Data Processing Agreement (EU and UK)
between [Customer legal name, address] (“Customer”, the Controller) and Athena Security, Inc., 248 Addie Roy Rd, C101, Austin, TX 78746, USA (“Athena”, the Processor). This DPA forms part of the [Master Services Agreement dated ___] (the “Agreement”).
1. Definitions. “Data Protection Law” means the EU General Data Protection Regulation 2016/679 (“GDPR”), the UK GDPR and Data Protection Act 2018, and any implementing national law, each as applicable to the Customer. “Personal Data”, “Processing”, “Data Subject”, “Controller”, “Processor”, “Supervisory Authority” and “Personal Data Breach” have the meanings in Data Protection Law. “Customer Data” means Personal Data processed by Athena on behalf of Customer under the Agreement. “Services” means the Athena products listed in Annex 1. “SCCs” means the standard contractual clauses adopted by the European Commission in Decision (EU) 2021/914, Module Two (controller to processor), and “UK Addendum” means the International Data Transfer Addendum issued by the UK Information Commissioner under s.119A of the Data Protection Act 2018.
2. Roles. Customer is the Controller and Athena is the Processor of Customer Data. Customer determines the purposes and means of Processing, including which data fields are collected, whether images are captured or stored, and retention periods. Athena Processes Customer Data only as described in Annex 1.
3. Athena’s obligations (Article 28(3)). Athena shall:
(a) Process Customer Data only on Customer’s documented instructions, including with regard to transfers to a third country, unless required to by Union or Member State law (or UK law) to which Athena is subject, in which case Athena shall inform Customer of that legal requirement before Processing unless the law prohibits it. Customer’s instructions are: the Agreement, this DPA, and configuration choices Customer makes in the Services. Athena shall inform Customer if, in its opinion, an instruction infringes Data Protection Law.
(b) Ensure that persons authorised to Process Customer Data have committed themselves to confidentiality and have received training in data protection.
(c) Implement the technical and organisational measures in Annex 2 and maintain them for the term of the Agreement.
(d) Engage subprocessors only under clause 5.
(e) Taking into account the nature of the Processing, assist Customer by appropriate technical and organisational measures in responding to requests from Data Subjects exercising their rights under Chapter III of the GDPR, as described in clause 7.
(f) Assist Customer in ensuring compliance with Articles 32 to 36 (security, breach notification, data protection impact assessments, and prior consultation), taking into account the nature of Processing and the information available to Athena, as described in clauses 6 and 8.
(g) At Customer’s choice, delete or return all Customer Data after the end of the Services, and delete existing copies, unless Union or Member State law (or UK law) requires storage, as described in clause 9.
(h) Make available to Customer all information necessary to demonstrate compliance with Article 28 and allow for and contribute to audits, including inspections, conducted by Customer or an auditor mandated by Customer, as described in clause 10.
4. Data location and transfers. (a) Athena shall host Customer Data only in data centres located within the European Union and the United Kingdom: Linode (Akamai) data centres in Frankfurt, Amsterdam and London, and Amazon Web Services EU regions. Athena’s infrastructure is configured to prevent Customer Data from leaving those locations, and access to those systems from United States IP ranges is blocked. Customer Data held in the United Kingdom is covered, for EU Customers, by the European Commission’s adequacy decision for the United Kingdom. (b) Athena shall not transfer Customer Data to, or permit access from, any third country except as set out in this clause and Annex 4. (c) Remote viewing for support under clause 6(d) occurs only through Athena’s EU environment, only under an open support ticket and only with Customer’s in-product approval. To the extent that such remote viewing by Athena personnel located in the United States constitutes a transfer under Chapter V of the GDPR or the UK GDPR, the parties agree that it is governed by the SCCs and the UK Addendum incorporated under Annex 4. (d) Email, SMS and support correspondence, and network traffic through Cloudflare, are processed by the subprocessors in Annex 3 located in the United States under the SCCs and the UK Addendum; they never contain alert images.
5. Subprocessors. Customer authorises Athena to engage the subprocessors listed in Annex 3. Athena shall inform Customer in writing at least 30 days before adding or replacing a subprocessor. Customer may object on reasonable data protection grounds within that period; if the objection cannot be resolved, Customer may terminate the affected Services without penalty. Athena shall impose on each subprocessor, by written contract, data protection obligations no less protective than this DPA, and shall remain fully liable to Customer for the subprocessor’s performance.
6. Security and support access. (a) Athena shall implement the measures in Annex 2, including encryption of Customer Data in transit and at rest, encryption of alert images on the screening device with keys held only on that device, two-factor authentication for all access to Personal Data, and logging of all access. (b) Athena personnel may access Customer Data only where necessary to perform the Services and only in connection with a support request raised by Customer. (c) All access by Athena personnel is logged, and Customer has access to those logs within the Services. (d) Athena does not have remote control of Customer systems. Remote viewing for troubleshooting requires a support ticket, Customer’s approval of the specific request within the Services, and an on-screen indicator while viewing is active. (e) Athena maintains a SOC 2 Type II attestation and shall provide the current report to Customer on request under confidentiality.
7. Data subject requests. Athena shall notify Customer without undue delay, and in any event within 3 business days, if it receives a request from a Data Subject relating to Customer Data, and shall not respond except on Customer’s instruction. The Services enable Customer to export all records relating to a named Data Subject, and Athena shall erase all such records within 10 business days of a support ticket from Customer. Where a Data Subject appears only in an image and cannot be identified by Customer, Athena shall assist Customer in documenting that the data is not reasonably identifiable.
8. Personal Data Breach. Athena shall notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach affecting Customer Data. Notification shall include, to the extent known, the nature of the breach, categories and approximate numbers of Data Subjects and records, likely consequences, measures taken or proposed, and a contact point. Athena shall provide updates as information becomes available and shall cooperate with Customer’s investigation and any notification to a Supervisory Authority or Data Subjects. Athena shall not notify a Supervisory Authority or Data Subjects on Customer’s behalf unless instructed.
9. Deletion and return. Customer may request deletion of any Customer Data at any time by support ticket, which provides an audit trail of each request; Athena shall complete the deletion within 10 business days and confirm it in the ticket. Within 30 days after the end of the Services, Athena shall, at Customer’s written election, return Customer Data in a commonly used format and/or delete it, and shall delete all remaining copies, including from backups, within 30 days thereafter, and certify deletion in writing. Athena may retain aggregated, anonymised data that does not identify any Data Subject.
10. Audit. Athena shall make available its SOC 2 Type II report, this DPA, its Record of Processing Activities relating to the Services, and the Annex 2 measures. Where these do not reasonably satisfy Customer’s obligations, Customer may conduct, or mandate an independent auditor to conduct, an audit on not less than 30 days’ written notice, no more than once per year unless required by a Supervisory Authority or following a Personal Data Breach, during business hours, under confidentiality, and without unreasonable disruption to Athena’s operations.
11. Data protection impact assessment. On request, Athena shall provide the DPIA Support Document describing the Processing, the risks, and the measures in place, and shall answer reasonable follow-up questions to assist Customer with any assessment under Article 35 or prior consultation under Article 36.
12. Optional identification features. Any feature of the Services that identifies natural persons by biometric means is disabled by default. Customer may enable such a feature only after confirming in writing that it has established a lawful basis under Article 6 and a condition under Article 9(2) (or the UK equivalent), completed a DPIA, and, where applicable, confirmed the feature is permitted under Regulation (EU) 2024/1689 (the AI Act). Customer is solely responsible for the lawfulness of enabling and using such a feature.
13. Liability, term, governing law. Each party’s liability under this DPA is subject to the limitations in the Agreement, except that nothing limits liability that cannot be limited under Data Protection Law. This DPA lasts for as long as Athena Processes Customer Data. This DPA is governed by the law of the EU Member State in which Customer is established or, for UK Customers, the law of England and Wales, and the courts of that jurisdiction have exclusive jurisdiction over disputes arising from it.
14. Contact. Athena’s Data Protection Officer is Garrett Dilmore, [email protected]. Appointment of Athena’s EU and UK representatives under Article 27 is in progress; until complete, Customer and any Supervisory Authority may contact the Data Protection Officer directly.
Annex 1 — Description of Processing
| Item | Detail |
|---|---|
| Subject matter | Weapons detection screening at Customer entrances and documentation of security incidents; visitor management where Entrance Pass is ordered |
| Duration | Term of the Agreement plus the deletion period in clause 9 |
| Nature and purpose | On-device automated detection of objects; generation of alerts; creation by Customer staff of incident records; visitor check-in where ordered; audit logging; support |
| Categories of Data Subjects | Persons passing through Customer’s screening points: employees, patients, visitors, students, members of the public, as applicable to the Customer’s site |
| Categories of Personal Data | Alert images of a person and object (where Customer enables image capture); incident-record fields defined by Customer, typically name and description of incident; visitor check-in records where Entrance Pass is ordered (name, contact details, identification details, person visited); audit log entries for Customer users |
| Special categories (Article 9) | None by default. Health data may be present in visitor records where a healthcare Customer configures such fields. Biometric data only if Customer enables an optional identification feature under clause 12 |
| Article 10 data | Incident records may describe an alleged offence; Customer controls whether such fields exist |
| Products | Apollo 500; AI X-ray A Series and C Series; Athena Compliance Platform; Athena Weapons Detection System Alert App; Entrance Pass (where ordered) |
Annex 2 — Technical and organisational measures (summary; full detail in the DPIA Support Document)
- Hosting: Linode (Akamai) Frankfurt, Amsterdam and London for platform, databases, logs, reports and backups; AWS EU regions for encrypted alert images; data egress from the EU and UK blocked; US IP ranges blocked from EU and UK systems
- Detection: AI analysis runs on the screening device at Customer’s site; only the resulting alert is transmitted
- Encryption: TLS 1.3 in transit, AES-256 at rest, device-side encryption of alert images with device-held keys that Athena cannot access
- Access control: two-factor authentication for all Personal Data access; role-based access for Customer users; Athena access only under an open Customer support ticket
- Logging: all access and changes logged; logs visible to Customer
- No remote control; remote view only with in-product Customer approval and on-screen indicator
- Data minimisation: image capture and storage optional; all incident fields Customer-defined
- Retention: Customer-configured per record type; deletion by support ticket with audit trail; backups purged within 30 days
- Notifications: alert links only, no images or Personal Data in message content; links expire after a Customer-set period
- Assurance: SOC 2 Type II; annual third-party penetration test; weekly vulnerability scanning; staff training on hire and annually
- Incident response: documented plan; 72-hour Customer notification; public status page at status.athena-security.com
Annex 3 — Subprocessors
Athena’s subprocessors, with the purpose, location and transfer mechanism of each, are published at https://www.athena-security.com/compliance/subprocessors/ and are incorporated into this DPA by reference. As at the date of signature the list comprises: Linode, an Akamai company, for hosting of the platform, databases, logs, reports and backups in Frankfurt, Amsterdam and London; Amazon Web Services for storage of encrypted alert images in EU regions; Cloudflare, Inc. for DNS, content delivery and web application security; Mailgun Technologies, Inc. for transactional email; Twilio Inc. for SMS; Apple Inc. and Google LLC for push delivery of alert links containing no Personal Data; and Google LLC (Google Workspace) for business email and support correspondence. Changes are notified under clause 5.
Annex 4 — Transfer safeguards
For any transfer of Customer Data to the United States under clause 4 or Annex 3, the SCCs (Module Two) and, for UK Customers, the UK Addendum are incorporated into this DPA by reference, with Customer as data exporter and Athena as data importer, and are completed as follows: Clause 7 (docking) applies; Clause 9(a) Option 2 (general authorisation) with the 30-day notice in clause 5; Clause 11 optional language does not apply; Clause 13 and Clause 17 governing law and Clause 18 forum are the Member State of Customer’s establishment (or England and Wales under the UK Addendum); Annex I is Annex 1 above; Annex II is Annex 2 above; Annex III is Annex 3 above. Athena’s transfer impact assessment is available on request from [email protected].
Signed for Customer: ____________________ Name: ____________________ Title: ____________________ Date: ______
Signed for Athena Security, Inc.: ____________________ Name: ____________________ Title: ____________________ Date: ______