and all of its Affiliates
with HackTheBox to identify what additional
together and (c) is solely responsible for
safeguards, if any, may be implemented to
coordinating all Instructions, authorizations
remedy such non-compliance. If HackTheBox
and communications with HackTheBox under
has not or cannot cure the non-compliance,
the DPA and will be entitled to make and
Subscriber may suspend or terminate the
receive any communications related to this
affected part of the Service in accordance
DPA on behalf of its Affiliates.
with the Agreement without liability to either
party (but without prejudice to any fees that
7
8
SCHEDULE 1
A. PARTIES
Data exporter:
Name: The Subscriber, as defined in the Subscription Agreement (on behalf of itself and its Affiliates)
Address: The Subscriber address, as set out in the Service Order Form
Contact person’s name, position and contact details: The Subscriber’s contact details, as set out in
the Service Order Form
Activities relevant to the data transferred under these Clauses: Processing of Personal Data in
connection with Subscriber’s use of the Services under the Subscription Agreement.
Role (controller/processor): Controller
Data importer:
Name: Hack The Box
Address: The address, as set out in the Service Order Form
Contact person’s name, position and contact details: The contact details, as set out in the Service
Order Form
Activities relevant to the data transferred under these Clauses: Processing of Personal Data in
connection with Subscriber’s use of the Services under the Subscription Agreement.
Role (controller/processor): Processor
B.DETAILS OF THE PROCESSING
Categories of Data Subjects: Subscriber’s Employees and Subscriber’s Authorized Users
Categories of Personal Data: Email addresses, business contact details, online identifiers,
account information.
Categories of Special Processing of Special Categories’ or Sensitive Personal
Category Personal Data or Data is not required for the provision of the Services.
Sensitive Data:
Nature of the processing: Personal Data will be Processed in accordance with the
Subscription Agreement (including this DPA) in order to
provide the Services and may be subject to the following
Processing activities:
1. Storage and other processing necessary to provide,
maintain and improve the Services provided to Subscriber;
and/or
1
2. Disclosure in accordance with the Subscription
Agreement (including this DPA) and/or as compelled by
applicable laws.
Purpose(s) HackTheBox will process Personal Data as necessary to
provide the Services pursuant to the Subscription
Agreement, as further specified in the Service Order Form,
this DPA and as further instructed by Subscriber.
Retention Period: For the duration of the Subscription Agreement and 2
months thereafter, unless earlier deleted by Subscriber or
its Authorised Users or unless required differently in order to
comply with any legal or regulatory obligation or to
defend any claims in respect of the Subscription
Agreement.
C. Competent Supervisory Authority
For the purposes of the Standard Contractual Clauses, the supervisory authority that will act as
competent supervisory authority will be determined in accordance with GDPR.
2
SCHEDULE 2
TECHNICAL & ORGANISATIONAL SECURITY MEASURES
Where applicable, this Schedule 2 will serve as Annex II to the Standard Contractual Clauses. The
following provides more information regarding HackTheBox’s technical and organisational security
measures set forth below.
The text of HackTheBox’s technical and organisational security measures to protect Subscriber
Data is available at https://resources.hackthebox.com/hubfs/Legal/DSM.pdf, which is
incorporated into this DPA.
1
SCHEDULE 3
LIST OF SUB-PROCESSORS
To help Hack The Box deliver the Service, we engage Sub-Processors to assist with our data
processing activities. A list of our Sub-Processors and our purpose for engaging them is located on
at https://resources.hackthebox.com/hubfs/Legal/SPL.pdf which is incorporated into this DPA
1
www.hackthebox.com info@hackthebox.com
1