Data Processing Agreement

1. Scope

This Data Processing Agreement ("DPA") applies when Upwarden processes personal data on behalf of the Customer as a data processor under GDPR Article 28.

2. Data Processing Details

• Subject matter: Uptime monitoring and status page services
• Duration: For the term of the service agreement
• Nature: Automated monitoring, storage, and notification delivery
• Categories of data subjects: Customer employees, status page subscribers
• Types of personal data: Email addresses, names, IP addresses (from monitoring targets owned by Customer)

3. Obligations

Upwarden will process personal data only on documented instructions from the Customer, ensure confidentiality, implement appropriate technical and organisational measures, and assist with GDPR compliance obligations.

4. Sub-processors

Current sub-processors:

• Resend (email delivery) — USA
• Polar.sh (billing) — EU
• Hetzner (hosting, storage) — Germany

5. Data Transfers

Where personal data is transferred outside the EEA, we ensure appropriate safeguards are in place (Standard Contractual Clauses or adequacy decisions).

6. Deletion

Upon termination of services, all personal data will be deleted within 30 days unless retention is required by law.

7. Contact

For DPA-related inquiries or to request a signed copy, contact [email protected].