Data Processing Agreement

1. Definitions

• "Controller" means the customer who determines the purposes and means of processing personal data
• "Processor" means Flare Warden LLC, which processes personal data on behalf of the Controller
• "Personal Data" means any information relating to an identified or identifiable natural person
• "Processing" means any operation performed on personal data, including collection, storage, use, and deletion
• "Sub-processor" means any third party engaged by the Processor to process personal data
• "Data Subject" means an individual whose personal data is processed

2. Scope and Purpose of Processing

The Processor processes personal data solely for the purpose of providing website monitoring services to the Controller, including:

• Account and user management
• Website and service monitoring
• Incident notification and alerting
• Status page subscriber management
• Audit logging and compliance

3. Categories of Personal Data

The following categories of personal data may be processed:

4. Controller Obligations

The Controller agrees to:

• Ensure a lawful basis exists for processing personal data
• Provide accurate and complete data to the Processor
• Obtain necessary consents from data subjects where required
• Comply with applicable data protection laws
• Notify the Processor of any data subject requests

5. Processor Obligations

FlareWarden agrees to:

• Process personal data only on documented instructions from the Controller
• Ensure personnel are bound by confidentiality obligations
• Implement appropriate technical and organizational security measures
• Assist the Controller in responding to data subject requests
• Assist with data protection impact assessments when required
• Delete or return personal data upon termination of services
• Make available information necessary to demonstrate compliance, as described in Section 12

6. Sub-processors

The Controller authorizes the Processor to engage the following sub-processors:

The Processor will notify the Controller of any intended changes to sub-processors, giving the Controller an opportunity to object.

7. International Data Transfers

Personal data may be transferred to and processed in:

• United States
• European Union
• Asia-Pacific region

For transfers outside the European Economic Area, the Processor ensures appropriate safeguards are in place, including Standard Contractual Clauses where applicable.

8. Security Measures

The Processor implements appropriate security measures including:

• Encryption of data in transit (TLS 1.2+)
• Secure password hashing (bcrypt)
• Access controls and role-based permissions
• Rate limiting on sign-in, sign-up, password reset and password changes
• Protection against SQL injection, cross-site request forgery and server-side request forgery
• Audit logging of account activity
• Incident response procedures

For more details, see our Security page.

9. Data Subject Rights

The Processor will assist the Controller in responding to data subject requests, including:

• Right of access
• Right to rectification
• Right to erasure
• Right to restrict processing
• Right to data portability
• Right to object

If the Processor receives a request directly from a data subject, it will promptly notify the Controller unless prohibited by law.

10. Data Breach Notification

The Processor will notify the Controller without undue delay upon becoming aware of a personal data breach. The notification will include the nature of the breach, categories of data affected, likely consequences, and measures taken to address the breach.

11. Data Retention and Deletion

Upon termination of the agreement:

• The Controller may export their data before account deletion
• Upon account deletion, all personal data will be permanently deleted
• Deletion is immediate for account data and monitors
• Backups are purged within 30 days

12. Audits and Compliance Information

The Processor holds no third-party security certifications and has not undergone a third-party security or compliance audit, as stated on its Security page, so it has no certification or audit reports to provide. To demonstrate its compliance with this DPA, the Processor will make available, on the Controller's written request to support@flarewarden.com:

• The Security page, which describes the measures in Section 8
• The current list of sub-processors in Section 6
• Written answers, within a reasonable time, to the Controller's reasonable questions about the Processor's processing of Personal Data and its security measures, including a reasonable security questionnaire

Where that information is not sufficient to demonstrate compliance with this DPA, or where applicable data protection law or a supervisory authority requires it, the Controller may audit the Processor's compliance with this DPA, itself or through an independent auditor bound by confidentiality obligations. The Controller will give at least 30 days' written notice with the proposed scope. Audits are limited to one in any twelve-month period, unless a supervisory authority requires otherwise or the audit follows a personal data breach affecting the Controller's data. Audits are carried out at the Controller's expense, without access to other customers' data, and without unreasonably disrupting the Processor's operations.

Personal Data is hosted on the infrastructure of the sub-processors listed in Section 6, and the Processor cannot grant access to their facilities. Audits are therefore carried out remotely, by review of documents and interviews, unless applicable data protection law or a supervisory authority requires an on-site inspection, in which case the parties will agree a reasonable time, place and scope in advance.

13. Term and Termination

This DPA remains in effect for the duration of the Controller's use of FlareWarden services. The obligations relating to confidentiality and data protection survive termination.

14. Liability

Each party is liable for damages caused by processing that violates applicable data protection laws. The Processor is liable for damages caused by processing that does not comply with this DPA or the Controller's lawful instructions.

Liability Cap: Each party's liability under this DPA is subject to the limitations set forth in the Terms of Service. The Processor's total aggregate liability for all claims arising under this DPA shall not exceed the amount paid by the Controller to the Processor in the twelve (12) months preceding the claim giving rise to liability.

Exclusions: Neither party excludes or limits liability for: (a) death or personal injury caused by negligence; (b) fraud or fraudulent misrepresentation; (c) breach of obligations regarding confidentiality of personal data; or (d) any other liability that cannot be excluded by applicable law.

15. Contact

For questions about this DPA or data protection matters:

Flare Warden LLC
PMB 128, 9801 Fall Creek Rd
Indianapolis, IN 46256, USA
Email: support@flarewarden.com