Data Processing Agreement — up4

Version 2026-09-29-v4 · under Article 28 GDPR · including Annexes A and B

European core infrastructure: application and database in Germany; object storage, backups and email delivery service in France. International monitoring locations and other processing locations are governed by section 5 and Annex B.

1. Parties and application

The Contractor is wissmann media, proprietor Dennis Wissmann, Vennstr. 86, 40627 Düsseldorf, Germany, privacy@upfour.io (up4). The Customer is the person or organisation identified with its business address upon electronic acceptance. Acceptance by an authorised representative is recorded with the contract version, language and time; the agreement and acceptance record are downloadable. The language version selected upon acceptance is authoritative. This DPA prevails over the main agreement in matters of data protection. Individual data protection agreements are replaced only by express agreement.

up4 acts as a processor; where the Customer itself acts as a processor, up4 acts as a sub-processor. The Customer ensures its authority to engage up4 and is responsible for the lawfulness of its instructions. up4’s own account management, billing and statutory recordkeeping purposes are described in the privacy notice; they do not permit unrelated use of Customer Personal Data.

2. Subject matter and data scope

up4 processes personal data (Customer Personal Data) for the commissioned monitoring of internet services, incident diagnosis, notifications, status publication, collaboration and reporting, including necessary operations, support and backup activities. This involves collecting, retrieving, analysing, storing, transmitting, making available and deleting data. Processing continues throughout the commissioned use and until deletion is completed under section 8.

Data types: contact and user identifiers, roles and recipient addresses; monitoring targets, configurations and necessary credentials; connection and measurement data including IP addresses and timestamps; retrieved or supplied content including commissioned screenshots; incident, communication, status-page and report data.

Data subjects: employees and representatives of the Customer and its end customers, users and recipients of the services, and persons whose data appears in retrieved or supplied content. Data under Articles 9 or 10 GDPR is not intended for ordinary use; processing it requires prior agreement on scope and safeguards.

3. Instructions and changes

up4 processes Customer Personal Data, including for third-country transfers, solely on documented instructions. Instructions arise from this DPA, the commissioned service description, documented settings and communications from authorised contacts to privacy@upfour.io; urgent oral instructions are confirmed in text form. If up4 considers an instruction unlawful, it promptly informs the Customer and suspends the affected processing pending clarification. Processing required by Union or Member State law is notified in advance, unless that law prohibits notification on important grounds of public interest.

Changes to functions, monitoring regions, recipients or retention periods within the agreed scope may be made through documented selection or commissioning. New purposes or data types outside that scope require a supplementary agreement. Technical changes, such as to software or server numbers, do not require a new DPA as long as instructions and the level of protection are preserved. Section 5 applies to new providers and countries.

4. Confidentiality and security

up4 implements the measures under Article 32 GDPR set out in Annex A. Access is limited to authorised persons bound by statutory or contractual confidentiality, to the extent necessary for their tasks. Confidentiality continues after the agreement ends. Measures may be developed further with at least equivalent protection; material changes are documented and explained on request. The Customer protects its credentials and limits content and sharing to what its purposes require.

5. Providers and processing countries

The Customer grants general authorisation to engage sub-processors; the initial list is in Annex B. up4 assesses their sufficient guarantees, contractually imposes equivalent data protection obligations and remains responsible to the Customer for their performance of those obligations.

up4 notifies the contractual contact by email at least 14 calendar days before adding or replacing providers or processing in new countries, stating the provider, task, data, countries and, where applicable, transfer basis. The Customer may object on reasonable data protection grounds within 14 calendar days of receipt of the complete notice. Pending resolution, the disputed change is not implemented for the Customer. If no solution can be found, the Customer may terminate the affected service before the change without an additional termination fee. Without a timely objection, the notified change is permitted; earlier use requires express authorisation. Notified changes update Annex B without requiring a new DPA.

Additional monitoring locations with already authorised providers and in already authorised countries do not require a new agreement. For third-country transfers, including remote access, up4 ensures compliance with Chapter V GDPR through applicable adequacy decisions or appropriate safeguards, in particular standard contractual clauses, necessary transfer assessments and supplementary measures. A transfer does not take place without a lawful basis. Selecting a region alone does not fulfil these requirements.

6. Assistance and personal data breaches

up4 assists the Customer through appropriate technical and organisational measures with data subject rights under Chapter III and, taking account of the processing and available information, with the obligations under Articles 32–36 GDPR. Data subject requests received directly are forwarded without undue delay and answered only on instruction or where required by mandatory law. For agency engagements, the Customer forwards instructions and information to the responsible party in the chain.

up4 notifies the contractual contact by email without undue delay after becoming aware of a breach affecting Customer Personal Data, providing available details of its nature, scope, affected data and persons, consequences, countermeasures and contact point. Missing information follows without undue delay. up4 mitigates the consequences and documents the incident and measures taken.

7. Evidence and audits

up4 provides all information necessary to demonstrate compliance with Article 28 GDPR, allows audits including inspections by the Customer or its auditor, and contributes to them. Scope and timing are coordinated according to the circumstances while protecting other customers; urgent inspections and the powers of supervisory authorities remain unaffected. up4 keeps information on the actual processing chain, including names, addresses, contacts, tasks and countries, current and accessible. Contractual and transfer evidence is provided to the extent required.

8. Retention and deletion

Operational content is retained for the commissioned use unless earlier deletion is instructed. Measurement histories, reports and screenshots follow the retention periods specified when commissioned or different documented instructions. Where no specific period applies, data is retained for the duration of the commissioned use. A later change to a product page does not extend agreed periods; archiving does not restart them. Data is deleted or irreversibly anonymised when the period expires.

Notification diagnostics are generally retained for no more than 30 days and delivery records (status and metadata) for no more than 400 days, to the extent necessary to resolve delivery questions and document usage. For specific unresolved incidents, only the data necessary for clarification may be retained until resolution.

After the commissioned use ends or on corresponding instruction, up4 either returns Customer Personal Data in a commonly used electronic format and deletes existing copies, or deletes it directly, at the Customer’s choice. up4 offers this choice before irreversible deletion and implements it without undue delay, including data held by sub-processors. If the Customer makes no choice within 30 days of receiving the offer, up4 deletes the Customer Personal Data; the offer states this consequence. Statutory retention duties under Union or Member State law remain limited to what is necessary.

Backups created by up4 are ordinarily replaced within 14 days. During a recovery failure, the last reliable backup may be retained with restricted access only as long as necessary. Until expiry, backups are restricted from other uses; following a restore, deletions are reapplied before regular processing resumes. up4 confirms completion of deletion and states the reason and expected deletion date for remaining backups or statutory exceptions. Deletion records are retained only to preserve this effect. Deletion obligations continue after the agreement ends.

Annex A — Technical and organisational measures

• Access: Individual accounts, restricted roles, separate customer and administration access, logical tenant separation, revocable sessions and API credentials; multi-factor authentication available for customer accounts.
• Transmission: TLS for public application access and connections to external monitoring locations; internal services in private, access-restricted networks; authenticated, permission-restricted service access.
• Storage: Encrypted monitoring access passwords, custom monitoring headers and notification-channel secrets; separately access-protected keys. Private, server-side encrypted object storage; database backups additionally encrypted before upload. Content fields are not universally encrypted at application level.
• Data minimisation: Authorised access to content, reduced logs and standard notifications, secrets hidden in routine output; internal systems protected against unauthorised access through monitoring targets.
• Operations: Monitoring, daily backups and tested recovery procedures; automated retention cleanup and authorised access/deletion procedures. Security updates and vulnerabilities handled according to risk; regular and event-driven reviews of the effectiveness of measures.

Annex B — Providers and locations

Contracting provider	Task and Customer Personal Data concerned	Processing
Hetzner Online GmbH, Germany	Application, database, monitoring locations and support mailboxes; Customer Personal Data processed there	Germany
Scaleway S.A.S., France	Object storage, backups and email delivery; stored Customer Personal Data, messages and delivery data	Paris, France; further sub-processors listed below
Ploi B.V., Netherlands	Server management; infrastructure details and administrative system access	Management platform in the Netherlands; managed systems at their respective locations
UpCloud Oy, Finland	Additional monitoring locations; assigned checks including necessary credentials, temporarily retrieved content and results	According to the commissioned monitoring region; Germany, USA, Singapore and Australia, with support/maintenance also in the United Kingdom

Depending on the region used, UpCloud USA Inc., UpCloud Asia Pte. Ltd., UpCloud Asia Pacific Pty Ltd. and, for support/maintenance, UpCloud UK Ltd. form part of the further processing chain. For transfers without an adequacy decision, the UpCloud DPA provides for standard contractual clauses. Further sub-processors used by Scaleway for the services concerned and their locations are set out in Scaleway’s sub-processor list. The actual processing chain under section 7 remains authoritative; changes to provider websites do not replace notification under section 5.

A provider’s purely own purposes, such as its contractual emails to up4, are outside the processing chain for Customer Personal Data. Where Customer Personal Data is processed in support or administration chains, sections 5–7 apply. Recipients and notification services selected by the Customer are contacted on its instructions; the Customer is responsible for their further processing.