For customers using Ghost to process personal data of EU, UK, or Swiss data subjects — including any Ghost for Business customer enrolling employees, contractors, or family members — we offer a signed Data Processing Agreement. The DPA incorporates the European Commission's 2021 Standard Contractual Clauses and the UK International Data Transfer Addendum where required. It is designed to satisfy Article 28 of the GDPR, Article 28 of the UK GDPR, and the equivalent provisions of the Swiss FADP.
How to request a signed DPA
Email legal@useghost.me with your full legal entity name, the contracting jurisdiction, the name and title of the signatory, and any clauses you would like to negotiate (most customers do not need to). We countersign within one business day of receipt. If you have your own DPA template you would prefer to use, send it and our Legal team will redline within five business days; in practice we accept customer paper for most mid-market and enterprise deals.
What the DPA covers
- Roles and responsibilities of the controller (you) and the processor (Ghost), including a clear statement that we act only on your documented instructions.
- Categories of personal data processed, the types of data subject, the purposes of processing, and the duration — mapped to the actual Ghost use cases (monitoring, removal, dark-web alerting, support).
- Sub-processor governance — our current list, our commitment to maintain equivalent obligations downstream, our notification cadence for changes (30 days in advance for material additions), and your right to object.
- Security obligations — the technical and organisational measures Ghost maintains, including encryption, access control, logging, incident response, secure development, and personnel screening. The detail is in our practices page; the contractual commitment is in Annex II of the DPA.
- International data transfers — Standard Contractual Clauses (EU 2021/914), UK IDTA Addendum, Swiss adaptations, plus the supplementary measures (encryption in transit and at rest, pseudonymisation where possible, transparency reporting on government requests) that demonstrate continued compliance after Schrems II.
- Audit rights — your right to audit our processing, satisfied in the first instance by our SOC 2 Type II report, ISO 27001 certification, and our latest penetration-test executive summary, with the right to on-site audit on reasonable notice for material concerns.
- Breach notification — Ghost notifies you of any personal-data breach affecting your data without undue delay and within 48 hours of becoming aware, with the content and form required to support your own regulator notifications.
- Return and deletion of personal data on termination, with documented timelines for active data (30 days) and backups (within the next backup cycle, never more than 90 days).
- Data-subject rights cooperation — Ghost assists you in responding to data-subject access, correction, deletion, portability, restriction, and objection requests within the statutory timelines.
- Liability and indemnity aligned with your master agreement, with carve-outs for breaches of the security and confidentiality obligations.
Standard sub-processors
Ghost relies on a small number of vetted sub-processors to deliver the service. The current list, the categories of personal data each one processes, and the country of processing are maintained in Annex III of the DPA and on our trust centre. We notify customers at least 30 days before adding a new sub-processor that processes identified personal data, and you may object in writing within that window.
Schrems II and ongoing transfer assessments
Where personal data of EU, UK, or Swiss data subjects is transferred outside the EEA/UK/Switzerland, Ghost performs and documents a Transfer Impact Assessment for each receiving country, considers the legal protections available to data subjects there, and applies supplementary technical, organisational, and contractual measures. Transfer Impact Assessments are refreshed annually and on any material change in the legal landscape.
Questions
For commercial questions, write to legal@useghost.me. For technical security questions (encryption configuration, sub-processor scope, residency), copy our security team at security@useghost.me. Our Data Protection Officer is reachable at dpo@useghost.me.