Data Processing Agreement (DPA)

Agreement pursuant to Art. 28 GDPR · As of: September 21, 2026 · Version 1.0

§ 1 Subject Matter and Duration

1.1 This agreement governs the processing of personal data that UptimeSheriff (Niels van Veen, c/o Postflex #8764, Emsdettener Str. 10, 48268 Greven, Deutschland; hereinafter the "Processor") processes on behalf of the customer (hereinafter the "Controller") within the service UptimeSheriff (Art. 28(3) GDPR). It supplements the Terms of Service and applies from registration for the term of the usage agreement.

1.2 It applies to customers who use the service as businesses (§ 14 German Civil Code, BGB). For consumers the privacy policy is decisive; no processing on behalf takes place there.

§ 2 Nature, Purpose and Scope of Processing

2.1 The subject matter of the processing is monitoring the availability of websites and HTTP endpoints, sending alert messages to the recipients stored by the Controller, and providing public status pages.

2.2 Categories of data: addresses of the monitored endpoints; addresses of alert recipients (email addresses as well as Telegram, Slack and webhook targets); check results and status changes; contents of alert messages.

2.3 Data subjects: employees and agents of the Controller stored as alert recipients, and persons whose data is contained in monitored addresses.

§ 3 Instructions

3.1 The Processor processes the data only on documented instructions of the Controller. Instructions result from the usage agreement, the Terms of Service and the settings the Controller makes in the service itself (creating monitors, storing recipients, publishing status pages). Further instructions are given by the Controller in text form to support@uptimesheriff.com.

3.2 If the Processor considers an instruction unlawful, it informs the Controller without delay and may suspend execution until the Controller confirms the instruction.

§ 4 Obligations of the Processor

• Confidentiality: persons with access to the data are bound to confidentiality.
• Security: the Processor implements the technical and organisational measures pursuant to Art. 32 GDPR described in § 7.
• Assistance: it assists the Controller by appropriate means in responding to requests of data subjects (Art. 12 to 22 GDPR) and with the obligations under Art. 32 to 36 GDPR, insofar as this is possible given the nature of the processing.
• Notification: it notifies the Controller of personal data breaches without undue delay after becoming aware, by email to the address of the user account, so that the Controller can meet its deadline under Art. 33 GDPR.
• Evidence: it makes available all information necessary to demonstrate compliance with the obligations under Art. 28 GDPR and allows for audits pursuant to § 6.
• Place of processing: processing takes place in the European Union; exceptions follow from § 5 of this agreement and section 15 of the privacy policy.

§ 5 Sub-processors

5.1 The Controller authorises the engagement of the following sub-processors (provider, seat, purpose):

• Vercel, Inc., Covina, USA: hosting of the application, edge network, serverless functions.
• Supabase, Inc., Singapore: database and authentication, data stored in Frankfurt.
• Hetzner Online GmbH, Gunzenhausen, Germany: monitoring server.
• Cloudflare, Inc., San Francisco, USA: bot protection (Turnstile).
• Resend (Plus Five Five, Inc.), San Francisco, USA: email delivery.
• Stripe Payments Europe, Ltd., Dublin, Ireland: payment processing.
• sevDesk GmbH, Offenburg, Germany: invoicing.

5.2 The Processor informs the Controller of intended changes (adding or replacing a sub-processor) at least 30 days in advance by email to the address of the user account. The Controller may object to the change within 14 days for important data protection reasons; if no agreement is reached, it may terminate the usage agreement for cause.

5.3 The Processor imposes on sub-processors the same data protection obligations as set out in this agreement and remains liable for them as for its own conduct (Art. 28(4) GDPR). Transfers to third countries are governed by section 15 of the privacy policy (EU-US Data Privacy Framework, standard contractual clauses).

§ 6 Audit Rights

6.1 The Controller may satisfy itself of compliance with this agreement before and during the processing, as a rule by way of information and evidence (such as certifications and reports of the sub-processors). On-site audits are possible with 30 days notice during usual business hours, at most once a year, unless a supervisory authority or a data breach gives cause.

§ 7 Technical and Organisational Measures

7.1 The Processor maintains the following measures and develops them in line with the state of the art:

• Access control: access to database, hosting and monitoring server only via personal credentials or SSH keys.
• Authorisation control: row level security in the database; every user sees only their own data, public status pages release only the data made public.
• Transfer control: all connections between browser, application, database and monitoring server are encrypted (TLS).
• Separation control: customer data is separated by the user ID in every table.
• Availability control: database backups by the database provider according to its service description; the monitoring server holds no data that cannot be restored from the database.
• Input control: changes to monitors, recipients and status pages are attributed to the user account from which they were made.
• Sub-processing control: sub-processors are engaged only under an agreement pursuant to Art. 28 GDPR (§ 5).

§ 8 Deletion and Return

8.1 Upon deletion of the user account (Terms § 8) the Processor deletes all data of the Controller unless statutory retention obligations apply. Check results are deleted earlier after the retention period of the respective plan (Terms § 2.2).

8.2 The Controller can view and export its data in the service before deletion (Terms § 8).

§ 9 Final Provisions

9.1 As far as processing on behalf is concerned, this agreement takes precedence over the Terms of Service. Otherwise the Terms apply, in particular regarding liability (§ 12), governing law and place of jurisdiction (§ 17).

9.2 The Processor notifies the Controller of changes to this agreement by email to the address of the user account; Terms § 15 applies accordingly.