1. Parties and scope
This agreement is between the Customer that uses Baitwise (the "controller") and Odeta Kurti, Tirana, Albania, operating Baitwise (the "processor"). It applies to all personal data the processor processes on the controller's behalf when providing the service, and meets the requirements of Article 26 of Law No. 124/2024 and Article 28 of the GDPR.
It forms part of the terms of service and is accepted with them. If your organisation needs a countersigned copy, email privacy@baitwise.al.
2. Details of the processing
- Subject matter and purpose: providing security-awareness training, quizzes and simulated phishing messages, and reporting results to the controller's administrators.
- Duration: for as long as the controller uses the service, plus the deletion period in section 9.
- Data subjects: the controller's employees and other people it invites to its workspace.
- Categories of data: name and work email; role, department and job title; training assignments, quiz answers and scores; responses to simulations and response times; for simulations sent to real inboxes, delivery times and, when a link is opened, the time, IP address and browser of the device; sign-in session data (IP address and browser).
- Special categories: none are needed. The controller must not enter special categories of data (such as health data) into the service.
3. Processing on instructions
The processor processes personal data only on the controller's documented instructions: these terms, the controller's configuration of the service, and other written instructions. If the processor believes an instruction breaks data protection law, it will tell the controller. The processor will not use the data for its own purposes.
4. Confidentiality
Anyone the processor authorises to process the data is bound by an obligation of confidentiality, as required by Article 30 of Law 124/2024.
5. Security
The processor maintains appropriate technical and organisational measures to protect the data, including those listed in the annex below, and reviews them as the service and risks change.
6. Subprocessors
The controller gives general authorisation for the processor to use subprocessors. The current list is published on our subprocessors page. The processor will notify the controller by email at least 30 days before adding or replacing a subprocessor. The controller may object on reasonable data protection grounds; if the parties can't resolve the objection, the controller may terminate the service.
The processor imposes the same data protection obligations on each subprocessor by written contract and remains responsible to the controller for their performance.
7. International transfers
Customer data is hosted in the European Union (Nuremberg, Germany). The processor transfers personal data outside Albania and the European Economic Area only with the safeguards required by Articles 40 and 41 of Law 124/2024 and Chapter V of the GDPR.
Where the controller is subject to the GDPR, the parties agree that, to the extent required for transfers to the processor, the EU standard contractual clauses (Commission Implementing Decision (EU) 2021/914), Module Two (controller to processor), are incorporated by reference, with the details in section 2 and the annex completing their annexes. Clause 7 (docking) applies, Option 2 (general authorisation, with the notice period in section 6) applies under Clause 9, the optional wording in Clause 11 does not apply, and for Clauses 17 and 18 the law and courts of the EU member state where the controller is established apply.
8. Assistance to the controller
- Data subject requests: the processor will pass on any request it receives from a data subject and help the controller answer requests to access, correct, delete or export data.
- Personal data breaches: the processor will notify the controller without undue delay, and in any case within 48 hours of becoming aware of a breach affecting the controller's data, with the information the controller needs to meet its own notification obligations.
- Impact assessments: the processor will give reasonable help with data protection impact assessments and any prior consultation with the supervisory authority.
9. Deletion and return of data
The controller can export its results at any time. When the service ends, the processor deletes the controller's data within 30 days, unless the law requires it to be kept. Deleted data is removed from backups as they rotate, within 14 days.
10. Information and audits
The processor will make available the information needed to demonstrate compliance with this agreement, and will allow and contribute to audits by the controller or an auditor it appoints, on reasonable notice, no more than once a year unless a breach has occurred, and at the controller's cost. Written answers and documentation will be used first where they are sufficient.
11. Order of precedence and liability
If this agreement conflicts with the terms of service on data protection, this agreement prevails; where standard contractual clauses apply, they prevail over both. Liability under this agreement is governed by the terms of service, except where the law does not allow it to be limited.
Annex: technical and organisational measures
- Hosting in a Hetzner data centre in Nuremberg, Germany, certified to ISO/IEC 27001.
- Encryption in transit (HTTPS/TLS) for all access to the service.
- Passwords stored only as salted hashes.
- Strict separation of each customer's data, with access checked on the server for every page, action and data request.
- Role-based access: employees never see colleagues' results, and administrators see only their own company.
- Rate limits on sign-in, registration, invitations and AI generation, per IP address, account and company.
- Real simulation emails only go to email domains the customer has verified with a DNS record.
- Nightly database backups kept for 14 days.
- Access to production systems limited to the operator.
- No employee personal data is sent to the AI provider.