When your organisation uses Lureproof, you're the controller of your staff's data and we're your processor. This agreement sets out the UK GDPR Article 28 terms: we only act on your instructions, keep the data secure, use only the listed subprocessors, and tell you about a breach within 48 hours.
Parties and scope
This data processing agreement (DPA) is between the customer organisation (“you”, the controller) and Fred Oyetayo, trading as Fred Web Studios, of Imperial Way, Thatcham, West Berkshire, RG19 (“we”, the processor). It forms part of, and is incorporated into, our terms of service, and applies whenever we process personal data on your behalf. If this DPA and the terms conflict on data protection, this DPA wins.
Processing details
| Subject matter | Phishing simulation, security training, assessments, drills, leaderboard and reporting |
|---|---|
| Nature and purpose | Providing the Lureproof service to you under the terms |
| Data subjects | Your employees, contractors and administrators |
| Personal data | Name, work email, department, account status, practice-email events, training, assessment and drill results, chosen replies in the live-attack practice chat, leaderboard points |
| Special category data | None intended. In the live attack, staff choose from pre-written replies and don't type free text. |
| Duration | The term of the agreement, plus up to 90 days for deletion |
Our obligations
Under UK GDPR Article 28 (and the EU GDPR where it applies), we will:
- Process personal data only on your documented instructions, including these terms and your settings in the product, unless the law requires otherwise (in which case we'll tell you first, unless the law forbids it).
- Make sure everyone authorised to process the data is bound by confidentiality.
- Apply the security measures below, and keep them appropriate to the risk.
- Use only the subprocessors on our subprocessors page, under written terms that protect the data at least as well as this DPA. We'll give you 30 days' notice of any new subprocessor, and you can object on reasonable data protection grounds.
- Help you respond to data subject requests, and assist with security, breach notifications, data protection impact assessments and consultations with regulators.
- Notify you of a personal data breach affecting your data without undue delay, and in any case within 48 hours of becoming aware of it, with the information you need to meet your own obligations.
- At the end of the service, delete or return your data at your choice, unless the law requires us to keep it.
- Make available the information needed to show we comply with this DPA, and allow for and contribute to reasonable audits.
Your obligations
You confirm you have a lawful basis for the processing, that you've told staff a security awareness programme is running (our staff privacy notice can help), and that you'll only add people your organisation is entitled to train.
International transfers
Where personal data is transferred outside the UK or EEA, we rely on adequacy regulations or appropriate safeguards such as the UK International Data Transfer Addendum or EU Standard Contractual Clauses.
Security measures
- Encryption in transit (TLS 1.2+) and at rest; provider refresh tokens AES-GCM encrypted
- httpOnly sessions; only token hashes stored; single-use sign-in links
- Role-based admin access (Owner, Admin and Viewer), with an audit log of admin actions
- Sends restricted to verified domains and to synced or imported employees; every practice email tagged with an
X-Lureproof-Simulationheader - Least-privilege, read-only directory scopes; we never read mailboxes, files or calendars
Signed copy
This DPA applies automatically when you accept the terms. If you need a countersigned copy for your records, request one from privacy@lureproof.com.