This data processing agreement ("DPA") is part of the agreement between the customer that uses Spectate ("Controller", "you") and Fjordlane Holding B.V., trading as Spectate, Guido Gezellestraat 43, 3351 CL Papendrecht, the Netherlands, registered with the Dutch Chamber of Commerce (KvK) under number 99322439 ("Processor", "Spectate", "we"). It applies automatically when you accept our Terms of service and whenever we process personal data on your behalf. You do not need to sign it. If you want a signed copy for your records, email privacy@spectate.net.

If you and we have signed a separate data processing agreement for the same processing, that agreement applies instead, where the two differ.

1. Definitions

1.1. Words such as personal data, processing, controller, processor, data subject, personal data breach and supervisory authority have the meaning they have in the General Data Protection Regulation (EU) 2016/679 ("GDPR").

1.2. In this DPA:

Agreement means the Terms of service and the other documents that are part of it;
Customer Personal Data means personal data that we process on your behalf when we provide the Service;
Data Protection Law means the GDPR, the Dutch GDPR Implementation Act (Uitvoeringswet AVG) and other EU or member state law on the protection of personal data that applies to the processing;
Service has the meaning given in the Terms of service;
Subprocessor means a third party we engage to process Customer Personal Data.

2. Roles and scope

2.1. You are the controller of Customer Personal Data. You decide why it is processed and the essential means. We are the processor. If you are yourself a processor for someone else, we are your subprocessor, and you confirm that you may engage us.

2.2. This DPA does not cover personal data we process for our own purposes as controller, such as Account details of your users, billing records and support conversations. Our Privacy policy covers that.

2.3. Vatly B.V. sells the Service to you as our reseller and merchant of record, and Mollie processes payments for Vatly. They process billing data as independent controllers. They do not receive Customer Personal Data and are not Subprocessors.

3. Details of the processing

Item	Details
Subject matter	Providing the Spectate monitoring, alerting, on-call, incident management and status page service.
Duration	The term of the Agreement, and after that until the data is deleted as described in section 11.
Nature of processing	Collecting, receiving, storing, organising, analysing, displaying, publishing (on status pages, as you configure), sending (by email, SMS, phone call, chat integrations and webhooks), backing up, exporting and deleting.
Purposes	Running checks on the targets you set up and storing the results; collecting host metrics; receiving events from alert sources; creating and escalating alerts; notifying the people and channels you choose; on-call schedules; incidents, timelines and postmortems; hosting status pages and emailing their subscribers; support at your request; keeping the Service secure and available.
Data subjects	Your users and team members; on-call people and other alert recipients; people named in incidents, postmortems, alert sources or monitor settings; status page subscribers and visitors; people who report a problem on a status page; people whose data appears in content we check for you (for example in a monitored web page, response body or screenshot).
Categories of personal data	Names, email addresses, phone numbers and chat user IDs of alert recipients and on-call people; on-call schedules; who acknowledged or resolved an alert; incident and postmortem content; monitored URLs, host names, IP addresses and settings, including credentials for checks; check results, and the responses and screenshots of failed checks; host metrics; alert source payloads; status page content, subscribers and visitor reports; any other personal data you put into the Service.
Special categories	Not required by the Service. You should not put special categories of personal data or criminal data into the Service.
Frequency	Continuous, as configured by you.
Retention during the term	As set out in our Privacy policy, section 7. Other data is kept until you delete it or the Team is deleted.
Location	See section 8.

4. Your instructions

4.1. We process Customer Personal Data only on your documented instructions. Your instructions are this DPA, the Agreement, and how you configure and use the Service, including the monitors, channels, escalation paths, status pages and integrations you set up. Further instructions must be in writing and fit the Service.

4.2. We may process Customer Personal Data without an instruction only if EU or member state law requires it. In that case we tell you first, unless that law forbids it.

4.3. We tell you right away if we think an instruction breaks Data Protection Law. We may then pause that instruction until you confirm or change it.

4.4. You are responsible for the lawfulness of the processing. In particular, you make sure that you have a legal basis to add alert recipients, on-call people and subscribers, that you inform them where required, and that the targets you monitor are yours or you may monitor them.

4.5. When you choose to send data to a destination outside our control, such as a Slack workspace, a Microsoft Teams or Discord channel, a Telegram chat, Pushover, Intercom, a webhook URL or a phone number in another country, that destination is chosen by you. It is not our Subprocessor. You are responsible for that transfer being lawful.

5. Our obligations

5.1. We only use Customer Personal Data to provide, secure and support the Service. We do not sell it, use it for advertising or profiling, or use it to train artificial intelligence models.

5.2. Everyone who works for us and can access Customer Personal Data is bound to confidentiality, gets access only as far as needed for their work, and is instructed on data protection and security.

5.3. Our staff access Customer Personal Data only when needed: to provide support you asked for, to fix a problem, to investigate abuse or a security issue, or when the law requires it. Such access is logged.

5.4. If an authority asks us for Customer Personal Data, we check whether the request is lawful, tell you before we give anything (unless the law forbids that), and give no more than required.

5.5. We tell you without undue delay if we can no longer meet this DPA.

6. Security

6.1. We take appropriate technical and organisational measures to protect Customer Personal Data, taking into account the state of the art, the costs, the nature of the processing and the risks for data subjects (Article 32 GDPR). The main measures are listed in Annex 1.

6.2. We may change these measures over time, as long as the overall level of protection does not go down.

7. Subprocessors

7.1. You give us general permission to use Subprocessors. The current list is on our Subprocessors page.

7.2. We tell you at least 30 days before a new Subprocessor starts processing Customer Personal Data, or before we replace one. We do this by email to the owners of your Team, or in the dashboard, and we update the Subprocessors page.

7.3. You can object to a new Subprocessor within those 30 days on reasonable grounds related to data protection, by emailing privacy@spectate.net. We will then discuss a solution in good faith. If we cannot find one, you may end the Agreement before the new Subprocessor starts, and we refund the part of a prepaid period after the end date. If you do not object within 30 days, you accept the change.

7.4. We make written agreements with each Subprocessor that give at least the same protection as this DPA. We remain responsible to you for our Subprocessors.

7.5. In an emergency, for example when a Subprocessor suddenly stops working and the Service is at risk, we may replace it sooner. We then tell you as soon as possible, and you keep your right to object.

8. Where we process data

8.1. We store Customer Personal Data in the European Union, at Hetzner in Germany. This includes the databases, file storage and backups.

8.2. Checks run from the regions you choose per monitor, on our checkers in Amsterdam, New York, Singapore and Sydney (servers of UpCloud). A checker outside the EU only receives the monitors that use its region, sends the results to our servers in Germany and keeps no copy.

8.3. We transfer Customer Personal Data outside the European Economic Area only if Chapter V GDPR allows it, for example based on an adequacy decision or the Standard Contractual Clauses of the European Commission, with extra measures where needed. The Subprocessors page shows where each Subprocessor processes data.

9. Helping you

9.1. If a data subject contacts us about Customer Personal Data, we forward the request to you without undue delay and do not answer it ourselves, unless you ask us to.

9.2. You can view, change and delete most Customer Personal Data yourself in the dashboard. Where that is not enough, we help you answer data subject requests.

9.3. We give you the information you reasonably need for a data protection impact assessment or a prior consultation with a supervisory authority about the Service.

9.4. If help goes far beyond the normal Service and is not caused by our own breach, we may charge a reasonable fee that we agree with you first.

10. Personal data breaches

10.1. We notify you without undue delay, and in any case within 48 hours after we become aware of a personal data breach that affects Customer Personal Data.

10.2. We send the notice to the owners of your Team by email. As far as we know at that moment, it describes what happened, which data and roughly how many data subjects are affected, the likely consequences, what we did and will do about it, and who you can contact. If we do not know everything yet, we send what we know and add the rest as soon as possible.

10.3. We take reasonable steps right away to stop the breach, limit its effects and prevent it from happening again. We help you meet your own obligations to notify the supervisory authority and data subjects. We do not notify them on your behalf unless you ask us to or the law requires it.

11. Deletion and return

11.1. You can delete Customer Personal Data in the dashboard at any time. Data that we keep for a limited period (section 3) is deleted automatically when that period ends.

11.2. When an owner deletes a Team, an owner can still restore it for 7 days. After that we permanently delete the Team and all its Customer Personal Data from our active systems.

11.3. When the Agreement ends because a Team has no paid Plan, the Team is paused, scheduled for deletion after 90 days and deleted 14 days later, as described in the Terms of service. You can ask for an export before the deletion date (section 11.4).

11.4. Before deletion, you can ask us to return Customer Personal Data in a common, machine-readable format by emailing help@spectate.net.

11.5. Copies in backups are deleted when those backups expire, within 14 days. Until then, they are protected as described in Annex 1 and are only used to recover from a disaster. If we restore a backup, we delete the data again.

11.6. If EU or member state law requires us to keep some data, we keep only that data, protect it and stop using it for anything else. On request, we confirm in writing that deletion is complete.

12. Information and audits

12.1. We give you the information you need to show that we meet Article 28 GDPR. This includes this DPA, our Security page and written answers to reasonable questions.

12.2. If that information is not enough, or a supervisory authority requires it, you may have our processing of Customer Personal Data audited by an independent auditor bound to confidentiality, at most once a year. You give us at least 30 days' notice. The audit takes place during working hours, must not disrupt the Service and must respect the confidentiality and security of other customers' data. You pay the costs of the audit.

13. Liability

13.1. The liability rules of the Terms of service apply to this DPA, as far as Data Protection Law allows. Nothing in this DPA limits the rights of data subjects or the powers of supervisory authorities.

14. Term and changes

14.1. This DPA applies as long as we process Customer Personal Data for you. Sections that by their nature should continue, such as confidentiality and deletion, continue after the Agreement ends.

14.2. We may change this DPA, for example when the law or the Service changes. We tell you about changes that matter at least 30 days before they take effect. If you do not agree, you may end the Agreement before the change takes effect.

14.3. Dutch law applies to this DPA. Disputes are decided by the District Court of Rotterdam (Rechtbank Rotterdam), the Netherlands, unless mandatory law says otherwise.

Annex 1: Technical and organisational measures

Hosting

Customer Personal Data is stored at Hetzner in Germany, in ISO 27001-certified data centres.
Our servers talk to each other over a private network. Checkers connect over the internet, encrypted and with their own credentials.
Backups are kept for 14 days and deleted automatically after that.

Encryption

All traffic to the dashboard, API and status pages uses HTTPS.
Sensitive values, such as credentials in monitor settings, notification channel settings, integration tokens and two-factor secrets, are also encrypted in the database by the application.
Passwords are stored as bcrypt hashes.

Access control

Email verification is required, two-factor authentication is available for every user, and sign-in and other sensitive endpoints are rate limited.
Access within a Team is based on roles.
Users get an email when their password, email address or two-factor settings change.

Staff access

Our back office is only reachable from our private network, with separate staff accounts.
Staff only access Customer Personal Data when needed for support, to fix a problem or to investigate abuse. Every action in the back office, and every request made while viewing the Service as a user, is logged.

Application security

Checks, webhooks and screenshots cannot reach private or internal networks.
Every change goes through automated tests and static analysis before it is deployed.

Data minimisation

Measurements are rolled up and deleted on a fixed schedule (see section 3).
Status page views are counted and visitor reports are stored without IP addresses. Subscriptions use double opt-in.

Incident response

Errors and failed scheduled jobs alert us automatically.
We notify customers of a personal data breach within 48 hours (section 10). Vulnerabilities can be reported under our Responsible disclosure policy.