Terms for the IVON incident investigation

B.1 Roles and status. For the personal data that Attic processes from Customer's Microsoft 365 environment during the investigation, Customer is the controller and Attic is the processor. This Part B is the data processing agreement within the meaning of Art. 28(3) GDPR. It is concluded electronically by the granting of the consent; the parties agree that this qualifies as in writing within the meaning of that article. For the data about the administrator personally, Attic is the controller — see Part C.

B.2 Subject matter, nature, purpose and duration. One-off triage and analysis of security incidents and misconfigurations in Customer's environment, with a view to the report. The processing lasts for as long as the investigation runs, plus the retention period set out in B.5.

B.3 Data and data subjects. The following are processed: identity and authentication data (usernames, email addresses, role information, sign-in history, MFA status, risk events), device and session data (endpoint IDs, device names, IP addresses, threat signals), incident and alert data including the content that Microsoft Defender or Sentinel includes in an alert (occasionally fragments of email content or file names), audit logs, and configuration and posture data. Data subjects: end users and administrators within Customer's environment, and external individuals insofar as their data appears in an incident.

B.4 Instructions. These terms, this Part B and the permissions granted with the consent constitute Customer's complete written instructions. Attic does not process for its own purposes and does not process for the training of models. Customer may issue additional instructions via [email protected]; if a statutory obligation requires Attic to process beyond those instructions, Attic notifies Customer beforehand, unless that law prohibits it.

B.5 Retention and deletion. Within 24 hours of delivery of the report, the data collected for the investigation, the report and the session expire. Those 24 hours run from the end of the run, not from its start. If Customer closes the browser session sooner, the report is already gone at that moment. This means that everything Attic retrieved from Customer's environment disappears, as does Attic's own copy of the report; after that, Attic no longer holds a copy and can no longer provide Customer with one. If Customer does not keep a downloaded copy of its own (article 2.2), the report is gone. The original data remains in Customer's environment, unaffected. Attic confirms the deletion in writing on request.

B.6 Security (Art. 32 GDPR). Least privilege and mandatory multi-factor authentication; encryption in transit (TLS 1.2 or higher) and at rest; per-tenant token scoping that technically enforces that no data is retrieved from any other environment; the access token expires as soon as the run is complete; the report is bound to the browser session that carried out the investigation, is not reachable via a shareable link and is not sent by email; execution in a clean runtime with no remnants of earlier investigations; logging of access to customer data; a duty of confidentiality and a Certificate of Conduct (Verklaring Omtrent het Gedrag) for staff. Attic is undergoing certification for ISO/IEC 27001:2023, with the Stage 2 audit planned for Q4 2026.

B.7 Sub-processors. For this investigation Attic engages: Hetzner Online GmbH (hosting, Germany and Finland) and Microsoft (Azure, West Europe region; AI inference in Azure AI Foundry, Sweden Central region). The current list is published at atticsecurity.com/en/sub-processors; the list as it reads at the moment the consent is granted is the one that applies. Sub-processors are bound by obligations at least equivalent to this Part B, and Attic remains responsible to Customer for their compliance.

B.8 Location. Processing takes place exclusively within the European Economic Area. No transfer outside it takes place.

B.9 Personal data breaches. Attic reports a personal data breach affecting Customer's personal data within 48 hours of discovery to the administrator account that granted the consent, stating the nature, the likely consequences and the measures taken and proposed. Customer assesses whether to notify the Dutch Data Protection Authority and the data subjects; Attic provides support in doing so.

B.10 Data subject rights. Customer handles requests from data subjects. Attic provides support insofar as reasonably possible, responds within 10 working days and forwards without delay any request that reaches Attic directly. After the 24 hours referred to in B.5, Attic can no longer provide support; the data no longer exists.

B.11 Demonstrating compliance. On request, Attic makes available the information needed to demonstrate compliance with Art. 28 GDPR, and to that end provides the most recent audit report by an independent party as soon as one is available.

This part concerns the data that Attic processes about you as the administrator. Attic is the controller for that data. What happens to the data from your Microsoft 365 environment is set out in Part B; your organisation is the controller for that data and Attic is the processor.

Who we are. Attic B.V., Molenstraat 36, 4761 CL Zevenbergen, the Netherlands, Chamber of Commerce number 83973206. Privacy contact: Erik Remmelzwaal, CEO — [email protected].

What we record about you. Your name and business email address; the name of your organisation and the Microsoft Entra tenant ID of your environment; the time at which you granted the consent, the permissions granted and the version of this document; which link you arrived through; and whether the investigation leads to a follow-up. We receive this data from Microsoft as part of the consent you grant — you do not have to enter it separately.

Unsubscribing. Every message we send you carries an unsubscribe link at the bottom. Unsubscribing is possible at any time and is free of charge, using that link or by sending a message to [email protected]. The investigation and your report go ahead as normal — they are part of what you requested.

Who we share it with. We use HubSpot (EU region) for our customer relationship management; your contact details are held there. The full list of parties that process data on our behalf is published at atticsecurity.com/en/sub-processors. We process exclusively within the EEA.

How long we keep it. The data from your environment, our own copy of the report and your session: within 24 hours of delivery of the report (Part B.5), and the report itself sooner still if you close the browser session. If you want to keep the report, download it from your browser — after that, we cannot give it to you either. Your contact details: 24 months after the investigation, if there is no follow-up; that is a period we have set ourselves. The record of what you accepted and when: for as long as we need to be able to rely on it. If you unsubscribe, we keep at least your email address on a suppression list, precisely so that we do not approach you again.

Your rights. You have the right of access, rectification, erasure, restriction, portability and objection. To exercise them, send a message to [email protected]; we respond within 30 days. We do not take automated decisions about you with legal or similarly significant effects.

Complaints. If you disagree with how we handle your data, let us know via [email protected]. You may also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), www.autoriteitpersoonsgegevens.nl.