Data Processing Addendum

Version 2026-11-09 · Processor: [Company name]

This Data Processing Addendum ("DPA") forms part of the Terms of Service between [Company name] ("Processor", "we") and the customer ("Controller", "you"). It applies where we process personal data on your behalf in providing the Service and the GDPR or equivalent laws apply. Terms used here have the meaning given in Regulation (EU) 2016/679 (GDPR).

1. Subject matter, duration, nature and purpose

We process personal data to provide the Service to you: to run the monitors you configure, store results, deliver alerts, publish status pages and provide support. Processing lasts as long as your account exists and for the deletion period in section 9.

2. Types of data and data subjects

• Data subjects: your team members and invited users; people whose contact details you enter to receive alerts or to subscribe to your status page; individuals whose personal data appears in the content of monitored responses or error messages recorded by checks (we do not seek this data and you should not configure monitors that expose personal data).
• Types of data: names, email addresses, phone numbers, messaging identifiers and webhook addresses, account identifiers, IP addresses and technical metadata, and any personal data contained in monitor names, addresses and recorded error messages.
• Special categories: the Service is not designed to process special categories of data and you must not use it for that purpose.

3. Your instructions

We process personal data only on your documented instructions, which are these Terms, this DPA, your configuration of the Service, and your other written instructions consistent with them, unless the law requires otherwise (in which case we tell you beforehand where the law allows). We will tell you if we believe an instruction infringes data protection law.

4. Confidentiality

People authorized to process the data are bound by confidentiality. This includes the automated and AI systems we use: they receive only the data needed for the task, and under contracts that restrict use of the data and prohibit training on it.

5. Security

We apply the technical and organizational measures in the Annex, appropriate to the risk, and we keep them under review.

6. Sub-processors

6.1 You give us a general authorization to engage sub-processors. The current list is on the sub-processors page.

6.2 We bind sub-processors to obligations no less protective than this DPA and remain responsible for their performance.

6.3 We will tell you at least 30 days before adding or replacing a sub-processor (by email or on the sub-processors page). You may object on reasonable data protection grounds within that period. If we cannot accommodate the objection, you may terminate the affected Service and receive no further charges for the period after termination.

7. Assistance

Taking into account the nature of processing, we will assist you, by appropriate measures, in responding to requests from data subjects, and in meeting your obligations on security, breach notification, impact assessments and prior consultation, to the extent the assistance relates to the Service. We may charge reasonable costs for assistance that goes beyond what the Service's features allow.

8. Personal data breaches

We will notify you without undue delay, and where feasible within 48 hours, after becoming aware of a personal data breach affecting your data, with the information we have to help you meet your obligations. Notification is not an acknowledgement of fault.

9. Deletion and return

After the end of the Service we delete your personal data within 30 days, except where the law requires us to keep it, and subject to the backup cycle (backups are overwritten within 30 days). During the 30 days after termination you can export your data using the Service's features.

10. Audits

We will make available the information needed to demonstrate compliance with this DPA. You may carry out an audit once per year, by written request with reasonable notice, remotely or by reviewing documents, during business hours and under confidentiality, at your own cost, and without access to other customers' data. Where we hold a recent independent report or certification covering the relevant controls, you agree to rely on it first.

11. International transfers

We may transfer personal data outside the EEA only in compliance with Chapter V of the GDPR. Where the transfer is to a country without an adequacy decision, the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) apply: Module Two (controller to processor) between you and us where we are established outside the EEA or the transfer is from you to us, and Module Three (processor to processor) between us and our sub-processors. They are incorporated by reference, with the details in this DPA and its Annex.

12. Liability and precedence

Each party's liability under this DPA is subject to the limitations in section 8 of the Terms, to the extent the law allows. If there is a conflict between this DPA and the Terms on the processing of personal data, this DPA prevails.

13. Roles

For account, billing and security data about you and your users we act as an independent controller, as described in the Privacy Policy. This DPA covers only the processing we carry out as your processor.

Annex: technical and organizational measures

• Access control: unique accounts, hashed passwords, email verification, optional Google sign-in, role-based access within teams; administrative access limited to what staff need.
• Network and application security: TLS for all connections, protection against requests to private or internal addresses from monitoring checks, rate limiting, input validation, secure session cookies.
• Data protection: encrypted backups with keys kept separately from the data; password hashes only; retention limits (monitoring results 90 days, logs 30 days).
• Resilience: backups and restoration procedures that are tested; an external heartbeat that alerts us if the Service stops running.
• Logging and monitoring: request and security logs without request content; alerts on failures.
• Organization: confidentiality commitments; documented procedures for incidents and for requests from data subjects; vetting of providers; human review of significant decisions; limits on the personal data made available to automated and AI systems, which have no access to production credentials or to customer data except through narrow, logged interfaces.
• Deletion: automated deletion of old monitoring data; deletion of accounts on request or at the end of the Service.