Data Processing Agreement
This Data Processing Agreement (“DPA”) forms part of the Terms of Service between [Company legal name] (“Processor”) and the customer (“Controller”) and applies when Upstreamr processes personal data on the Controller’s behalf, as required by Article 28 GDPR.
Draft, pending legal review. This document is a template and is not yet in force. Text in [brackets] will be completed before launch.
Contents
1. Subject matter and duration
The Processor processes personal data to provide Upstreamr under the Terms of Service, for as long as the Controller uses the service and until deletion under section 10.
2. Nature and purpose
Hosting status pages and their content; storing and notifying subscribers by email, webhooks and chat channels; running monitoring checks; storing organization members and their activity; and related support.
3. Categories of data and data subjects
- Data subjects: the Controller’s status page subscribers, its organization members, and individuals named in content the Controller publishes.
- Personal data: email addresses, names, webhook and chat channel addresses, subscription preferences, IP addresses in logs, and any personal data the Controller includes in published content.
- No special categories of personal data are intended to be processed.
4. Processor obligations
- Process personal data only on the Controller’s documented instructions, including these terms.
- Ensure people authorized to process the data are bound by confidentiality.
- Implement the technical and organizational measures in section 7.
- Assist the Controller with data subject requests, security, breach notification and impact assessments.
- Make available the information needed to demonstrate compliance and allow for audits under section 8.
5. Sub-processors
The Controller gives general authorization for the sub-processors below. The Processor will give at least 30 days’ notice of new sub-processors by email or in the admin, during which the Controller may object on reasonable data protection grounds. The Processor imposes data protection obligations on each sub-processor equivalent to this DPA and remains liable for them.
| Sub-processor | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| Cloudflare, Inc. | Hosting, compute, database, queues, content delivery and network security | Global network; EU data localisation where configured | EU Standard Contractual Clauses; EU-U.S. Data Privacy Framework |
| Stripe Payments Europe, Ltd. (Stripe) | Payment processing, invoicing and tax calculation | Ireland, with transfers to the United States | EU Standard Contractual Clauses; EU-U.S. Data Privacy Framework |
| Resend (Plus Five Five, Inc.) | Transactional and notification email delivery | United States and EU regions | EU Standard Contractual Clauses |
| jsDelivr (Prospect One / Cloudflare and Fastly CDN) | Delivery of the API reference page’s scripts and styles (/api/docs); receives the visitor’s IP address and browser details | Global content delivery network | EU Standard Contractual Clauses [to confirm with counsel] |
6. International transfers
Transfers outside the European Economic Area take place only under an adequacy decision or the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Three where the Processor engages a sub-processor.
7. Security measures
- Encryption in transit (TLS) and at rest through our infrastructure providers.
- Role-based access for organization members; least-privilege access for our staff.
- Hashed API keys and probe tokens, signed probe results and signed webhooks.
- Logical separation of each organization’s data.
- Backups, monitoring of the service, and a documented incident response process.
8. Audits
On reasonable request, no more than once a year and with 30 days’ notice, the Processor will provide information to demonstrate compliance, such as sub-processor certifications. On-site audits are at the Controller’s expense and subject to confidentiality.
9. Personal data breaches
The Processor will notify the Controller without undue delay, and in any case within [48] hours, after becoming aware of a personal data breach affecting the Controller’s data, with the information the Controller needs to meet its own obligations.
10. Deletion and return
When the service ends, the Processor deletes the Controller’s personal data within [30] days, unless EU or Member State law requires storage.
11. Contact
Data protection questions and requests: hello@upstreamr.com. [Company legal name], [Registered address].