Netgraph Data Processing & Privacy Annex

Version: 8.0 (Revised Structure)
Applies to: Netgraph Connectivity Platform (All modules)

Effective Date: 2026-03-23

1. ANNEX I – DESCRIPTION OF PROCESSING

A. List of Parties

Data Exporter (Controller)

The Customer (as defined in the Agreement), acting as Data Controller.

Data Importer (Processor)

Netgraph Sverige AB
Org. No: 559033-1141
Biblioteksgatan 6A
831 30 Östersund
Sweden

Email: dpo@netgraph.se

Role: Data Processor

B. Description of Processing

1. Categories of Data Subjects

• Customer administrators
• End users (guests, employees, residents, visitors)
• Device users
• Self-service portal users

2. Categories of Personal Data

Administrator Data

• Name
• Email address
• Username
• Authentication credentials (password or SSO identity)

End User Data

• Name (optional)
• Email address (optional)
• Phone number (optional)
• Company / organization (optional)

Device & Network Data

• MAC address
• IP address
• Device identifiers
• Authentication method
• VLAN / network assignment
• Session metadata (timestamps, activity logs)

Security & Access Data

• Authentication logs
• Audit logs
• Policy assignments
• Access control attributes

3. Special Categories of Data

The service is not intended to process special categories of personal data under Article 9 GDPR.
Any such processing remains the sole responsibility of the Customer.

4. Nature of Processing

• Collection
• Registration
• Organization
• Storage
• Retrieval
• Use
• Disclosure (to authorized systems only)
• Erasure

5. Purpose of Processing

• Provide secure network access (WiFi / NAC)
• Authenticate users and devices
• Enforce access control policies
• Enable onboarding (guest, BYOD, IoT)
• Maintain audit logs and traceability
• Provide support and troubleshooting

6. Duration of Processing

Processing takes place:

• During the duration of the Agreement
• With retention periods configurable by the Customer

Default values:

• End-user/device data: approx. 1 month
• Administrator data: contract duration + 6 months

7. Processing Context (Services)

Processing is performed within:

• Sign In (Captive Portal & onboarding)
• EntryPoint (RADIUSaaS)
• EasyPSK (Private WiFi segmentation)
• Endpoint Manager (Cisco ISE integration)

C. Competent Supervisory Authority

The competent supervisory authority shall be:

• The authority where the Data Exporter is established

For Sweden:
Integritetsskyddsmyndigheten (IMY)

2. ANNEX II – TECHNICAL & ORGANIZATIONAL MEASURES

2.1 Access Control

• Role-Based Access Control (RBAC)
• Tenant-level logical isolation
• Least privilege principles
• Secure authentication (password or SSO)
• Administrative access restricted and logged

2.2 Encryption

• Data at rest: AES-256
• Data in transit: TLS 1.2 or higher

Applies to all personal data processed within the platform.

2.3 Data Separation (Multi-Tenancy)

• Logical isolation between tenants
• No cross-tenant access possible
• Policy-based segmentation and enforcement

2.4 Logging & Monitoring

• Centralized audit logging of:

  • Administrative actions

  • Authentication events

  • Policy changes

• Full traceability across all modules

2.5 Availability & Resilience

• Deployment across multiple Availability Zones
• Load balancing and automatic failover
• Microservices-based architecture
• Horizontal scalability

2.6 Incident Management

• Dedicated Data Protection & Privacy function
• Documented incident response procedures
• Incident Commander role
• Notification to customers in accordance with DPA and GDPR

2.7 Data Minimization & Purpose Limitation

• Only data necessary for service delivery is processed
• Optional data fields configurable by the Customer
• No processing for marketing or unrelated analytics

2.8 Security Governance & Integrations

• Secure API integrations (Cisco, Auth0, Microsoft, etc.)
• Controlled access to integrations
• Continuous monitoring and system hardening

3. APPENDIX A – DETAILED PROCESSING (Module Tables)

A.1 Module Overview

Module	Data Categories	Purpose
Sign In	End-user identifiers, device data	Authentication, onboarding
EntryPoint	Device identifiers, RADIUS attributes	Network access control
EasyPSK	User + device data	Private WiFi segmentation
Endpoint Manager	Device + policy data	IoT & Cisco ISE integration

A.2 Sign In – Authentication Methods & Data

Method	Personal Data Collected	Optional Fields	Purpose
Meeting Host	Host email, end user name, company, MAC, IP, stats	–	Identify host, authenticate guest
Conference	Email, phone, name, company, MAC, IP	Email, phone	Guest authentication
Self-provision (email)	Email, MAC, IP	–	Email validation
Self-provision (SMS)	Phone, MAC, IP	–	SMS validation
SAML Federation	Username, MAC, IP	–	Federation login
Password	MAC, IP	–	Local authentication
Click-to-connect	MAC, IP	–	Open access tracking
Event Access	MAC, IP	–	Temporary access
Whitelisting	MAC, IP	–	Allow-list
Username & Password	Username, MAC, IP	–	Credential-based authentication

A.3 EntryPoint (RADIUSaaS)

Scenario	Personal Data	Purpose
802.1X (EAP-TLS / PEAP)	MAC, username, IP	Secure authentication
MAB	MAC, IP	IoT onboarding
Static credentials	Username, MAC, IP	Manual authentication

A.4 EasyPSK

Action	Personal Data	Purpose
PSK Assignment	Email, MAC, PSK name, WPA2 key	Personal network provisioning
Device onboarding	MAC, IP	Device mapping
Key rotation	WPA2 key	Security maintenance

A.5 Endpoint Manager (for Cisco ISE)

Function	Personal Data	Purpose
Device registration	MAC, email	IoT onboarding
Policy assignment	Device profile, attributes	Access control

4. APPENDIX B – SUB-PROCESSORS

B.1 Sub-Processor Overview

Sub-Processor	Legal Entity	Registration No.	Address	Purpose	Data Type	Location
Amazon Web Services EMEA SARL	AWS	B186284	38 Avenue John F. Kennedy, L-1855 Luxembourg	Cloud hosting & infrastructure	Platform data	Sweden / Germany
Amazon Web Services EMEA SARL (SES)	AWS SES	B186284	Luxembourg (EU infrastructure)	Email delivery services	Email addresses	Ireland
ELASTX AB	Elastx	556906-5617	Kungsgatan 12, 111 35 Stockholm, Sweden	Cloud hosting (Swedish option)	Platform data	Sweden

B.2 Safeguards

• Data Processing Agreements are in place with all sub-processors
• Standard Contractual Clauses (SCCs) are implemented where applicable
• Data is hosted within the EU by default
• Sub-processors are contractually bound to equivalent security standards
• Regular vendor assessments and security reviews are performed

B.3 Sub-Processor Transparency

A current list of sub-processors is maintained and made available to Customers upon request or via Netgraph documentation.

5. DATA SUBJECT RIGHTS

• Data subjects exercise their rights via the Customer (Controller)
• Netgraph provides assistance upon documented request

Supported rights include:

• Access
• Rectification
• Erasure
• Restriction of processing
• Data portability

6. CUSTOMER RESPONSIBILITIES

The Customer is responsible for:

• Establishing lawful basis for processing
• Informing end users of applicable privacy policies
• Configuring retention policies
• Managing optional personal data fields
• Handling data subject requests