How we handle the data you trust us with.

1 · Definitions

• You: the customer, the person or organisation that holds an Upglory workspace and accepted the terms of service.
• We and Upglory: the company named in section 16.
• The terms: the terms of service, of which this agreement is a part.
• Customer personal data: personal data in your workspace that we process on your behalf to provide the service, as Annex 1 describes.
• Data protection law: the General Data Protection Regulation (EU) 2016/679 (the GDPR), the national laws that supplement it, and, where they apply, the UK GDPR and the UK Data Protection Act 2018.
• Subprocessor: a company we engage to process customer personal data.
• Standard contractual clauses: the clauses annexed to Commission Implementing Decision (EU) 2021/914.
• Controller, processor, data subject, personal data breach, processing and supervisory authority mean what they mean in the GDPR.

2 · Scope and roles

This agreement applies whenever we process customer personal data to provide the service. You are the controller and we are your processor. Where you act as a processor for someone else, we are your subprocessor, and you confirm that your controller has allowed it.

Your instructions are the terms, this agreement and the choices you make in the product: what you monitor, where alerts go, what your status pages publish, whom you invite, and what you export or delete. If the law requires us to process customer personal data in any other way, we tell you first, unless the law forbids it. If we believe an instruction breaks data protection law, we tell you.

You are responsible for the lawful basis of the personal data you put into the service, and for informing the people it concerns, such as your status page subscribers and the people who receive your alerts. The data we hold about you as our customer, such as your account, your sign-in activity and your billing, is ours as controller and is covered by the privacy notice, not by this agreement.

This agreement is part of the terms of service and you accept it with them when you set up or join a workspace. No signature is needed. If you want a signed copy for your records, ask through the contact page or write to [email protected], and we send one, signed by us, with the named list of subprocessors.

3 · Our obligations as processor

• We process customer personal data only on your documented instructions, as section 2 describes.
• Everyone we allow to access customer personal data is bound to keep it confidential, by contract or by law, and uses that access only to provide the service, answer a support request or fix a fault.
• We keep it secure, as section 4 and Annex 2 describe.
• We engage subprocessors only as section 6 describes.
• We help you answer the people the data concerns, keep the data secure, deal with breaches and carry out impact assessments, as sections 5, 7 and 8 describe.
• We delete or return the data when the service ends, as section 10 describes.
• We give you the information you need to show that this agreement is kept, and allow audits, as section 11 describes.
• We never sell customer personal data, use it for advertising or profiling, or use it to train AI models.

4 · Security

We take the technical and organisational measures in Annex 2, chosen for the risk to the people the data concerns, as article 32 of the GDPR asks. We may change a measure as the service and good practice change, but never in a way that lowers the protection of customer personal data.

5 · Personal data breaches

If we become aware of a personal data breach affecting customer personal data, we tell the owners of the workspace by email without undue delay and in any case within 72 hours. We say what we know at the time: what happened, the kinds and the approximate number of people and records concerned, the likely consequences, what we have done and will do about it, and whom to contact. What we do not know yet follows as soon as we do.

We take the steps we reasonably can to contain the breach and reduce its harm, and we keep a record of it. You decide whether to notify a supervisory authority or the people concerned about customer personal data, and we help you with the information we have. Telling you about a breach is not an admission of fault.

6 · Subprocessors

You give us a general authorisation to engage subprocessors. The kinds we use, and where each keeps the data, are in Annex 3. The named list, with the date each started, is in Settings, under Workspace, for the owners of a workspace, and anyone can ask for it at [email protected].

We tell the owners of every workspace by email at least 30 days before a new subprocessor starts to process customer personal data. You may object on reasonable data protection grounds by writing to support within that time. We will look for a way to meet the objection; if there is none, you may end the agreement by deleting your workspace before the change applies.

Every subprocessor is bound by a written contract that protects customer personal data at least as well as this agreement does. We remain responsible to you for the work of each subprocessor.

7 · Requests from data subjects

Most requests you can answer yourself in the product: export a workspace, correct what it holds, remove a subscriber, an alert destination or a team member, or delete the workspace. If someone asks us directly about customer personal data, we pass the request on to you without undue delay and do not answer it ourselves unless you ask us to. Where the product does not let you answer a request, we help you as far as we reasonably can.

8 · Impact assessments and consultation

If you carry out a data protection impact assessment, or consult a supervisory authority before processing, we give you the information you reasonably need about how we process customer personal data.

9 · International transfers

Customer personal data is stored in the European Union. Some subprocessors are companies outside it, and some processing happens outside it: single requests to one provider, and the checks you choose to run from the United States; Annex 3 says which. We transfer customer personal data out of the European Economic Area only under one of the safeguards in Annex 4.

10 · Deletion and return

You can export a workspace at any time from its settings, and we offer the export again before you delete it; that export is how we return the data to you. When you delete a workspace, everything in it stops at once and its data is removed seven days later; the seven days are there so a mistake can be undone. Copies in our backups expire within 35 days after that, so the data is fully gone within six weeks of the deletion.

When the agreement ends in any other way, we delete customer personal data in the same way, unless the law requires us to keep part of it. We do not store invoices; they are kept by our payment provider, as the seller, for as long as Bulgarian law requires.

11 · Audits

We give you the information you reasonably need to show that this agreement is kept. The first answer to an audit request is a security questionnaire, which we complete without charge once a year, and again after a breach that affects you or when a supervisory authority asks.

If the answers are not enough, you, or an independent auditor bound to confidentiality, may audit us on site at your cost, with 30 days' notice, during working hours, and no more than once a year unless a supervisory authority requires it or a breach has affected you. An audit never gives access to another customer's data, and for our subprocessors' premises we provide their own audit reports instead.

12 · Liability

Liability under this agreement follows the liability section of the terms, as if this agreement were written into them. Nothing here limits a liability to the people the data concerns that the law does not allow to be limited.

13 · Duration

This agreement lasts as long as we process customer personal data for you, and ends when the deletion in section 10 is complete. What must outlast it by its nature, such as confidentiality and deletion, does.

14 · Governing law

Bulgarian law applies to this agreement and the courts of Sofia have jurisdiction, as in the terms. The standard contractual clauses, where they apply, are governed as Annex 4 sets out.

15 · Changes and precedence

When this agreement changes, we tell you in the app or by email and date the new version. Because it is part of the terms, a material change asks you to accept the terms again. If this agreement and the terms disagree about personal data, this agreement wins; if the standard contractual clauses apply and disagree with either, the clauses win.

Annex 1 · Details of processing

• Subject and durationProviding the service, for as long as the workspace exists and until the deletion in section 10 is complete.
• Nature and purposeRunning checks and heartbeats, opening and explaining incidents, sending alerts, publishing status pages and emailing their subscribers, inviting team members, and answering support requests.
• People concernedYour team members and the people you invite, the people who receive your alerts, your status page subscribers, and anyone whose personal data appears in what you monitor or write.
• Special categoriesNone are intended. Do not put them into the service.
• FrequencyContinuous, while the workspace runs.

The kinds of customer personal data:

• Monitored addresses and their settings, including any headers or values you add to a check.
• Check results, incidents and their evidence, including a short excerpt of a failing response, and the explanations written from them.
• Notes and incident updates you write.
• Where alerts go: the email addresses and chat channel identifiers of your alert destinations.
• The email addresses of status page subscribers, and their confirmations.
• The names, email addresses and roles of team members, and the invitations sent to them.

Each is kept as long as the workspace keeps it, within the history period of its plan, and deleted as section 10 describes.

Annex 2 · Security measures

• Encryption: data is encrypted in transit on every connection we make or accept, and at rest, backups included.
• Access: only the people who run the service have access, each with their own account and a strong sign-in, and only to provide the service, answer support or fix a fault.
• Separation: every read and write of workspace data is limited to that workspace.
• Backups: the database is backed up every day, backups are kept for 35 days at most, and restoring them is practised regularly.
• Monitoring and logging: errors and failures on our side are reported to us as they happen, and operational logs are kept for 30 days.
• Minimisation: a check keeps only what an explanation needs, and an error report carries no content of the request.
• Deletion: on request and at the end of the service, as section 10 describes.
• Staff confidentiality: everyone with access is bound to confidentiality.
• Changes: every change is reviewed and tested before it is released.
• Incidents: a written procedure for personal data breaches, as section 5 describes.

Annex 3 · Subprocessors by kind

• Cloud hostingRuns the service, the database and its backups. A company in the European Union, part of a US group; the data is kept in the European Union. A check you choose to run from our location in the United States is made from there, and its result is stored in the European Union.
• Email deliverySends sign-in codes, alerts and status page emails. A US company; the emails are sent from the European Union.
• Edge network and bot protectionCarries traffic to the site and status pages, checks that a visitor is a person, and keeps a second, encrypted backup copy. A US company; data centres in the European Union.
• AI model providerReceives the evidence of one incident at a time to write its explanation, and does not train on it. A US company; each request is processed in the United States.
• Error trackingReceives reports of errors on our side, with a request reference and a path and no content. A US company; the data is kept in the European Union.
• Payments and invoicesSells the subscription and holds your billing details, as a controller of its own for the sale. A US company.
• Site measurementCounts visits to our public pages without cookies. An EU company; it handles no customer personal data.

The named list, with the date each started, is in Settings, under Workspace, for workspace owners, and on request at [email protected].

Annex 4 · International transfers

Where a subprocessor outside the European Economic Area is certified under the EU-US Data Privacy Framework, the transfer relies on the European Commission's adequacy decision for it. Otherwise it relies on the standard contractual clauses, which bind that subprocessor.

Where the standard contractual clauses are needed for a transfer between you and us, they are incorporated into this agreement by reference: Module 2 (controller to processor) where you are a controller, and Module 3 (processor to processor) where you are a processor. You are the data exporter and we are the data importer. In them, clause 7 applies; under clause 9, option 2 applies, with the notice of section 6; the optional wording of clause 11 does not apply; under clause 13, the supervisory authority is the one that clause names; under clauses 17 and 18, the law of Bulgaria applies and the courts of Bulgaria have jurisdiction. Annex 1 of this agreement is their Annex I.B, Annex 2 their Annex II and Annex 3 their Annex III.

For transfers under the UK GDPR, the UK Addendum to the standard contractual clauses, issued by the UK Information Commissioner, is incorporated in the same way, with the details above.

16 · Who provides Upglory

Upglory is provided by DEV GLORY LTD, which is your processor under this agreement. Write to [email protected] about this agreement, for a signed copy or for the named list of subprocessors, and to [email protected] to report a security issue. The company's address, register number and VAT number are in the legal notice.