Data processing agreement

This agreement is between the customer who uses Uplance for business purposes ("controller") and Marius Erik Kinzler, c/o Online-Impressum 11507, Europaring 90, 53757 Sankt Augustin, Germany ("processor"). It forms part of the terms of service and applies whenever the processor processes personal data on the controller's behalf while providing Uplance.

1Subject matter and duration#

The processor provides the monitoring, alerting and status page service Uplance as described in the terms of service. This agreement applies for as long as the processor processes personal data for the controller, and ends with the contract, subject to section 7.

2Nature and purpose, types of data, data subjects#

Nature and purpose: storing and processing data that the controller enters into Uplance or that arises from using it, in order to run checks against the controller's systems, keep their results, send alerts and status updates, publish status pages and provide the dashboard and API.

Types of personal data: names, email addresses, roles and sign-in data of team members; email addresses, chat IDs and webhook addresses of alert recipients and status page subscribers; content of incidents, post-mortems, maintenance notices and status pages; personal data contained in monitored addresses, request headers, credentials or responses of the controller's systems; IP addresses, hashed IP addresses and user agents in security logs and problem reports.

Data subjects: the controller's employees and team members, recipients of alerts and status updates, visitors of the controller's status pages, and people whose data is contained in the controller's monitored systems.

3Controller's responsibilities and instructions#

The controller is responsible for the lawfulness of the processing, in particular for being entitled to monitor the systems it adds and to send alerts to the recipients it enters. The controller gives its instructions through this agreement, the settings of the service and, where needed, in text form. The processor informs the controller without delay if it believes an instruction infringes data protection law, and may suspend carrying it out until it is confirmed or changed.

4Processor's obligations#

The processor – processes personal data only on documented instructions of the controller, including with regard to transfers to third countries, unless it is required to do so by Union or Member State law; in that case it informs the controller before processing, unless that law prohibits it; – ensures that everyone authorised to process the data has committed to confidentiality or is under an appropriate statutory obligation of confidentiality; – takes the technical and organisational measures in Annex 1 and keeps them appropriate to the state of the art; it may change them as long as the level of protection isn't reduced; – assists the controller, taking into account the nature of the processing, with appropriate measures in responding to requests from data subjects and in meeting the obligations under Art. 32 to 36 GDPR; – notifies the controller without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting the controller's data, with the information available at that time; – makes available to the controller all information necessary to demonstrate compliance with Art. 28 GDPR and allows for and contributes to audits under section 8.

5Sub-processors#

The controller gives general authorisation for the processor to engage sub-processors. The sub-processors at the time this agreement is concluded are listed in Annex 2.

The processor informs the controller at least 30 days in advance of any intended addition or replacement of sub-processors, by email or in the service. The controller may object for good reason within that period. If the parties can't resolve the objection, the controller may terminate the affected service with effect from the date of the change.

The processor imposes the same data protection obligations as in this agreement on each sub-processor by contract and remains liable to the controller for their performance.

6Transfers to third countries#

Personal data is only transferred to a country outside the EU or the EEA if the conditions of Chapter V GDPR are met, in particular on the basis of an adequacy decision of the European Commission (including the EU-U.S. Data Privacy Framework for certified companies) or standard contractual clauses.

7Deletion and return#

During the contract, the controller can export its data at any time (the backup export in the settings, "Download my data" and the API) and delete it (monitors, workspaces, account). After the contract ends, the processor deletes the controller's remaining personal data within 30 days, and from backups when they are overwritten in the normal rotation, unless Union or Member State law requires storage.

8Audits#

The processor demonstrates compliance primarily through this agreement, the documented measures in Annex 1 and, where available, certificates or audit reports. If these aren't sufficient in a specific case, the controller may, after giving at least 30 days' notice, carry out an inspection itself or through an independent auditor bound to confidentiality, during normal business hours and without disproportionately disrupting operations. Each party bears its own costs.

9Liability and precedence#

The parties' liability towards data subjects follows Art. 82 GDPR. Otherwise the liability provisions of the terms of service apply. If this agreement conflicts with the terms of service on the protection of personal data, this agreement prevails.

Annex 1: Technical and organisational measures#

Confidentiality: access to production systems only for authorised persons with personal accounts; the operator console requires two-factor authentication; every dashboard query is bound to one workspace so customers can't see each other's data; passwords are hashed with Argon2id; two-factor secrets, check credentials and bot tokens are encrypted with AES-256-GCM; API keys, session tokens and one-time links are stored only as hashes; sessions expire after inactivity.

Integrity: all connections to the service are encrypted with TLS; changes in workspaces and all actions in the operator console are recorded in audit logs; outgoing check requests are checked against private and blocked addresses.

Availability and resilience: servers and database at 24fire GmbH, Kronenstraße 4, 68723 Schwetzingen, Germany (servers in Germany); the service monitors its own scheduler and alert delivery and reports problems; rate limits and bot protection against abuse; failed alert deliveries are retried.

Backups and recovery: a database backup every night, stored on our servers at 24fire GmbH in Germany, kept for 30 days and then deleted.

Separation: data of different customers is separated by workspace in the application.

Review: dependencies are checked for known vulnerabilities; security reports are accepted at https://uplance.cloud/security; these measures are reviewed regularly and at least once a year.

Annex 2: Sub-processors#

Hosting of servers and database: 24fire GmbH, Kronenstraße 4, 68723 Schwetzingen, Germany (servers in Germany). Email delivery: our own mail server (Poste.io) on our servers at 24fire GmbH, Kronenstraße 4, 68723 Schwetzingen, Germany; no separate email service receives the messages. Payments, only for billing data of paying customers: Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. Network delivery, DNS and protection against attacks for uplance.cloud (all visits pass through it, including IP addresses): Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Spam checks for emails sent to us (the sending mail server's IP address and domain are looked up in public blocklists): Spamhaus Technology Ltd., United Kingdom, and other public DNS blocklists. For completeness, not processors: the service, its database and mail server are deployed and managed with Coolify, which we run ourselves on our own servers, so no data goes to Coolify's makers. Browser checks run in a Chromium browser (Playwright) on our own servers. HTTPS certificates come from Let's Encrypt (Internet Security Research Group, San Francisco, USA), which only sees domain names, not visitor data.