Data processing agreement (GDPR Article 28)

This agreement applies when [Company name] (the "processor") processes personal data on behalf of the customer (the "controller") as part of the StatusGuard service.

1. Subject matter, duration, nature and purpose

Hosting and running the monitoring of the customer's resources (websites, APIs, certificates), managing the space's user accounts and status pages, for the duration of the contract.

2. Categories of data and data subjects

Space users (email, name, role, sign-in logs); data that may be contained in the monitored resources or in notifications configured by the customer.

3. Processor obligations

• process data only on documented instructions from the customer;
• ensure that persons authorised to process the data are bound by confidentiality;
• implement the security measures of Article 32 (encryption in transit and of secrets, isolation of each space in its own container and volume, private network for the database, backups, access control with two-factor authentication, logging);
• engage a sub-processor only after informing the customer in advance (list: sub-processors), under the same obligations;
• assist the customer in responding to data subject requests (self-service export and deletion);
• notify any personal data breach without undue delay and no later than 48 hours after becoming aware of it;
• at the end of the contract, delete the data (30-day grace period) after allowing its export;
• make available the information necessary to demonstrate compliance with this agreement and allow reasonable audits.

4. Location

Data is hosted in the European Union (Microsoft Azure, France Central region). No transfer outside the EU takes place without appropriate safeguards (standard contractual clauses).

5. Contact

[GDPR contact / DPO]

Version 2026-10 — publisher: [Company name].