Data Processing Agreement

1. Parties and scope

This Data Processing Agreement (“DPA”) is between the customer that holds an PingWise account (“Customer”, “you”) and Alexandros Kyrlis, a sole proprietorship trading as Netlayer, Eleftheriou Venizelou 31, 16675 Glyfada, Greece, General Commercial Registry no. 008078401000, VAT no. EL121157554 (“Netlayer”, “we”). It forms part of the Terms of Service and applies whenever we process personal data on your behalf in providing the Service.

It does not cover personal data for which we are the controller, such as your own account details, your billing data and our security logs. Those are described in our Privacy Policy.

Capitalised terms not defined here have the meaning given in Regulation (EU) 2016/679 (“GDPR”).

2. Details of the processing

3. Your obligations as controller

You are responsible for the lawfulness of the processing you instruct, including having a lawful basis, informing data subjects, and obtaining any consent needed (for example, status page subscribers must have asked for your notices). You will not instruct us to process data in breach of the law. You will keep your account secure and manage who has access to it.

4. Our obligations as processor

We will:

1. process personal data only on your documented instructions, which consist of the Terms, this DPA, and the settings you make in the Service, unless EU or member state law requires otherwise, in which case we will tell you before processing unless the law forbids it;
2. tell you immediately if we think an instruction breaches the GDPR or other data protection law;
3. ensure that every person we authorise to process personal data is bound by confidentiality;
4. implement the technical and organisational measures in Annex 1 and keep them at a level appropriate to the risk;
5. use sub-processors only as allowed in section 6;
6. help you, taking into account the nature of the processing, to respond to requests from data subjects (section 7);
7. help you meet your obligations under GDPR articles 32 to 36 (security, breach notification, impact assessments and prior consultation), taking into account the information available to us;
8. delete or return the personal data at the end of the Service (section 9);
9. make available the information needed to show compliance with GDPR article 28 and allow audits as described in section 8.

5. Security

We maintain the measures listed in Annex 1. We may update them as technology and threats change, provided the overall level of protection does not fall.

6. Sub-processors

You give us general authorisation to use the sub-processors listed in Annex 2. Each is bound by a written contract imposing data protection obligations equivalent to those in this DPA, and we remain responsible to you for their performance.

We will give you at least 30 days’ notice by email to the account owner before adding or replacing a sub-processor. If you object on reasonable data protection grounds and we cannot resolve the objection, you may terminate the Service, and we will refund unused bought credits. Adding a probe location with an existing provider in Annex 2 is not a new sub-processor, but we will keep the location list on this page current.

7. Data subject requests

If a data subject contacts us directly about data we process for you, we will refer them to you and will not respond on your behalf except to say that we are a processor, unless you instruct us otherwise. We will help you respond to requests through the tools in the Service (you can delete subscribers, users and content yourself) and, where those are not enough, through reasonable assistance from privacy@pingwise.com.

8. Audits and information

On written request, no more than once a year unless a supervisory authority requires it or a personal data breach has occurred, we will provide the information reasonably needed to demonstrate compliance with this DPA, including summaries of any third-party audit reports or certifications we hold. If that is not enough, you or an independent auditor bound by confidentiality may audit our relevant processing, on at least 30 days’ notice, during business hours, without disrupting the Service, and at your cost. Audits do not extend to other customers’ data or to our sub-processors’ premises; for those we rely on their own audit reports.

9. Personal data breaches

We will notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting your data, with the information we have at that time and updates as we learn more, so that you can meet your own obligations under GDPR articles 33 and 34.

10. Deletion and return

You can export your monitors and configuration from the Service at any time, and delete users, subscribers, content and the whole account yourself. When the account is deleted, or when you ask us to, we delete the personal data we process for you within 30 days, except what we must keep by law. Encrypted backups are overwritten within a further 90 days and are never used to restore deleted data except to recover from a failure.

11. International transfers

We process your data in the EU, except as described in Annex 2: probes outside the EEA see only the check traffic to the targets you designated and the results of those checks, and certain providers are based in the USA. For every transfer outside the EEA we rely on an adequacy decision of the European Commission or on the Commission’s Standard Contractual Clauses (Decision (EU) 2021/914) together with supplementary measures. Where the Standard Contractual Clauses apply between us and a sub-processor, they are available on request. If you are yourself outside the EEA and the Clauses must apply between you and us, module two (controller to processor) is incorporated into this DPA by reference, with you as data exporter and Netlayer as data importer, Greek law and courts as the governing law and forum, and Annexes 1 and 2 of this DPA as its annexes.

12. Liability, term and changes

Liability under this DPA is subject to the limits in the Terms of Service, to the extent the GDPR allows. This DPA lasts as long as the Terms and the deletion period after them. We may update this DPA to reflect changes in law or in the Service; the Terms’ rules on changes apply. If you need a signed copy, email privacy@pingwise.com and we will send one for countersignature.

Annex 1 · Technical and organisational measures

• Encryption in transit: TLS on every connection to the website, application, API, probe control channel and status pages; HSTS on our domains.
• Encryption at rest: integration credentials, two-factor secrets and backup archives are encrypted (backups with AES-256 before they leave the server); passwords are stored as salted hashes.
• Access control: production servers are administered over SSH with key-only authentication, rate limiting and automated blocking of repeated attempts; the staff area requires a staff account with two-factor authentication; staff access to customer data is limited to what support requires; two-factor authentication is available to every customer account and mandatory for staff.
• Tenant separation: every record is tied to an account; application-level checks prevent access across accounts; status page visitors never see monitor targets.
• Probe minimisation: probes hold no account data, receive only the check specification, return only results, and read at most a capped amount of a response.
• Availability: point-in-time database backups with continuous archiving, nightly logical backups, weekly automated restore tests, monitoring of the Service by itself and by an independent dead-man’s switch.
• Logging and detection: security-relevant actions are logged; probe health is checked continuously and anomalous probes are quarantined.
• Development: changes are version-controlled and reviewed; secrets are kept out of the code repository; dependencies are updated regularly.
• Incident response: a documented procedure for security incidents and breach notification, with the timeline in section 9.
• Deletion: deletion by the customer takes effect immediately in the application; backups roll over within 90 days.

Annex 2 · Sub-processors

Current as of 30 October 2026. Changes are announced by email at least 30 days in advance (section 6). InterServer, Melbicom and Akamai were added on 30 October 2026; the section 6 notice period for them runs until 29 November 2026, and account owners may object until then.

Destinations you choose, such as Telegram, Slack, Discord, SMS gateways or your own webhook endpoints, receive the alert content you configure. They act on your instructions, not ours, and are not sub-processors under this DPA.