Data processing agreement
Version 1, effective from 13 November 2026. An annex to the terms of use of the Rejekto service for paid plans. In case of any difference, the Slovak version prevails.
1. Parties and subject
1.1 The controller is the customer who has created a paid account in the Rejekto service (the “Customer”).
1.2 The processor is IOSEC Slovakia s. r. o., Mariánska 2222/3, 811 08 Bratislava – mestská časť Staré Mesto, Slovakia, company ID 44517734 (“IOSEC”).
1.3 This agreement is an annex to the terms of use of the Rejekto service. The Customer enters into it by accepting the terms of use at registration or when ordering a plan.
1.4 The agreement governs the processing of personal data that IOSEC processes on behalf of the Customer when providing the Rejekto service, under Article 28 of Regulation (EU) 2016/679 (the “GDPR”).
1.5 The agreement does not cover data that IOSEC processes as an independent controller: account and sign-in data, invoicing, protection of the service against abuse, the free test and the records of the operator's actions. Those are governed by the privacy policy.
1.6 If the Customer processes data as a processor for its own clients, IOSEC acts as a sub-processor. The Customer is responsible for having its clients' authorisation to engage IOSEC.
2. Scope of processing
2.1 IOSEC processes personal data only to the extent and for the purposes in this table.
| Data | Data subjects | Purpose | Duration |
|---|---|---|---|
| E-mail, role and language of a team member (names are not stored) | Employees and collaborators of the Customer | Access to the application and account management | For the life of the account or until the member is removed |
| E-mails of alert recipients of a site | People designated by the Customer | Sending alerts about changes on the monitored site and the monthly summary | For the life of the account or until the recipient is removed |
| Notes on a site, reasons given when marking a finding as wrong and when reporting a finding | People the Customer mentions in the text | The Customer's internal records, review of a finding | For the life of the account; reports 12 months |
| Record of changes in the organization (which member changed what and when) | Team members of the Customer | Audit of changes for the Customer | For the life of the account |
| Name and note a developer enters when marking a fix through the developer link | Developers and website administrators of the Customer or its clients | Record of the fix and the check scan | 90 days after the link expires |
| Personal data captured by a scan: screenshots, texts and page addresses of the monitored site | People shown on the publicly available pages of the monitored site | Technical audit of the site's behaviour, history, reports | Screenshots and HTML reports 3 months, scan data and findings 12 months; a site whose monitoring ended 30 days, then deletion |
| The same for one-off scans of third-party sites the Customer enters (a client's competitors, a prospect audit) | People shown on the publicly available pages of those sites | Comparison and audit for the Customer | Audit 90 days; a competitor until removed or until the site's monitoring ends |
| Identifiers of shared links and client reports | – | Access to a report without signing in | 30 days after the link expires or is revoked |
2.2 IOSEC does not process special categories of personal data under Article 9 GDPR. The Customer does not enter such data into the application.
2.3 A scan records the publicly available content of a website as a visitor sees it. It does not sign in, submit forms or enter data. Cookie values are stored truncated to 64 characters.
2.4 Rejekto sends no e-mails to the Customer's developers or website administrators. The badge code, the developer brief and the developer link are sent by the Customer from its own e-mail program; IOSEC does not store those addresses.
2.5 Processing is automated: storage, display in the application, sending of e-mails and generation of reports.
3. Obligations of IOSEC
3.1 Instructions. IOSEC processes personal data only on the Customer's documented instructions. The instructions are this agreement, the terms of use and the settings the Customer makes in the application.
3.2 Notice of an unlawful instruction. If IOSEC considers an instruction to infringe the GDPR or other data protection law, it informs the Customer without undue delay.
3.3 Confidentiality. Only people who need access to operate the service have it, and they are bound by confidentiality, which continues after their relationship with IOSEC ends.
3.4 Security. IOSEC has adopted and maintains the technical and organisational measures under Article 32 GDPR listed in Annex 1.
3.5 Data subject rights. IOSEC gives the Customer reasonable assistance with data subject requests. A request it receives directly is forwarded to the Customer within 3 working days; IOSEC does not answer it on the merits itself.
3.6 Personal data breach. IOSEC notifies the Customer of a personal data breach concerning the Customer's data without undue delay after becoming aware of it, as a rule within 48 hours. The notice describes the nature of the breach, the data concerned, the likely consequences and the measures taken; information not yet known at that time is provided as it becomes available.
3.7 Assistance. IOSEC assists the Customer to a reasonable extent with data protection impact assessments and consultations with the supervisory authority where they concern the Rejekto service.
3.8 Demonstrating compliance and audits. On request, IOSEC provides the information needed to demonstrate compliance with this agreement. The Customer may audit at most once a year, with at least 30 days' notice, during normal working hours and without endangering other customers' data. Audits take place primarily through written answers and documentation.
3.9 Own purposes. IOSEC does not use data processed on behalf of the Customer for its own purposes, in particular not to approach the Customer's clients.
4. Sub-processors and place of processing
4.1 On the effective date, IOSEC uses no sub-processor for the Customer's data. The service runs on IOSEC's own servers in the European Union, backups are on IOSEC's own equipment and e-mails are sent by IOSEC's own mail server. The current state is in Annex 2.
4.2 The Customer gives IOSEC a general written authorisation to engage a sub-processor. IOSEC informs the account owner by e-mail at least 30 days in advance. The Customer may object within that period. Without an objection, the change is deemed approved. If the parties do not agree, the Customer may terminate the service as of the day the sub-processor is engaged; the notice must be given within 7 days after the unsuccessful negotiation.
4.3 IOSEC binds a sub-processor to the same data protection obligations as it has under this agreement and remains liable to the Customer for its performance.
4.4 Personal data is processed exclusively in the European Union. IOSEC does not transfer it to a country outside the European Economic Area without the Customer's prior written instruction.
5. Security measures
5.1 IOSEC applies the technical and organisational measures in Annex 1.
5.2 IOSEC may change the measures as long as the achieved level of protection is not reduced. Significant changes are documented.
5.3 Annexes 1 to 3 form part of this agreement. Their current wording is published together with the agreement.
6. Obligations of the Customer
6.1 The Customer is responsible for having a legal basis for the processing of data entered into the application and for informing the data subjects.
6.2 The Customer adds only websites it is entitled to have scanned; for competitors and prospects this is a one-off scan of publicly available content.
6.3 The Customer does not enter personal data beyond what is needed to use the service into notes or other fields.
7. Term, termination and deletion
7.1 The agreement applies for the life of the Customer's paid account.
7.2 The Customer may export or delete data in the application at any time, to the extent the application allows (ending a site's monitoring, removing a member or recipient, revoking a link).
7.3 After a site's monitoring ends or the account is cancelled, IOSEC keeps the data for 30 days, during which the Customer may restore it. Then it is deleted, including scans and reports.
7.4 Data is removed from backups within 60 days of deletion at the latest (daily backups 14 days, weekly 8 weeks). On request, IOSEC issues the Customer a confirmation of deletion.
7.5 Deletion does not apply to data IOSEC must retain by law, in particular accounting documents. IOSEC processes those as an independent controller.
8. Final provisions
8.1 In case of a conflict between this agreement and the terms of use, this agreement prevails in data protection matters.
8.2 The agreement is governed by the law of the Slovak Republic.
8.3 IOSEC may amend the agreement in the same way as the terms of use. An amendment that reduces data protection is announced at least 30 days in advance.
8.4 Contact for data protection matters: the data protection officer, dpo@iosec.eu.
Annex 1 – Security measures
| Area | Measures |
|---|---|
| Confidentiality | Own servers in the European Union with no third-party access. Encrypted connections (TLS) for the application and e-mail. Sign-in by a one-time link valid for 15 minutes, no passwords; a session ends after 7 days of inactivity. Separation of organizations' data enforced directly in the database (row-level security), not only in the application. The operator's administration is reachable only through an encrypted SSH tunnel with a one-time link. Only IOSEC has access to the servers. |
| Integrity | Every operator action is written to an immutable audit log. Changes in an organization are recorded for the Customer. The process that opens third-party websites runs in an isolated network without access to the database or internal networks and without system privileges. Operating system security updates within 7 days, critical ones without delay. |
| Availability | Independent external availability monitoring and operational alerts (overload, scan failures, blocked network). Limits on the number of scans and requests as protection against overload. Host firewall with automatic rule checks. |
| Recoverability | Daily database backup (14 days) and weekly backup (8 weeks) on the server, a copy on IOSEC's own equipment off the server; a backup before every schema change. Monthly restore test into a separate environment. |
| Pseudonymisation and minimisation | IP addresses are stored only as a one-way hash for 24 hours. Cookie values truncated to 64 characters. Members' names are not stored. Addresses of developers and website administrators are not stored (the Customer sends to them). Client reports and developer links contain no members' e-mails, internal notes or scores beyond their purpose. |
| Regular review | The measures are reviewed by IOSEC's data protection officer quarterly and at every major change of the service. Incident procedure: detection → containment → notice to the Customer under 3.6 → remedy → record. Contact: dpo@iosec.eu. |
Annex 2 – Sub-processors
As of 13 November 2026, IOSEC uses no sub-processor for the Customer's data. Changes are announced under 4.2 and recorded in this annex.
For completeness: for invoicing and payments IOSEC, as an independent controller, uses the iDoklad invoicing system and, for card payments, Stripe; availability monitoring (UptimeRobot, healthchecks.io) receives only the public address of the service and the time of the check, no personal data. These services are described in the privacy policy.
Annex 3 – Description of the service
Rejekto is a service for the technical audit of how a website handles visitors' consent. For the Customer it includes:
- regular scans of monitored websites on desktop and mobile,
- an application with findings, scan history and comparison,
- e-mail alerts on changes and a monthly summary,
- reports and client reports as PDF, shared links, a badge for the website, a developer link,
- one-off scans of a client's competitors and of prospects.
Personal data is processed only to the extent of 2.1.