Data Processing Agreement

1. Parties, scope and effect

1.1 This Data Processing Agreement ("DPA") forms part of the terms of service of each product listed in 1.3. It becomes binding when the customer accepts those terms. It applies from the first processing of personal data on the customer's behalf, on any plan (paid, free or trial), until the Processor has deleted that data under section 9. It implements Article 28(3) of Regulation (EU) 2016/679 (the "GDPR").

1.2 Processor:

UptimeVanguard, eenmanszaak (sole proprietorship)
De Ambacht 4, 4681 CV Nieuw-Vossemeer
The Netherlands
Chamber of Commerce (KvK) no.: 42017143, branch no. 000065206312
VAT ID: NL005434561B13
[email protected]

Controller: the organization named in the customer's account when the terms are accepted. The person who accepts confirms that they may bind that organization. Notices under this DPA go to the privacy contact set in the account, or, if none is set, to the account email address.

1.3 This DPA covers the UptimeVanguard products below. The general terms in sections 1 to 11 apply to each of them. Each product has a product annex that describes the processing, the security measures and the sub-processors for that product:

• Product annex: UptimeVanguard (SaaS)
• Product annex: UptimeVanguard Enterprise (only when the customer gives the Processor support access)

1.4 This DPA applies to a customer that uses a product for its business. It does not apply to a consumer who uses a product only for personal or household purposes.

1.5 "Entrusted data" means the personal data that the Processor processes on the Controller's behalf when it provides the product. Data that the Processor processes as a controller for its own customer relationship (account holder, billing, platform security) is described in the Privacy Policy and is not entrusted data.

2. Instructions, purpose and duration

2.1 The Processor processes entrusted data only on documented instructions from the Controller, including for transfers to third countries, unless Union or Member State law to which the Processor is subject requires otherwise. In that case the Processor informs the Controller of that requirement before the processing, unless that law prohibits this on important grounds of public interest.

2.2 The Controller's documented instructions are this DPA, the product's terms, the configuration the Controller sets in the product, and written instructions sent to [email protected].

2.3 If the Processor considers that an instruction infringes the GDPR or other Union or Member State data protection law, it informs the Controller immediately. It may suspend that instruction until the Controller confirms or changes it.

2.4 The Processor does not process entrusted data for its own purposes. It does not use entrusted data to train models or for advertising. It only uses anonymous totals that identify no person and no customer, such as the number of checks run or the load of a server, to operate and plan its products. It never analyzes or uses the data of an individual customer for its own purposes.

2.5 Processing lasts for as long as the Controller has an active plan (paid, free or trial) for the product, plus the deletion period in section 9.

2.6 The Controller is responsible for the lawfulness of the processing it instructs, and for informing the people whose data it enters, such as alert recipients and status page subscribers. The Controller does not configure the product to process special categories of personal data (Article 9 GDPR) or data about criminal convictions (Article 10 GDPR). Where a check needs credentials, the Controller uses credentials made for monitoring only, with the least privilege the check needs.

3. Confidentiality and security

3.1 Only the Processor's owner has access to entrusted data and to the production systems. Tools and automation that process entrusted data run under the owner's control. The owner is bound to confidentiality by this DPA. If the Processor ever gives another person access, that person is first bound by a written duty of confidentiality that continues after the engagement ends, and gets access only as far as the role requires.

3.2 The Processor implements and maintains at least the technical and organizational measures in the product annex for as long as it processes entrusted data, including in backups. It evaluates them at least once a year. It changes them only if the overall level of protection does not decrease.

4. Sub-processors

4.1 The Controller gives general written authorization (Article 28(2) GDPR) for the sub-processors in the product annex.

4.2 The Processor informs the Controller at least 30 days before it adds or replaces a sub-processor, by email to the Controller's privacy contact (or the account email address) and by an update of the product annex. The notice names the legal entity, the purpose, the data, the countries of processing and the transfer mechanism.

4.3 The Controller may object by email to [email protected] within those 30 days. If the objection cannot be resolved, the Controller may end its plan for the affected product before the change takes effect. Fees already paid are not refunded.

4.4 The Processor imposes on each sub-processor, by written contract, the same data protection obligations as in this DPA. The Processor remains fully responsible to the Controller for each sub-processor's performance.

4.5 Services that the Controller connects itself, such as its own Slack, Microsoft Teams, Discord, Telegram, Google Chat, PagerDuty or ntfy workspace, its own webhook endpoint, or its own SMS provider account, are the Controller's recipients and not sub-processors. The Processor sends them only the content the Controller configures. The Controller is responsible for any transfer to them.

5. International transfers

5.1 The Processor stores entrusted data in the European Economic Area (EEA). It transfers entrusted data outside the EEA only to the sub-processors and locations in the product annex, and to recipients the Controller connects itself. The Controller instructs these transfers when it accepts this DPA and when it configures the product (for example the monitoring regions and notification channels).

5.2 Before a transfer to a sub-processor outside the EEA, the Processor ensures one of the following: an adequacy decision of the European Commission that covers the destination; for the United States, the importer's certification under the EU-US Data Privacy Framework; or the standard contractual clauses of Commission Implementing Decision (EU) 2021/914 in the sub-processor's data processing terms. The product annex states the mechanism per sub-processor.

5.3 If a safeguard stops being valid, the Processor informs the Controller without undue delay and suspends the affected transfer until a lawful alternative is in place.

6. Assistance

6.1 Taking into account the nature of the processing, the Processor assists the Controller, as far as possible, to respond to requests under Chapter III GDPR: access, rectification, erasure, restriction, portability and objection. It forwards each request it receives about entrusted data to the Controller within 5 business days. It does not answer the data subject unless the Controller instructs it or the law requires it.

6.2 Taking into account the information available to it, the Processor also assists the Controller with Articles 32 to 36 GDPR: security, breach notification, data protection impact assessments and prior consultation. It gives this assistance in time to meet the statutory deadlines and does not charge for it.

7. Personal data breaches

The Processor notifies the Controller without undue delay, and at most 48 hours after it becomes aware of a personal data breach that affects entrusted data. It does not delay the first notice to complete an investigation. The notice states, as far as known, the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences, the measures taken or proposed, and a contact point. Further facts follow as they become known. The Processor documents each breach and assists the Controller with notices to the supervisory authority and to data subjects (Articles 33 and 34 GDPR). It does not notify them on the Controller's behalf unless the Controller instructs it in writing or the law requires it. A notice is not an admission of liability.

8. Information and audits

8.1 The Processor makes available all information necessary to demonstrate compliance with Article 28 GDPR. This is this DPA with its product annex, and written answers to the Controller's questions. The Processor answers a reasonable written questionnaire within 30 days.

8.2 The Controller verifies compliance through this documentation and these written answers. There are no on-site audits or inspections at the Processor's premises or systems. This does not limit an audit or inspection that a supervisory authority orders under its powers.

9. Return and deletion

9.1 While the Controller has an active plan, it can export its data with the export functions the product offers, as described in the product annex.

9.2 When the Controller no longer has an active plan (paid, free or trial) for a product, the Processor deletes the entrusted data of that product from its production systems after the retention period stated in the product's terms, unless the law requires it to keep the data longer (section 9.3). While the Controller has an active plan, including a free plan, the Processor keeps that data. When the Controller deletes its account, the Processor deletes its entrusted data from production within 30 days. When the Controller deletes a single item in the product, such as a monitor, the Processor deletes its data from production within 30 days. Backups that contain entrusted data age out within a further 30 days. Until then, backups remain subject to this DPA and are used only to recover from a disaster. After a restore, the Processor applies the deletions again before normal processing resumes.

9.3 The Processor keeps entrusted data longer only where Union or Member State law requires it. It then informs the Controller, unless that law prohibits this, and processes the data only for that purpose. Invoices and other accounting records that the Processor holds as a controller are not entrusted data.

9.4 On written request, the Processor confirms the deletion in writing.

10. Liability, law and precedence

10.1 To the extent permitted by law, the Processor is not liable to the Controller for damage under this DPA or the product's terms for UptimeVanguard and UptimeVanguard Enterprise. This exclusion does not apply to damage caused by the Processor's intent or gross negligence (opzet of bewuste roekeloosheid), and it does not limit a data subject's claim under Article 82 GDPR.

10.2 This DPA is governed by Dutch law. Disputes go to the competent court in the Netherlands.

10.3 For entrusted data, this DPA prevails over the product's terms. Where standard contractual clauses apply, they prevail over both. Confidentiality, assistance and deletion obligations continue for as long as the Processor holds entrusted data.

11. Changes

The Processor announces a new version of this DPA at least 30 days before it takes effect, by email or an in-app notice. Each version has its own version number. The product records which version the customer accepted and when. After a change, the customer is asked at sign-in to accept the new version, and that acceptance is recorded too.

Product annex: UptimeVanguard (SaaS)

This annex covers the hosted service at app.uptimevanguard.com.

A. Processing

• Nature and purpose: checking the availability and performance of the targets the Controller configures, detecting and confirming outages, sending alerts, publishing status pages, and support.
• Frequency: continuous, at the check intervals the Controller configures.
• Data: monitored URLs and host names; configured request headers, request bodies and check credentials; check results (status, timings, status codes, error messages, DNS records, certificate data and selected response headers such as Server and Location); incidents; alert recipients (email addresses, phone numbers for SMS, chat and webhook destinations); status page content and subscriber email addresses; team member names, email addresses and roles; support messages.
• Data subjects: the Controller's staff and team members, alert recipients, status page subscribers, and people whose data appears in monitored targets or check results.
• Retention: check results 90 days; notification history 30 days; configuration, recipients and status pages for as long as the team has an active plan: a paid plan, the trial or the Free plan. A team on the Free plan keeps its data. Section 9 applies when the team no longer has an active plan.
• Export: SLA reports and incidents as CSV in the application, and sites, checks, check history, incidents and reports through the REST API. A complete export of other data is provided on request within 14 days.

B. Technical and organizational measures

• Organization: the Processor is a sole proprietorship. Only the owner has access to production systems and entrusted data (section 3.1). There are no contractors with access.
• Hosting: application, databases and backups at Hetzner Online GmbH in Falkenstein, Germany. Physical security is provided by Hetzner.
• Network: HTTPS for browser, API and polling node traffic. The administration area is reachable only over a private VPN. The databases do not accept connections from the internet.
• Accounts: passwords hashed with bcrypt (cost 12); optional two-factor authentication (TOTP) with recovery codes stored as hashes; team roles; rate limiting and bot protection on sign-in and signup; CSRF protection; every query scoped to the customer's team.
• Encryption at rest: check settings (including credentials) and notification channel settings are encrypted with AES-256; the key is kept in the production cluster, not in the database. Backups are encrypted with AES-256. The database disks themselves are not encrypted.
• Polling nodes: each node authenticates with its own key, of which the Processor stores only a hash. A node receives the settings of the checks assigned to it and keeps them in memory only. It writes only check results to disk, in a local delivery queue of at most 256 MB. Its logs contain no targets, request headers, request bodies, credentials or response bodies. The nodes have no swap.
• Outbound protection: targets in private, loopback, link-local and similar address ranges are refused when a check is saved, and again on every request and every redirect.
• Region scoping: a check's settings, including credentials, go only to the nodes that run it: the primary region, a second region that confirms an outage (unless the team turns this off), or all regions when the Controller selects multi-region monitoring. When a monitor is created, only its URL (no headers, body or credentials) goes once to one node per region to measure which region is nearest.
• Backups: the main database daily, encrypted, kept 30 days on equipment that the owner owns and operates in the Netherlands; check results daily (weekly full, daily incremental), encrypted, kept 14 days at Hetzner in Germany. Restores are tested.
• Logs: application request logs are kept 365 days, with the client IP address removed after 30 days; audit logs 365 days; security events 90 days.
• Changes: code changes pass review and an automated test suite before deployment.
• Deletion: deleted monitors, accounts and teams are removed from the databases, including the analytics database, by background jobs; when a team no longer has an active plan (its trial or subscription ended and it does not hold the Free plan), its monitors, their history, its alert channels and its status pages are deleted 30 days later, as section 4 of the terms states, with a notice to the account owner 7 days before. A team on the Free plan keeps its data.
• Certification: the Processor holds no security certification. It has not appointed a data protection officer; Article 37 GDPR does not require one.

C. Sub-processors

Mollie B.V. processes payment data as an independent controller for the Processor's own billing and is not a sub-processor. The owner's own backup equipment in the Netherlands is not a third party. The current polling node addresses are published at uptimevanguard.com/bot; that list is not the sub-processor list.

Product annex: UptimeVanguard Enterprise

UptimeVanguard Enterprise runs on the Controller's own infrastructure. The Processor does not host it and has no access to it. This annex applies only when the Controller gives the Processor support access, for example a remote session or a copy of logs or a database sent for support.

• Processing: diagnosing and fixing the problem the Controller reports, for as long as the support case is open. The data is whatever the Controller makes accessible, typically monitoring configuration, results and user accounts of its installation.
• Measures: only the owner handles support cases (section 3.1). The Processor uses the access only for the reported case, keeps no copy longer than the case needs, and deletes copies within 30 days after the case is closed. Material the Controller sends is kept on the Processor's systems at Hetzner in Germany; the measures of the SaaS annex B apply to them.
• Sub-processors: Hetzner Online GmbH (Germany) for the support systems, and Cloudflare, Inc. (United States) for delivery of support email, as in the SaaS annex C.

Contact

For questions about this DPA or a privacy request, contact [email protected].