# Data Processing Agreement — up4

Version 2026-09-29-v4 · under Article 28 GDPR · including Annexes A and B

**European core infrastructure:** application and database in Germany;
object storage, backups and email delivery service in France.
International monitoring locations and other processing locations are governed
by section 5 and Annex B.

## 1. Parties and application

The Contractor is wissmann media, proprietor Dennis Wissmann, Vennstr. 86,
40627 Düsseldorf, Germany, privacy@upfour.io (up4). The Customer is the person
or organisation identified with its business address upon electronic acceptance.
Acceptance by an authorised representative is recorded with the contract
version, language and time; the agreement and acceptance record are downloadable.
The language version selected upon acceptance is authoritative.
This DPA prevails over the main agreement in matters of data protection.
Individual data protection agreements are replaced only by express agreement.

up4 acts as a processor; where the Customer itself acts as a processor,
up4 acts as a sub-processor. The
Customer ensures its authority to engage up4 and is responsible for the lawfulness
of its instructions. up4's own account management, billing and statutory
recordkeeping purposes are described in the privacy notice; they do not permit
unrelated use of Customer Personal Data.

## 2. Subject matter and data scope

up4 processes personal data (Customer Personal Data) for the commissioned monitoring of internet services,
incident diagnosis, notifications, status publication, collaboration and reporting,
including necessary operations, support and backup activities. This involves collecting, retrieving, analysing, storing, transmitting,
making available and deleting data. Processing continues throughout the
commissioned use and until deletion is completed under section 8.

**Data types:** contact and user identifiers, roles and recipient addresses;
monitoring targets, configurations and necessary credentials; connection and
measurement data including IP addresses and timestamps; retrieved or supplied
content including commissioned screenshots; incident, communication, status-page
and report data.

**Data subjects:** employees and representatives of the Customer and its end
customers, users and recipients of the services, and persons whose data appears
in retrieved or supplied content. Data under Articles 9 or 10 GDPR is not intended
for ordinary use; processing it requires prior agreement on scope and safeguards.

## 3. Instructions and changes

up4 processes Customer Personal Data, including for third-country transfers,
solely on documented instructions.
Instructions arise from this DPA, the commissioned service description,
documented settings and communications from authorised contacts to
privacy@upfour.io; urgent oral instructions are confirmed in text form.
If up4 considers an instruction unlawful, it promptly informs the Customer and
suspends the affected processing pending clarification. Processing required by
Union or Member State law is notified in advance, unless that law prohibits
notification on important grounds of public interest.

Changes to functions, monitoring regions, recipients or retention periods within
the agreed scope may be made through documented selection or commissioning.
New purposes or data types outside that scope require a supplementary agreement.
Technical changes, such as to software or server numbers, do not require a new
DPA as long as instructions and the level of protection are preserved. Section 5
applies to new providers and countries.

## 4. Confidentiality and security

up4 implements the measures under Article 32 GDPR set out in Annex A. Access is
limited to authorised persons bound by statutory or contractual confidentiality,
to the extent necessary for their tasks. Confidentiality continues after the
agreement ends. Measures may be developed further with at least equivalent
protection; material changes are documented and explained on request. The
Customer protects its credentials and limits content and sharing to what its
purposes require.

## 5. Providers and processing countries

The Customer grants general authorisation to engage sub-processors; the initial
list is in Annex B. up4 assesses their sufficient guarantees, contractually imposes equivalent
data protection obligations and remains responsible to the Customer for their
performance of those obligations.

up4 notifies the contractual contact by email at least 14 calendar days before
adding or replacing providers or processing in new countries, stating the
provider, task, data, countries and, where applicable, transfer basis.
The Customer may object on reasonable data protection grounds within 14 calendar
days of receipt of the complete notice. Pending resolution, the disputed change
is not implemented for the Customer. If no solution can be found, the Customer may terminate the
affected service before the change without an additional termination fee.
Without a timely objection, the notified change is permitted; earlier use requires
express authorisation. Notified changes update Annex B without requiring a new DPA.

Additional monitoring locations with already authorised providers and in already
authorised countries do not require a new agreement. For third-country transfers,
including remote access, up4 ensures compliance with Chapter V GDPR through
applicable adequacy decisions or appropriate safeguards, in particular standard
contractual clauses, necessary transfer assessments and supplementary measures.
A transfer does not take place without a lawful basis. Selecting a region alone
does not fulfil these requirements.

## 6. Assistance and personal data breaches

up4 assists the Customer through appropriate technical and organisational
measures with data subject rights under Chapter III and, taking account of the
processing and available information, with the obligations under Articles 32–36
GDPR. Data subject requests received directly are forwarded without undue delay
and answered only on instruction or where required by mandatory law. For agency
engagements, the Customer forwards instructions and information to the responsible
party in the chain.

up4 notifies the contractual contact by email without undue delay after becoming
aware of a breach affecting Customer Personal Data, providing available details
of its nature, scope, affected data and persons, consequences, countermeasures
and contact point. Missing information follows without undue delay. up4 mitigates
the consequences and documents the incident and measures taken.

## 7. Evidence and audits

up4 provides all information necessary to demonstrate compliance with Article 28
GDPR, allows audits including inspections by the Customer or its auditor, and
contributes to them. Scope and timing are coordinated according to the
circumstances while protecting other customers; urgent inspections and the powers
of supervisory authorities remain unaffected. up4 keeps information on the actual
processing chain, including names, addresses, contacts, tasks and countries,
current and accessible. Contractual and transfer evidence is provided to the
extent required.

## 8. Retention and deletion

Operational content is retained for the commissioned use unless earlier deletion
is instructed. Measurement histories, reports and screenshots follow the retention
periods specified when commissioned or different documented instructions.
Where no specific period applies, data is retained for the duration of the
commissioned use. A later change to a product page does not extend agreed periods;
archiving does not restart them. Data is deleted or irreversibly anonymised when
the period expires.

Notification diagnostics are generally retained for no more than 30 days and
delivery records (status and metadata) for no more than 400 days, to the extent necessary to resolve
delivery questions and document usage. For specific unresolved incidents, only
the data necessary for clarification may be retained until resolution.

After the commissioned use ends or on corresponding instruction, up4 either
returns Customer Personal Data in a commonly
used electronic format and deletes existing copies, or deletes it directly, at
the Customer's choice. up4 offers this choice before irreversible deletion and
implements it without undue delay, including data held by sub-processors.
If the Customer makes no choice within 30 days of receiving the offer, up4 deletes
the Customer Personal Data; the offer states this consequence. Statutory retention duties under Union or Member State law remain limited to
what is necessary.

Backups created by up4 are ordinarily replaced within 14 days. During a recovery failure, the
last reliable backup may be retained with restricted access only as long as
necessary. Until expiry, backups are restricted from other uses; following a
restore, deletions are reapplied before regular processing resumes. up4 confirms
completion of deletion and states the reason and expected deletion date for
remaining backups or statutory exceptions. Deletion records are retained only
to preserve this effect. Deletion obligations continue after the agreement ends.

## Annex A — Technical and organisational measures

- **Access:** Individual accounts, restricted roles, separate customer and
  administration access, logical tenant separation, revocable sessions and
  API credentials; multi-factor authentication available for customer accounts.
- **Transmission:** TLS for public application access and connections to
  external monitoring locations; internal services in private, access-restricted
  networks; authenticated, permission-restricted service access.
- **Storage:** Encrypted monitoring access passwords, custom monitoring headers and
  notification-channel secrets; separately access-protected keys. Private,
  server-side encrypted object storage; database backups additionally encrypted
  before upload. Content fields are not universally encrypted at application level.
- **Data minimisation:** Authorised access to content, reduced logs and standard
  notifications, secrets hidden in routine output; internal systems protected
  against unauthorised access through monitoring targets.
- **Operations:** Monitoring, daily backups and tested recovery procedures;
  automated retention cleanup and authorised access/deletion procedures.
  Security updates and vulnerabilities handled according to risk; regular and
  event-driven reviews of the effectiveness of measures.

## Annex B — Providers and locations

| Contracting provider | Task and Customer Personal Data concerned | Processing |
|---|---|---|
| Hetzner Online GmbH, Germany | Application, database, monitoring locations and support mailboxes; Customer Personal Data processed there | Germany |
| Scaleway S.A.S., France | Object storage, backups and email delivery; stored Customer Personal Data, messages and delivery data | Paris, France; further sub-processors listed below |
| Ploi B.V., Netherlands | Server management; infrastructure details and administrative system access | Management platform in the Netherlands; managed systems at their respective locations |
| UpCloud Oy, Finland | Additional monitoring locations; assigned checks including necessary credentials, temporarily retrieved content and results | According to the commissioned monitoring region; Germany, USA, Singapore and Australia, with support/maintenance also in the United Kingdom |

Depending on the region used, UpCloud USA Inc., UpCloud Asia Pte. Ltd., UpCloud
Asia Pacific Pty Ltd. and, for support/maintenance, UpCloud UK Ltd. form part of
the further processing chain. For transfers without an adequacy decision, the
[UpCloud DPA](https://upcloud.com/global/terms-of-service/) provides for standard
contractual clauses. Further sub-processors used by Scaleway for the services
concerned and their locations are set out in [Scaleway's sub-processor list](https://www.scaleway.com/en/subprocessorlist/).
The actual processing chain under section 7 remains authoritative; changes to
provider websites do not replace notification under section 5.

A provider's purely own purposes, such as its contractual emails to up4, are
outside the processing chain for Customer Personal Data. Where Customer Personal
Data is processed in support or administration chains, sections 5–7 apply.
Recipients and notification services selected by the Customer are contacted on
its instructions; the Customer is responsible for their further processing.