Data Processing Agreement
Questo documento è pubblicato esclusivamente in inglese. Il testo inglese è la versione vincolante.
This Data Processing Agreement ("DPA") forms part of the Terms of Service published at https://pingsured.eu/legal/terms ("Terms") between comci technology UG (haftungsbeschränkt), Dreieichstr. 53, 63128 Dietzenbach, Germany ("Pingsured", "we", "us") and the Customer identified in the Terms ("Customer", "you"). It is accepted together with the Terms and applies for as long as we process personal data on your behalf.
Capitalised terms not defined here have the meaning given in the Terms. "GDPR" means Regulation (EU) 2016/679. "Personal data", "processing", "controller", "processor", "data subject", and "personal data breach" have the meaning given in Article 4 GDPR.
1. Roles
For the processing described in Annex 1, you are the controller and we are the processor within the meaning of Article 28 GDPR. Where you act as a processor for a third party, you are our instructing party in relation to that processing and warrant that your instructions are covered by your own agreement with that third party.
We are the independent controller for personal data we process for our own purposes, such as account and billing data, as described in our privacy policy at https://pingsured.eu/legal/privacy. That processing is not covered by this DPA.
2. Subject matter, duration, nature, and purpose
The subject matter, duration, nature, and purpose of the processing, the types of personal data, and the categories of data subjects are set out in Annex 1.
3. Instructions
We process personal data only on your documented instructions, unless required to do so by Union or Member State law to which we are subject; in that case we inform you of the legal requirement before processing, unless the law prohibits this on important grounds of public interest.
Your instructions consist of the Terms, this DPA, and the configuration you make in the Service through its user interface and API (which checks to run, against which hosts, from which locations, what to capture, and where to send notifications). The Service is a standardised product; individual instructions outside the configuration options it offers are not part of the Service, and we are not obliged to carry them out. We will inform you if, in our opinion, a configuration you have made infringes the GDPR or other applicable data-protection law, and we may suspend the affected processing until you change it.
4. Confidentiality
We ensure that persons authorised to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that they process personal data only on our instructions.
5. Security
Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risks for the rights and freedoms of natural persons, we implement the technical and organisational measures set out in Annex 2 to ensure a level of security appropriate to the risk. We may update those measures over time provided the overall level of security is not reduced.
6. Subprocessors
You give us general authorisation to engage the subprocessors listed in Annex 3. We will notify you by email to the account owner(s) at least thirty (30) days before adding or replacing a subprocessor. You may object on reasonable data-protection grounds within that period. If we cannot resolve the objection, you may terminate the affected part of the Service with effect from the date the change takes effect; prepaid fees for the unused remainder of the subscription period are refunded pro rata.
We impose on each subprocessor, by contract, data-protection obligations equivalent to those in this DPA, in particular sufficient guarantees to implement appropriate technical and organisational measures. We remain fully liable to you for the performance of each subprocessor's obligations.
7. Assistance
Taking into account the nature of the processing, we assist you by appropriate technical and organisational measures, insofar as this is possible, in fulfilling your obligation to respond to requests from data subjects exercising their rights under Chapter III GDPR. If a data subject contacts us directly about processing carried out on your behalf, we forward the request to you without undue delay and do not respond ourselves unless you instruct us to.
We assist you in ensuring compliance with Articles 32 to 36 GDPR (security, breach notification, data protection impact assessment, and prior consultation), taking into account the nature of the processing and the information available to us. Where such assistance goes beyond what is reasonably included in the Service, we may charge our then-current reasonable rates, provided we tell you in advance.
8. Personal data breaches
We notify you without undue delay, and in any case within forty-eight (48) hours, after becoming aware of a personal data breach affecting personal data processed on your behalf. The notification describes, to the extent known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Information may be provided in phases as it becomes available.
9. Deletion and return
During the contract, Customer Data is accessible to you through the Service's user interface and API. For thirty (30) days after termination, you may request a copy of your Customer Data by email to support@pingsured.eu from an address registered to your account; we provide it in a common machine-readable format within fourteen (14) days of the request. After the thirty-day period we delete all personal data processed on your behalf, including copies, unless Union or Member State law requires storage. Backups are overwritten in the ordinary course of our backup rotation within a further period of no more than ninety (90) days and are not accessed for any other purpose in the meantime.
10. Audits and information
We make available to you all information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR. Our first means of doing so is documentation: this DPA, its annexes, and any certifications or audit reports of our subprocessors that we are permitted to share.
Where documentation is not sufficient to demonstrate compliance, you may conduct, or have an independent auditor bound by confidentiality conduct, an audit of the processing covered by this DPA once per twelve (12) months, or additionally where a supervisory authority requires it or a personal data breach has occurred. Audits are announced at least thirty (30) days in advance, take place during normal business hours, do not unreasonably disrupt our operations, and do not extend to other customers' data or to our subprocessors' premises. Each party bears its own costs.
11. International transfers
Customer Data — check configuration, results, alert history, notification recipients, and captured response data — is stored and processed in the European Union.
Monitoring checks are executed from worker nodes in the locations you select for each monitor. Those locations may be outside the European Economic Area, and by selecting such a location you instruct us to execute the check from there. A worker node outside the EEA processes only the data needed to execute the check — the target hostname, IP address, or URL, the check configuration, and the response received from the target — and transmits the result to our systems in the EU. Worker nodes outside the EEA do not persistently store personal data, and captured response data is retained only in the EU. You may restrict a monitor to locations within the EEA at any time.
Where a worker node outside the EEA is operated by a subprocessor established outside the EEA, we ensure an appropriate safeguard under Chapter V GDPR before engaging it — an adequacy decision (including certification under the EU-US Data Privacy Framework) or the standard contractual clauses adopted by the European Commission — and assess the laws and practices of the destination country. The safeguard relied on for each such subprocessor is stated in Annex 3. Where a worker node outside the EEA is operated by a subprocessor established in the EU on its own infrastructure abroad, no transfer within the meaning of Chapter V takes place, but the location is nevertheless disclosed in Annex 3.
Apart from the execution of checks as described above, we do not transfer personal data to a country outside the EEA and do not engage subprocessors outside the EEA without notifying you in accordance with section 6.
12. Liability
The limitation of liability in section 12 of the Terms applies to claims under this DPA. It does not limit either party's liability towards data subjects under Article 82 GDPR or towards supervisory authorities.
13. Term and precedence
This DPA applies for as long as we process personal data on your behalf and, for the deletion obligations in section 9, until deletion is complete. In the event of a conflict between this DPA and the Terms on any matter concerning the processing of personal data, this DPA prevails.
Annex 1 — Details of the processing
Subject matter. Provision of the Pingsured uptime and availability monitoring platform as described in section 3 of the Terms.
Duration. For as long as you have an account on the Service, and thereafter until the personal data has been returned or deleted in accordance with section 9.
Nature and purpose. Executing the monitoring checks you configure from our worker nodes, storing the results, sending notifications to the recipients you configure, and displaying results and metrics in the platform UI. The purpose is limited to delivering the Service to you.
Scope in practice. The Service is designed to monitor systems, not people. The personal data it needs in order to work is limited to the names and contact details of the users and notification recipients you configure. Check targets and check results — hostnames, IP addresses, URLs, status codes, response times — generally do not constitute personal data, and the Service does not capture response bodies unless you enable it for a monitor. To the extent monitoring data nevertheless contains personal data, which is determined entirely by which systems you choose to monitor and what you choose to capture, this DPA applies to it.
Types of personal data.
- Contact details of notification recipients you configure: names, email addresses, phone numbers, chat or webhook identifiers.
- Names and email addresses of users you invite to your account.
- Network identifiers of monitored systems: hostnames, IP addresses, URLs.
- Response data from monitored endpoints where you have configured the Service to capture it (status lines, headers, response bodies). This may contain any personal data your endpoints return; you control what is captured.
- Timestamps, check results, and alert history associated with the above.
Special categories of data. None intended. You must not configure the Service to capture response data containing special categories of personal data (Article 9 GDPR).
Categories of data subjects. Your employees, contractors, and other persons you designate as notification recipients or account users; operators and users of the systems you monitor, insofar as personal data appears in network identifiers or captured response data.
Annex 2 — Technical and organisational measures
Our security programme is aligned with the control objectives of ISO/IEC 27001 and the SOC 2 Trust Services Criteria. We are not currently certified under either framework and do not represent otherwise.
Confidentiality
- Data at rest is stored on encrypted volumes at our hosting provider.
- Data in transit between users, the platform, worker nodes, and subprocessors is encrypted using TLS.
- Access to production systems is limited to named staff with a need to know, authenticated by individual accounts and SSH keys, with multi-factor authentication where the provider supports it.
- Access rights are reviewed when staff join or leave and at least annually.
- Customer accounts are logically separated; users see only data belonging to their own account.
- Staff are bound to confidentiality by contract.
Integrity
- Changes to production systems are made through version-controlled deployments.
- Every change to a database record — including Customer Data and configuration — is recorded in an audit trail capturing what changed, by whom, and when. Audit records are retained for twenty-four (24) months on a rolling basis and, in any case, deleted with the account in accordance with section 9.
- Administrative access and security-relevant events are logged; logs are retained for at least ninety (90) days and protected against modification.
Availability and resilience
- Production data is backed up at least daily; backups are stored encrypted and in a separate location from the primary system within the EU.
- Restore procedures are tested at least annually.
- Systems are monitored for availability and resource exhaustion.
- Worker nodes, which by design may reside outside the EEA, hold no persistent data and can be rebuilt from configuration.
Procedures for regular review
- Security measures and this annex are reviewed at least annually and after any personal data breach.
- Subprocessor agreements and certifications are reviewed at least annually.
- Security vulnerabilities reported to security@pingsured.eu are triaged and tracked to resolution.
Annex 3 — Subprocessors
The subprocessors we engage, their registered seats, the purposes for which we use them, the locations in which they process personal data, and — for any subprocessor established outside the EEA — the transfer safeguard relied on, are published at https://pingsured.eu/legal/subprocessors. That list forms part of this DPA. It records the date of each addition, replacement, or removal, so that the list applicable at any point in time can be determined.
Changes to the list are made in accordance with section 6 and do not require a new version of this DPA.
Worker nodes outside the EEA execute checks only and do not persistently store personal data (see section 11). Where a worker node outside the EEA is operated by a subprocessor established in the EU on its own infrastructure abroad, no transfer within the meaning of Chapter V GDPR takes place; the location is nevertheless disclosed in the list.
Change log
v1.0 (2026-09-15) — initial
Initial publication, together with Terms of Service v1.0.