Data Processing Agreement

Parties

This Data Processing Agreement ("DPA") is entered into between the business customer that has accepted the MonitorBase Terms of Service ("Customer") and Sjøbeck Digital, a Danish sole proprietorship (CVR no. 34358702, VAT DK34358702, Høsten Teglværksvej 23, 4690 Haslev, Denmark, tel. +45 53 50 08 98), trading as MonitorBase ("MonitorBase").

1. Scope

1.1 This DPA forms part of the Terms of Service (clause 7.2) and applies when MonitorBase processes personal data on behalf of the Customer. It does not apply to consumers.

1.2 In case of conflict between this DPA and the Terms regarding the processing of personal data, this DPA prevails.

1.3 Terms defined in Regulation (EU) 2016/679 ("GDPR") have the same meaning in this DPA.

2. Roles

2.1 The Customer is the controller and MonitorBase is the processor of the personal data described in Annex 1.

2.2 Where the Customer processes the personal data as a processor on behalf of its own client, the Customer warrants that its client has authorised the Customer’s instructions under this DPA, including the use of MonitorBase and the sub-processors in Annex 3. MonitorBase then acts as the Customer’s sub-processor on the terms of this DPA (GDPR Art. 28(4)), takes instructions only from the Customer and assists the Customer’s client through the Customer, unless the Customer has ceased to exist in law.

2.3 The Customer is responsible for the lawfulness of the processing, including the legal basis for it and the information provided to data subjects, and for the lawfulness of its instructions.

3. Instructions

3.1 MonitorBase processes the personal data only on documented instructions from the Customer, including with regard to transfers to third countries, unless required to do so by EU or Member State law; in that case MonitorBase informs the Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

3.2 The Customer’s documented instructions are the Terms, this DPA and the Customer’s configuration and use of the service.

3.3 MonitorBase informs the Customer immediately if, in its opinion, an instruction infringes data protection law.

3.4 Sending-source directory. The Customer agrees that MonitorBase may use the IP addresses, host names and sending domains of sending servers contained in reports to maintain a directory of sending services used across the service. This use falls outside clauses 3.1 and 3.2: MonitorBase processes that data as an independent controller, retains it for 365 days after a source was last seen and does not use it to identify individuals.

4. Confidentiality

MonitorBase ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

5. Security

MonitorBase implements the technical and organisational measures in Annex 2 in accordance with GDPR Art. 32. MonitorBase may update the measures provided the overall level of protection is not reduced.

6. Sub-processors

6.1 The Customer gives general written authorisation to the sub-processors listed in Annex 3.

6.2 MonitorBase notifies the Customer by email at least 14 days before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds within that period by writing to christian@monitorbase.eu. If the objection cannot be resolved, the Customer may terminate the service and receives a pro-rata refund of prepaid fees for the unused period.

6.3 MonitorBase imposes the same data protection obligations as set out in this DPA on each sub-processor by written contract and remains fully liable to the Customer for the performance of the sub-processor’s obligations.

7. Assistance

7.1 Taking into account the nature of the processing, MonitorBase assists the Customer by appropriate technical and organisational measures in fulfilling the Customer’s obligation to respond to requests from data subjects. MonitorBase forwards any such request it receives to the Customer without undue delay and within 5 business days.

7.2 MonitorBase assists the Customer in ensuring compliance with GDPR Arts. 32–36, taking into account the nature of the processing and the information available to MonitorBase.

8. Personal data breaches

8.1 MonitorBase notifies the Customer without undue delay and in any event within 24 hours after becoming aware of a personal data breach affecting the Customer’s personal data.

8.2 The notification contains the information required by GDPR Art. 33(3) to the extent available. Information not available at first is provided in phases without undue delay.

9. Deletion and return

9.1 The Customer can export its data from the service until the account is deleted.

9.2 When the Customer deletes its account, and in any event no later than 30 days after termination of the agreement under clause 5 of the Terms, MonitorBase deletes the Customer’s personal data, unless EU or Member State law requires storage. Copies in backups are deleted no later than 66 days after the deletion and are not restored except to recover from a disaster, in which case the deletion is re-applied.

9.3 On request, MonitorBase confirms the deletion in writing.

10. Information and audits

10.1 MonitorBase makes available to the Customer all information necessary to demonstrate compliance with GDPR Art. 28, including answers to a reasonable written security questionnaire once per 12 months.

10.2 Where that is not sufficient, the Customer or an independent auditor bound by confidentiality may carry out an audit, including an inspection, with at least 30 days’ written notice, during normal business hours and at the Customer’s cost. Audits by a supervisory authority are not subject to these limitations.

11. Transfers to third countries

MonitorBase does not transfer the Customer’s personal data outside the EU/EEA, except to Switzerland on the basis of an adequacy decision as stated in Annex 3. Any other transfer requires notice under clause 6 and a transfer mechanism under GDPR Chapter V.

12. Liability, term, changes and governing law

12.1 The limitation of liability for business customers in the Terms (clause 10.2) applies to this DPA, to the extent permitted by law.

12.2 This DPA applies for as long as MonitorBase processes personal data on behalf of the Customer.

12.3 MonitorBase may amend this DPA with at least 30 days’ notice by email (14 days for sub-processor changes under clause 6). An amendment may not reduce the protection of the Customer’s personal data.

12.4 This DPA is governed by Danish law. Disputes are settled as set out in the Terms (clause 12).

Annex 1 — Description of the processing

• Subject matter and purpose: monitoring of email authentication and TLS for the Customer’s domains (or its clients’ domains).
• Nature of the processing: reception, analysis, minimisation, storage, display, alerting, export and deletion of reports and monitoring results.
• Duration: the term of the agreement. Retention within the term follows the Privacy Policy, section 5.
• Categories of data subjects: persons responsible for sending servers or sending email that appears in DMARC and TLS-RPT reports; senders and recipients of individual messages in failure reports; persons identifiable from DNS records of monitored domains; contact persons of the Customer’s clients entered for their branding.
• Types of personal data: IP addresses and host names of sending servers; message counts and authentication results; in failure reports, selected header fields with recipient addresses reduced to the domain and sender addresses masked to the first character without display names (subject line only if enabled by the Customer; message content never stored); DNS records; names of the Customer’s clients and contact details entered for their branding.
• Special categories of personal data: none intended.

Annex 2 — Technical and organisational measures

• Encryption of all traffic in transit (TLS).
• Signed webhooks for inbound reports; per-domain ingest tokens.
• Separation of each customer’s data in the application; role-based team access; API keys stored as hashes with read or write scope and optional limitation to one client.
• Passwords stored as hashes; two-factor authentication available; re-authentication required for account deletion.
• Data minimisation of failure reports as described in Annex 1.
• Automatic daily deletion according to the retention periods.
• Daily backups to object storage in France, uploaded with dedicated credentials limited to object storage; continuous availability monitoring.
• Infrastructure defined as code; changes tested in a separate environment.
• Administrative access limited to authorised personnel bound by confidentiality.
• Documented procedure for handling personal data breaches.
• Physical security provided by the hosting provider’s data centres in France.

Annex 3 — Sub-processors