Data Processing Agreement
Our commitment to protecting your data and ensuring GDPR compliance in all processing activities
Last updated: April 21, 2026 · Effective: June 5, 2026 · [email protected]
This Data Processing Agreement ("Agreement") forms part of the Contract for Services under the IronWiFi Terms and Conditions (the "Principal Agreement"). This Agreement is an amendment to the Principal Agreement and is effective upon its incorporation to the Principal Agreement, which incorporation may be specified in the Principal Agreement or an executed amendment to the Principal Agreement. Upon its incorporation into the Principal Agreement, this Agreement will form a part of the Principal Agreement.
We periodically update this Agreement. If you have an active IronWiFi account, you will be informed of any modification by email.
The term of this Agreement shall follow the term of the Principal Agreement. Terms not defined herein shall have the meaning as set forth in the Principal Agreement.
WHEREAS
(A) The Company acts as a Data Controller.
(B) The Company wishes to subcontract certain Services, which imply the processing of personal data, to the Data Processor.
(C) The Parties seek to implement a data processing agreement that complies with the requirements of the current legal framework in relation to data processing and with the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
(D) The Parties wish to lay down their rights and obligations.
IT IS AGREED AS FOLLOWS:
1. Definitions and Interpretation
1.1 Unless otherwise defined herein, capitalized terms and expressions used in this Agreement shall have the following meaning:
1.1.1 "Agreement" means this Data Processing Agreement and all Schedules;
1.1.2 "Company Personal Data" means any Personal Data Processed by a Contracted Processor on behalf of Company pursuant to or in connection with the Principal Agreement;
1.1.3 "Contracted Processor" means a Subprocessor;
1.1.4 "Data Protection Laws" means EU Data Protection Laws and, to the extent applicable, the data protection or privacy laws of any other country;
1.1.5 "EEA" means the European Economic Area;
1.1.6 "EU Data Protection Laws" means Regulation (EU) 2016/679 (the "GDPR"), the UK Data Protection Act 2018 and UK GDPR, the Swiss Federal Act on Data Protection (FADP), and other data-protection or privacy laws applicable to the Processing of Company Personal Data, in each case as amended, replaced, or superseded from time to time;
1.1.7 "GDPR" means EU General Data Protection Regulation 2016/679;
1.1.8 "Data Transfer" means:
1.1.8.1 a transfer of Company Personal Data from the Company to a Contracted Processor; or
1.1.8.2 an onward transfer of Company Personal Data from a Contracted Processor to a Subcontracted Processor, or between two establishments of a Contracted Processor, in each case, where such transfer would be prohibited by Data Protection Laws (or by the terms of data transfer agreements put in place to address the data transfer restrictions of Data Protection Laws);
1.1.9 "Services" means the Captive Portal and RADIUS services the Company provides.
1.1.10 "Subprocessor" means any person appointed by or on behalf of Processor to process Personal Data on behalf of the Company in connection with the Agreement.
1.2 The terms "Commission", "Controller", "Data Subject", "Member State", "Personal Data", "Personal Data Breach", "Processing" and "Supervisory Authority" shall have the same meaning as in the GDPR, and their cognate terms shall be construed accordingly.
2. Processing of Company Personal Data
2.1 Processor shall:
2.1.1 comply with all applicable Data Protection Laws in the Processing of Company Personal Data; and
2.1.2 not Process Company Personal Data other than on the relevant Company's documented instructions.
2.2 The Company instructs Processor to process Company Personal Data.
2.3 Description of Processing (Art. 28(3) GDPR).
2.3.1 Subject matter: provision of the IronWiFi Service, which may include WiFi authentication (Cloud RADIUS, Cloud PKI, Captive Portal, OpenRoaming), WiFi identity threat detection and response (WiFi ITDR), and related administrative, reporting, and support functions.
2.3.2 Duration: the duration of the Principal Agreement, plus any retention period set out in Section 9.
2.3.3 Nature and purpose: authentication of network users; issuance, management, and revocation of digital certificates; captive-portal user authentication, consent capture, and session management; collection, storage, and analysis of authentication and session telemetry; automated threat detection, risk scoring, and response; administrative configuration and customer-support operations.
2.3.4 Categories of Data Subjects: end users of the Company's network; the Company's IT administrators; visitors to the Company's captive-portal pages; individuals about whom the Company submits data to the Service.
2.3.5 Categories of Personal Data: identifiers (username, email, MAC address, IP address, device identifier); authentication data (hashed credentials, certificate subject names, authentication timestamps, session state); network attributes (access point, location if configured, signal strength, session duration); behavioural telemetry (authentication patterns, timing, anomaly indicators); captive-portal fields as configured by the Company; account-administrator data (name, email, role, audit trail).
2.3.6 Special categories: the Processor does not require or solicit special-category personal data under GDPR Art. 9. If the Company configures the Service to process special-category data, the Company is solely responsible for ensuring a lawful Art. 9 basis.
3. Processor Personnel
Processor shall take reasonable steps to ensure the reliability of any employee, agent or contractor of any Contracted Processor who may have access to the Company Personal Data, ensuring in each case that access is strictly limited to those individuals who need to know / access the relevant Company Personal Data, as strictly necessary for the purposes of the Principal Agreement, and to comply with Applicable Laws in the context of that individual's duties to the Contracted Processor, ensuring that all such individuals are subject to confidentiality undertakings or professional or statutory obligations of confidentiality.
4. Security
4.1 Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Processor shall in relation to the Company Personal Data implement appropriate technical and organizational measures to ensure a level of security appropriate to that risk, including, as appropriate, the measures referred to in Article 32(1) of the GDPR. Processor maintains a SOC 2 Type II attestation, available to Company under NDA upon request.
4.2 In assessing the appropriate level of security, Processor shall take account in particular of the risks that are presented by Processing, in particular from a Personal Data Breach.
4.3 Technical and Organizational Measures. The measures implemented by Processor include:
4.3.1 Encryption: data in transit over TLS 1.2 or higher; data at rest encrypted with AES-256; credentials stored using adaptive hashing with per-record salt.
4.3.2 Access controls: role-based access with least-privilege; multi-factor authentication for administrative access; quarterly access reviews; immediate revocation on termination.
4.3.3 Network security: perimeter defenses (WAF, DDoS mitigation); segmentation of production and non-production environments; logical isolation of Company tenants.
4.3.4 Operational security: annual SOC 2 Type II attestation; weekly vulnerability scanning; annual third-party penetration testing; dependency-vulnerability monitoring.
4.3.5 Incident response: documented incident-response plan tested annually; 24/7 on-call rotation; 72-hour breach-notification commitment (see Section 7).
4.3.6 Personnel: pre-employment background checks; security-awareness training on hire and annually; confidentiality obligations for all personnel with access to Company Personal Data.
4.3.7 Supplementary measures for international transfers: end-to-end encryption in transit across all transfer channels; access logging; documented transfer-impact assessments for new third-country sub-processors; policy against voluntary disclosure to third-country authorities absent valid legal compulsion.
5. Subprocessing
5.1 General authorization. Company hereby grants Processor a general written authorization to engage Subprocessors to Process Company Personal Data in connection with the Service, subject to Sections 5.2 through 5.5.
5.2 Subprocessor list. The current list of Subprocessors is maintained at https://trust.ironwifi.com/subprocessors.
5.3 Notice of changes. Processor shall provide Company with at least thirty (30) days' advance notice of any addition or replacement of a Subprocessor that will Process Company Personal Data, by updating the Subprocessor list and by email to the notification address Company has on file (or via a subscription mechanism on the Subprocessor list page).
5.4 Objection. Company may object in writing to the engagement of a new Subprocessor on reasonable grounds related to data protection within the notice period. The Parties will work in good faith to resolve the objection. If they cannot, Company may, as its sole and exclusive remedy, terminate the affected Service and receive a pro-rata refund of prepaid fees for the unused term.
5.5 Subprocessor obligations. Processor shall impose on each Subprocessor, by way of a written contract, data-protection obligations substantially the same as those set out in this Agreement, in particular providing sufficient guarantees to implement appropriate technical and organizational measures. Processor remains fully responsible to Company for the performance of each Subprocessor's obligations.
6. Data Subject Rights
6.1 Taking into account the nature of the Processing, Processor shall assist the Company by implementing appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Company obligations, as reasonably understood by Company, to respond to requests to exercise Data Subject rights under the Data Protection Laws.
6.2 Processor shall:
6.2.1 promptly notify Company if it receives a request from a Data Subject under any Data Protection Law in respect of Company Personal Data; and
6.2.2 ensure that it does not respond to that request except on the documented instructions of Company or as required by Applicable Laws to which the Processor is subject, in which case Processor shall to the extent permitted by Applicable Laws inform Company of that legal requirement before the Contracted Processor responds to the request.
7. Personal Data Breach
7.1 Processor shall notify Company without undue delay, and in any event within seventy-two (72) hours of becoming aware of a Personal Data Breach affecting Company Personal Data, providing Company with sufficient information to allow the Company to meet any obligations to report or inform Data Subjects of the Personal Data Breach under the Data Protection Laws. Such notice shall include, to the extent known: (i) a description of the nature of the Breach and, where possible, the categories and approximate number of Data Subjects and records concerned; (ii) the likely consequences; (iii) the measures taken or proposed to address the Breach and mitigate its effects; and (iv) contact information for further inquiries.
7.2 Processor shall co-operate with the Company and take reasonable commercial steps as are directed by Company to assist in the investigation, mitigation and remediation of each such Personal Data Breach.
7.3 The transmission of notice under this Section 7 is not an acknowledgment of fault, liability, or wrongdoing by Processor.
8. Data Protection Impact Assessment and Prior Consultation
8.1 Processor shall provide reasonable assistance to the Company with any data protection impact assessments, and prior consultations with Supervising Authorities or other competent data privacy authorities, which Company reasonably considers to be required by article 35 or 36 of the GDPR or equivalent provisions of any other Data Protection Law, in each case solely in relation to Processing of Company Personal Data by, and taking into account the nature of the Processing and information available to, the Contracted Processors.
9. Deletion or return of Company Personal Data
9.1 Subject to this section 9 Processor shall promptly and in any event within 10 business days of the date of cessation of any Services involving the Processing of Company Personal Data (the "Cessation Date"), delete and procure the deletion of all copies of those Company Personal Data.
10. Audit rights
10.1 Subject to this section 10, Processor shall make available to the Company on request all information necessary to demonstrate compliance with this Agreement, and shall allow for and contribute to audits, including inspections, by the Company or an auditor mandated by the Company in relation to the Processing of the Company Personal Data by the Contracted Processors.
10.2 Information and audit rights of the Company only arise under section 10.1 to the extent that the Agreement does not otherwise give them information and audit rights meeting the relevant requirements of Data Protection Law.
11. Data Transfer
11.1 Where Company Personal Data originating in the EEA, United Kingdom, or Switzerland is transferred to a country that is not the subject of an adequacy decision of the European Commission (or of the UK or Swiss Federal Council as applicable), the transfer is carried out under the following safeguards:
11.1.1 Where Processor (or the relevant Subprocessor) is certified under the EU-US Data Privacy Framework (and, for UK data, the UK Extension to the DPF; and for Swiss data, the Swiss-US DPF), the transfer is made under the DPF certification.
11.1.2 Otherwise, the Parties enter into the Standard Contractual Clauses approved by the European Commission on 4 June 2021 (Decision (EU) 2021/914), Module 2 (Controller-to-Processor) or Module 3 (Processor-to-Processor) as applicable, incorporated into this Agreement by reference and populated as set out in Annex III.
11.1.3 For transfers from the United Kingdom, the UK International Data Transfer Addendum issued by the Information Commissioner under s.119A of the Data Protection Act 2018 applies, populated as set out in Annex III.
11.1.4 For transfers from Switzerland, the Standard Contractual Clauses apply with the adaptations set out in the Swiss FDPIC guidance, including replacing references to the GDPR with references to the FADP and treating the Federal Data Protection and Information Commissioner as the Supervisory Authority.
11.2 Processor implements supplementary technical, organizational, and contractual measures as described in Section 4 and Annex II to protect Company Personal Data transferred internationally, consistent with the Schrems II judgment (Case C-311/18) and EDPB Recommendations 01/2020 (v2.0).
11.3 In the event that the safeguards set out above cease to provide an adequate level of protection, the Parties shall work in good faith to implement alternative safeguards or to suspend the affected transfers.
12. General Terms
12.1 Confidentiality. Each Party must keep this Agreement and information it receives about the other Party and its business in connection with this Agreement ("Confidential Information") confidential and must not use or disclose that Confidential Information without the prior written consent of the other Party except to the extent that:
(a) disclosure is required by law;
(b) the relevant information is already in the public domain.
12.2 Notices. All notices and communications given under this Agreement must be in writing and will be delivered personally, sent by post or sent by email to the address or email address set out in the heading of this Agreement at such other address as notified from time to time by the Parties changing address.
13. Governing Law and Jurisdiction
13.1 This Agreement is governed by and construed in accordance with the laws of the State of Florida, United States, without regard to its conflict-of-laws principles, except that the Standard Contractual Clauses (where incorporated under Section 11) are governed by their own choice-of-law provisions.
13.2 Any dispute arising in connection with this Agreement that the Parties are unable to resolve amicably will be submitted to the exclusive jurisdiction of the state and federal courts located in Orange County, Florida, except that a claim arising under the Standard Contractual Clauses (where incorporated under Section 11) is subject to the jurisdictional provisions set out in those clauses.
14. California Consumer Privacy Act — Service Provider and Contractor Terms
14.1 To the extent Processor Processes personal information of California residents on behalf of Company, Processor acts as a "Service Provider" and, where applicable, a "Contractor," as those terms are defined in Cal. Civ. Code § 1798.140.
14.2 Processor certifies that it:
14.2.1 will not sell or share Company Personal Data (as those terms are defined by the CPRA);
14.2.2 will not retain, use, or disclose Company Personal Data for any purpose other than for the specific purpose of performing the Service specified in the Principal Agreement, including for a commercial purpose other than providing the Service, except as permitted under the CPRA;
14.2.3 will not combine Company Personal Data with personal information from another source, except as permitted under Cal. Civ. Code § 1798.140(ag)(2);
14.2.4 will comply with applicable obligations under the CPRA and will provide the same level of privacy protection as required by the CPRA.
14.3 Processor will assist Company in responding to verifiable consumer requests under the CPRA and will provide Company with information reasonably necessary to respond to such requests.
14.4 Processor will notify Company promptly if it determines it can no longer meet its obligations under the CPRA. Company may take reasonable steps to stop and remediate any unauthorized use of Company Personal Data.
14.5 Processor will assist Company in complying with obligations under other U.S. state privacy laws (VCDPA, CPA, CTDPA, UCPA, TDPSA, OCPA, MCDPA, DPDPA, ICDPA, TIPA, NJDPA, INCDPA, MODPA, and successors) to the same extent it assists under this Section 14.
15. Business Associate Agreement (HIPAA)
15.1 Where Company is a Covered Entity or Business Associate under the U.S. Health Insurance Portability and Accountability Act of 1996 (as amended, including by the HITECH Act) and its implementing regulations at 45 C.F.R. Parts 160, 162, and 164 (collectively, "HIPAA"), Processor is prepared to execute a Business Associate Agreement ("BAA") that supplements this Agreement and flows down the Security Rule, Privacy Rule, and Breach Notification Rule obligations applicable to IronWifi's Services.
15.2 To request a BAA, Company shall contact [email protected]. IronWifi's template BAA incorporates the required elements of 45 C.F.R. § 164.504(e) and the Security Rule safeguards described in Section 4.3 of this Agreement.
15.3 Countersignature required. No BAA is effective, and nothing in this Agreement or on IronWifi's website shall be construed as an executed Business Associate Agreement, unless and until a written BAA has been signed by both parties and countersigned by IronWifi's HIPAA Security Officer. Company must not process Protected Health Information through the Service before receiving IronWifi's countersigned BAA. Where Company has processed Protected Health Information through the Service without a countersigned BAA, the parties shall execute a BAA promptly, but execution shall not retroactively validate the prior processing, which constitutes a material breach of these Terms and the Services Agreement.
Annex I — Parties and Description of Transfer
Data Exporter (Controller): Company, as identified in the IronWiFi subscription account and Principal Agreement.
Data Importer (Processor): IronWiFi, LLC, 100 East Pine Street, Suite 110, Orlando, FL 32801, United States. Contact: [email protected].
EU Representative (GDPR Art. 27): not currently appointed. IronWiFi is evaluating whether Art. 27 appointment is required under its current processing activities, and intends to publish the appointed representative's name and address upon completion of that evaluation. In the interim, EU Data Subjects may contact Processor directly at [email protected].
UK Representative (UK GDPR Art. 27): not currently appointed, subject to the same evaluation and interim contact as above.
Categories of Data Subjects, Personal Data, Purposes, Duration: as set out in Section 2.3 of this Agreement.
Competent Supervisory Authority: the Supervisory Authority of the relevant Member State of the EU, or the Information Commissioner's Office for UK transfers, or the Federal Data Protection and Information Commissioner for Swiss transfers.
Annex II — Technical and Organizational Measures
See Section 4.3 of this Agreement, which is incorporated here by reference.
Annex III — Standard Contractual Clauses (Incorporation)
Module applicable: where Company is in the EEA and Processor acts as Processor, Module 2 (Controller-to-Processor) of the 2021 SCCs applies; where a Subprocessor acts as Processor on behalf of Processor, Module 3 (Processor-to-Processor) applies.
Completion of SCC options:
Clause 7 (Docking Clause): not used.
Clause 9 (Sub-processing): OPTION 2 (general written authorization), with 30-day advance notice per Section 5.3.
Clause 11(a) (Redress): optional independent-dispute-resolution language is not selected.
Clause 17 (Governing Law): Irish law.
Clause 18 (Choice of Forum): Irish courts.
Annexes to the SCCs:
Annex I.A (List of Parties): IronWiFi, LLC and Company, as identified in the IronWiFi subscription account.
Annex I.B (Description of Transfer): Section 2.3 of this Agreement.
Annex I.C (Competent Supervisory Authority): as set forth in Annex I above.
Annex II (Technical and Organizational Measures): Section 4.3 of this Agreement.
Annex III (List of Subprocessors): maintained at https://trust.ironwifi.com/subprocessors.
UK Addendum: where Company Personal Data is transferred from the UK, the UK International Data Transfer Addendum issued by the ICO under s.119A of the Data Protection Act 2018 applies. Tables 1, 2, and 3 of the UK Addendum are completed by reference to the Annexes above and to the selected SCC Module.
Swiss adaptation: where personal data originates in Switzerland, the SCCs apply with the adaptations set out in the Swiss FDPIC guidance (references to the GDPR are read as references to the FADP; the Federal Data Protection and Information Commissioner is the Supervisory Authority).