Data Processing Addendum

This Data Processing Addendum (“Addendum”) forms part of the agreement for UptimeOwl between Blastup Single Member P.C. (“Blastup”, “Processor”) and the subscribing customer (“Customer”). It applies where Blastup processes personal data on the Customer's behalf to provide the Services. The Customer's identity is recorded in the relevant account, subscription or order. Blastup's legal information is available at https://blastup.digital/en/legal-notice. The data-protection contact is [email protected].

1. Scope and roles

The Customer appoints Blastup to process Customer Personal Data for the monitoring, incident-management and related services described in the agreement and Schedule A below. The Customer ordinarily acts as controller. Where the Customer acts as processor for another controller, Blastup acts as subprocessor, and the Customer confirms that it is authorised to give the relevant instructions and appoint Blastup.

This Addendum applies only to the processing performed on the Customer's behalf. Processing for which Blastup independently determines the purposes and means, such as its own customer administration, accounting and legal compliance, is described in the Privacy Policy. A provider's role depends on the processing concerned; a reference to a payment or integration provider does not make every activity of that provider subprocessing under this Addendum.

This Addendum takes precedence over conflicting general service terms on the processing it governs. Mandatory data-protection law and any applicable binding international-transfer clauses take precedence over inconsistent contractual wording. The Customer's applicable order and documented configuration identify the features actually used; references to roadmap capabilities do not activate those features or promise their release.

2. Definitions

“Applicable Data Protection Law” means the data-protection laws applicable to the processing, including Regulation (EU) 2016/679 (“GDPR”) and relevant EU and Member State legislation.

“Customer Personal Data” means personal data submitted, collected or otherwise processed by Blastup on the Customer's behalf under the agreement, including personal data in configurations, monitoring results, incident content and communications.

“Personal Data Breach” means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Customer Personal Data. A suspected event is investigated to establish whether a breach has occurred.

“Subprocessor” means another processor engaged by Blastup to carry out processing of Customer Personal Data on the Customer's behalf. “Controller”, “processor”, “personal data”, “data subject” and “processing” have the meanings given by Applicable Data Protection Law.

“Transfer Clauses” means the applicable Standard Contractual Clauses under Commission Implementing Decision (EU) 2021/914, or a valid replacement, where selected and completed for a relevant international transfer. This Addendum does not itself purport to be those clauses or to supply missing transfer annexes.

3. Customer responsibilities and documented instructions

The agreement, this Addendum, the accepted order and the Customer's authorised service configuration constitute the initial documented instructions. Instructions can include targets and check settings, notification recipients, publication choices, integrations, private agents and approved automated actions within the agreed service scope.

The Customer is responsible for a lawful basis, transparency to affected people, authority to monitor target systems and the lawfulness of information supplied or returned. It must minimise unnecessary personal data, control its users' permissions and obtain any required permissions for notifications, private-network access and automated activity. Special-category or other particularly sensitive data is not authorised merely because a field can technically receive it; Schedule A sets the applicable restriction.

Additional instructions must be documented by the Customer's authorised personnel, through supported account controls or [email protected]. Instructions outside the agreed scope may require a separate service arrangement, but that requirement cannot be used to avoid mandatory data-protection duties.

Blastup will process Customer Personal Data only on documented instructions, including for transfers, unless required by EU or Member State law to which it is subject. In that case, Blastup will inform the Customer of the legal requirement before processing unless the law prohibits that information on important public-interest grounds.

If Blastup considers an instruction to infringe Applicable Data Protection Law, it will inform the Customer immediately and seek a lawful resolution. It may pause the affected instruction while the issue is resolved; confirmation from the Customer does not authorise unlawful processing. Blastup will not use Customer Personal Data for unrelated advertising or third-party model training under this Addendum.

4. Confidentiality and personnel

Blastup will ensure that people authorised to process Customer Personal Data are bound by confidentiality or an appropriate statutory obligation and receive instructions appropriate to their responsibilities. Access will be limited to what is needed for authorised operation, support, security or other obligations under the agreement.

Blastup will maintain processes for granting, reviewing and withdrawing access, including privileged platform access. Authorised support visits must follow the applicable permission, time-limit and audit controls. Customer data must not be disclosed to unrelated tenants or accessed merely because a person holds an account on UptimeOwl.

The confidentiality obligation continues after the relevant person's access or engagement ends. Confidential information may be disclosed where law requires it, subject to the notification and other protections applicable to that disclosure.

5. Security of processing

Taking account of the state of the art, implementation costs, the nature and context of processing and risks to individuals, Blastup will implement and maintain appropriate technical and organisational measures. Schedule B describes the security framework for the processing.

The measures must address confidentiality, integrity, availability and resilience, appropriate protection of credentials and personal data, restoration following incidents and regular assessment of their effectiveness. Blastup may update measures as technology and risks change, provided the overall protection required by this Addendum is not materially reduced.

The Customer remains responsible for security under its control, including its email inboxes, devices, authorised recipients, integration permissions, private-agent deployment and the target systems it instructs UptimeOwl to contact. A Customer's selection of an unencrypted endpoint does not turn that connection into an encrypted one; sensitive monitoring traffic should use appropriately protected channels.

6. Personal Data Breaches

Blastup will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data. Initial notice will not be postponed solely because all details are not yet known. Information may be supplied in stages as the investigation progresses.

To the extent available, the notice will describe the nature of the breach, the categories and approximate numbers of affected people and records, likely consequences, measures taken or proposed to address the breach and mitigate adverse effects, and a contact for further information.

Blastup will take reasonable measures to contain and investigate the incident, preserve relevant evidence and reduce recurrence. It will provide assistance needed for the Customer to assess and meet its notification obligations, taking account of the processing and information available to Blastup. Notification is not an admission of liability.

The Customer remains responsible for decisions on notification to its supervisory authority and affected individuals, unless law separately requires Blastup to notify. An ordinary failed monitor check is not by itself a Personal Data Breach, although it may trigger investigation of the monitored system.

7. Assistance and individual rights

Taking account of the nature of processing, Blastup will assist the Customer through appropriate technical and organisational measures, insofar as possible, with requests to exercise data-subject rights. This includes relevant assistance with access, rectification, erasure, restriction, portability and objections.

If a request relating to Customer Personal Data reaches Blastup directly, Blastup will notify or refer it to the Customer without undue delay and will not substantively determine the response on the Customer's behalf without authorisation, unless law requires it. Blastup may verify identity and take steps needed to avoid unauthorised disclosure.

Taking account of the processing and information available, Blastup will assist the Customer with obligations concerning security, breach notifications, data-protection impact assessments and prior consultation with supervisory authorities under GDPR Articles 32 to 36. It will provide relevant information about its processing, safeguards and subprocessors.

The parties will cooperate with competent supervisory authorities. Blastup will notify the Customer of legally disclosable authority requests concerning Customer Personal Data, and will not disclose more than is lawfully required. Nothing in this Addendum prevents an authority from exercising its powers.

8. Subprocessors and customer-selected integrations

The Customer provides general written authorisation for subprocessors identified in the applicable subprocessor register made available for the service, subject to this section. Blastup will maintain the register with the relevant legal identities, processing functions and locations, and make it available before the relevant processing and on request at [email protected]. A list of provider categories or a roadmap reference is not a substitute for that register.

Before an intended addition or replacement, Blastup will notify the Customer and provide the relevant information at least 10 days before the new subprocessor begins processing Customer Personal Data. The Customer may object within that period on reasonable data-protection grounds. Blastup will not start the proposed processing during the objection period and will work with the Customer to resolve a timely objection before using that subprocessor for the Customer's data.

If no suitable resolution is available, the parties will arrange an alternative, discontinue the affected feature or permit termination of the affected service before the disputed processing begins. Applicable charges and any required adjustment follow the agreement and mandatory law; this process does not restrict statutory remedies.

Blastup will use subprocessors offering sufficient guarantees and impose binding data-protection obligations providing the protection required by this Addendum for their processing. Blastup remains fully liable to the Customer for performance of its subprocessors' relevant obligations. It will provide information needed to demonstrate those arrangements, with appropriate protection of unrelated confidential material.

Customer-selected recipients and integrations are separately governed by the Customer's instructions and the applicable provider arrangement. For example, sending an incident to a Customer's own Slack channel does not necessarily make Slack a Blastup subprocessor. Where Blastup appoints a provider to process the Customer's data on its behalf, the subprocessor requirements apply regardless of the feature's name.

9. Processing locations and international transfers

The processing locations and relevant transfer arrangements must be identified for the services and subprocessors used. A selected monitoring region identifies a probe location, not an automatic commitment that every database, support activity, message delivery or other processing remains in that region. An exclusively EU/EEA residency commitment applies only where expressly agreed and supported by the applicable configuration and provider arrangements.

Blastup will not transfer Customer Personal Data in a manner inconsistent with the Customer's documented instructions or Applicable Data Protection Law. Where a transfer outside the EEA requires a safeguard, the parties or relevant provider must establish a valid transfer mechanism before it begins, such as an applicable adequacy decision or properly completed Transfer Clauses, together with necessary assessments and supplementary measures.

Where Transfer Clauses are used, the correct module, parties, annexes, supervisory authority and other required particulars must reflect the actual transfer. A generic reference to clauses in this document does not establish that a particular provider or destination is covered. Blastup will provide information reasonably needed to assess the relevant safeguards and respond to lawful information requests about them.

10. Records, information and audits

Blastup will maintain the processing records required of it and make available the information necessary to demonstrate compliance with the obligations in this Addendum and GDPR Article 28. This includes relevant information about access, locations, subprocessors, security measures and implementation of data-handling instructions.

Blastup will allow and contribute to audits, including inspections, by the Customer or an independent auditor mandated by it. The parties may reasonably coordinate timing, scope, confidentiality and secure access and use existing evidence where it adequately answers the request. These arrangements must not prevent a necessary audit, exclude inspections altogether or restrict a competent authority's powers.

Audits must protect unrelated customer data and systems and avoid unnecessary disruption. Confidential evidence may be handled through appropriate access restrictions, but an unsupported assurance or certification claim is not a substitute for information necessary to establish compliance. Blastup will address established non-compliance without undue delay and cooperate on appropriate corrective action.

11. Suspension, return and deletion

A payment or voluntary suspension does not terminate this Addendum or remove data-protection obligations. The service's preservation of suspended workspaces, and its deferral of routine deletion of history outside a plan's visible allowance, remain subject to lawful Customer instructions and mandatory duties. Blastup will not withhold required assistance, return or deletion solely because a fee is disputed or unpaid.

At the end of the relevant processing services, the Customer may choose return or deletion of Customer Personal Data. Blastup will return the data in an agreed usable form where return is selected and delete remaining copies, or securely delete it where deletion is selected, unless EU or Member State law requires storage. Requests should be made through supported controls or [email protected] by an authorised Customer representative.

The parties will document the practical scope and completion arrangements for return or deletion. Backup copies must remain protected and unavailable for ordinary use pending secure deletion under the applicable backup cycle. If a backup is restored during that interval, applicable deletion instructions must be reapplied. Backup handling must not be used to retain data indefinitely or disregard required deletion.

Where storage is legally required, Blastup will identify the requirement to the extent permitted, restrict use to that purpose and maintain the protections of this Addendum for as long as it holds the relevant data. On request, Blastup will confirm completion of deletion and identify any legally required exceptions. Blastup's independent statutory accounting or legal records are distinguished from Customer Personal Data held solely as processor.

12. Term, changes and governing provisions

This Addendum applies for the duration of the relevant processing and continues for any period during which Blastup or its subprocessors hold Customer Personal Data under it. Confidentiality and any obligations intended to survive continue as applicable.

Changes must be documented through an appropriate agreement or acceptance process. An updated website version does not silently rewrite the Addendum recorded for an existing acceptance or authorise a new purpose. No general service disclaimer, commercial remedy or liability provision limits mandatory data-protection duties or rights that cannot lawfully be restricted.

Greek law governs this Addendum, subject to mandatory Applicable Data Protection Law and any overriding rules in valid Transfer Clauses. If a provision is invalid, the remaining provisions continue to apply to the extent lawful. Questions, instructions and data-protection notices may be sent to [email protected].

Schedule A. Description of processing

Subject matter and purpose

Processing supports the Customer's authorised use of UptimeOwl for monitoring systems and availability, managing incidents, notifying authorised recipients, publishing selected status information, producing reports and administering the related workspace. Processing is limited to enabled features and documented instructions.

Nature and operations

Operations can include collection from configured targets or authorised users; transmission; recording and storage; validation, filtering and analysis; correlation into incidents; aggregation for uptime, latency and service-level reports; retrieval and display; delivery through selected channels or integrations; publication at the Customer's direction; access restriction; export, return and deletion.

The service scope includes HTTP/API checks, certificate and domain information, DNS and heartbeat checks, network probes, browser journeys, regional and private-network agents, maintenance schedules, incident notes and runbooks, on-call and escalation, status pages and subscriptions, mobile access, API and ticketing connections, enterprise identity provisioning, and explicitly authorised diagnostic or remediation actions when available. Optional AI processing requires specific disclosure and instructions and any necessary provider authorisation before use; this Addendum provides no general authorisation for model training.

Categories of people

Data may concern the Customer's employees, contractors and authorised workspace users; incident contacts and on-call personnel; status subscribers and visitors; users of monitored systems whose data appears in permitted responses or logs; and other people whose information the Customer lawfully supplies for the agreed purpose.

Types of personal data

Relevant data can include names, work identifiers and roles; email addresses and mobile numbers; channel and push-device identifiers; IP addresses and request or device metadata; schedule, time-zone and acknowledgment information; incident comments and communications; and personal data contained in endpoint addresses, request configurations, credentials, response samples, browser captures or diagnostic output.

Published names, branding and status messages can also contain personal data. The actual types depend on the Customer's configuration. Billing and statutory accounting data for which Blastup acts independently as controller are outside this processing schedule to that extent.

Sensitive data and minimisation

Routine processing of special-category data, criminal-conviction data or other information requiring additional safeguards is not part of the standard authorised scope. It requires an express written arrangement identifying the data, lawful instructions, necessity and additional measures before processing. Customers should redact or avoid unnecessary personal information, use test credentials and restrict captures and diagnostics to what is needed.

If such information is inadvertently included, the parties will cooperate on appropriate containment, restriction or deletion and assessment of any further obligations. Its receipt does not expand the authorised purpose.

Duration and frequency

Checks and related processing recur at the configured intervals or in response to events and authorised actions for the duration of the service. Scheduled pauses stop relevant new activity but may preserve existing records. Processing and protected storage continue only as permitted by the agreement, this Addendum, lawful instructions and applicable retention duties. End-of-service return and deletion follow section 11.

Schedule B. Technical and organisational measures

Identity, authorisation and tenant separation

Blastup will maintain authenticated access, role and resource permissions, tenant-scoped access to data and controls to withdraw access when authorisation ends. Normal production interactive access uses email-link confirmation followed by authenticator verification or a single-use backup code. Authenticator secrets are encrypted and backup codes are stored as hashes. Browser sessions expire; persistent mobile sessions remain revocable. Factor changes require fresh verification, invalidate other sessions and are recorded without setup secrets or codes. Privileged and support access must be restricted and auditable.

Data and credential protection

Measures include protection of sensitive monitoring credentials, controlled access to keys and integration secrets, redaction of secrets from public views and relevant logs, and access-controlled storage of private uploaded or generated files. Account and service communications must use appropriate transport protection. Public status publication must expose only the content authorised for publication; it must not expose private configuration or credentials.

Resilience and recovery

Blastup will maintain risk-appropriate backup, recovery and incident procedures, capacity oversight and measures to restore availability and access after a physical or technical incident. Recovery arrangements must be assessed and tested as appropriate to the service and risks. This schedule does not assert a particular replication topology, backup location, guaranteed recovery deadline or certification unless separately documented and agreed.

Secure operation and change management

Measures include controlled changes, appropriate separation of development and production, security testing, dependency and vulnerability management, incident handling and monitoring of relevant access and operational events. Testing must avoid unnecessary use of live Customer Personal Data. Public-target restrictions, agent permissions and safe handling of request settings must be maintained for the applicable monitor types.

People and service providers

Authorised personnel must receive appropriate confidentiality and security instructions. Infrastructure providers must supply suitable assurances for their physical and operational safeguards. Subprocessor arrangements, access reviews, incident contacts and evidence of the measures must be kept current. Any claim about a named certification must correspond to its actual holder, scope and validity; a provider's certificate is not automatically an UptimeOwl certification.

Schedule C. Subprocessor and feature-specific records

The applicable subprocessor register and any feature-specific processing or transfer schedules form part of the documented processing arrangement when supplied and agreed through the applicable process. They must identify the actual entities, functions and locations rather than only brand names.

Relevant service categories can include hosting and managed data services, object storage, delivery and security, transactional email, push notifications and SMS. Providers referenced in UptimeOwl's service documentation include UpCloud, Google Cloud Storage, Cloudflare and Mandrill/Mailchimp Transactional, and OneSignal or Twilio where those features are enabled. This category summary is not an assertion that every provider processes every Customer's data and is not a completed subprocessor register.

Customer-selected Slack, Teams, ticketing, identity or other connections require their actual roles and instructions to be recorded as applicable. Payment, tax-validation and accounting providers are assessed according to their particular processing and controller or processor role. Optional AI or private-agent arrangements require relevant additional details before activation.

The Customer may obtain the applicable records and submit questions or objections through [email protected]. Blastup must establish required subprocessor authorisations and transfer safeguards before the corresponding processing begins.