Data Processing
Agreement.

1. Who this agreement is between

This Data Processing Agreement ("DPA") is between you, the customer who accepted our Terms of Service ("you"), and ACEFINA LLC, a Wyoming limited liability company, 9550 Ploof Rd SE, Unit 2B, Leland, NC 28451, USA ("we", "us" or "our"), which operates Visual Sentinel (the "Service"). It forms part of the Terms and applies whenever we process Customer Personal Data for you that is covered by Data Protection Law. You do not need to sign anything for it to apply. If you need a signed copy, email legal@visualsentinel.com.

2. Definitions

• Data Protection Law: the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), the UK GDPR and the UK Data Protection Act 2018, the Swiss Federal Act on Data Protection, and any other data protection law that applies to the processing, each as amended.
• Customer Personal Data: personal data that you or your users put into the Service, or that the Service collects for you, and that we process on your behalf.
• Subprocessor: a company we engage that processes Customer Personal Data for us.
• Security Incident: a breach of security that leads to the accidental or unlawful destruction, loss, alteration or unauthorised disclosure of, or access to, Customer Personal Data.

Words such as controller, processor, data subject, personal data and processing have the meanings given in the GDPR.

3. Roles

For Customer Personal Data, you are the controller (or a processor acting for your own client) and we are your processor (or subprocessor). For personal data we use for our own purposes, such as running and billing your account, keeping the Service secure and our own marketing, we are the controller and our Privacy Policy applies instead of this DPA.

If you use the Service for your own clients, for example on an Agency plan, you are responsible for having the agreements with them that Data Protection Law requires. This DPA is between you and us only.

4. What we process

• Purpose: to provide the Service under the Terms: checking the websites, servers and APIs you set up, storing the results, sending alerts, running your status pages and reports, and answering your support requests.
• Duration: for as long as we provide the Service to you, and then until deletion as described in section 11.
• Nature of the processing: collecting, storing, comparing, analysing, sending and deleting data, as needed to provide the Service.
• People the data is about: your users and team members; people you add as alert recipients; people who subscribe to your public status pages; and people whose personal data appears on the pages you monitor, for example in screenshots or page text.
• Types of personal data: names, email addresses, phone numbers you add for alerts, device push tokens, IP addresses and usage records, and any personal data contained in monitored pages, screenshots, request settings you add (such as headers), messages and notes.
• Special categories: we do not ask for special categories of personal data (such as health data). Please do not put them into the Service. If a page you monitor contains them, they are processed only as part of that page.

5. What we do

We will:

• process Customer Personal Data only on your documented instructions, which are the Terms, this DPA and the way you set up and use the Service, unless the law requires otherwise. In that case we will tell you first, unless the law forbids it;
• tell you if we believe an instruction breaks Data Protection Law;
• make sure everyone we allow to process Customer Personal Data is bound by confidentiality;
• take the security measures described in section 12;
• help you, as far as the nature of the processing allows, to answer requests from people exercising their data protection rights, where you cannot do this yourself in the Service;
• help you meet your obligations on security, Security Incident notification, data protection impact assessments and prior consultation (GDPR Articles 32 to 36), taking into account the information available to us.

6. What you do

You confirm that you have a lawful basis for the Customer Personal Data you give us and the instructions you give, that you have given people any notices the law requires (for example, to the alert recipients you add), and that you use the Service in line with the acceptable use rules in the Terms.

7. Subprocessors

You give us general authorisation to use subprocessors. We require each subprocessor, by written agreement (which may be the provider's standard data processing terms), to protect Customer Personal Data to the standard Data Protection Law requires. We remain responsible to you for the work our subprocessors do for us.

The current list of subprocessors, with what each one does, the Customer Personal Data it receives and where it processes it, is in your workspace settings under Data processing when you are signed in. You can also ask for it by emailing support@visualsentinel.com.

Services you choose to connect, such as Slack, Discord, Microsoft Teams, Telegram, your own webhooks or an AI assistant you connect, receive data because you tell us to send it there. They are not our subprocessors, and their own terms apply. Browser push alerts travel through your browser's push service, encrypted so that it cannot read them. Our own website analytics and advertising tools are described in our Privacy Policy.

Changes to subprocessors: Before we add or replace a subprocessor, we update the list in your workspace settings and email your workspace owners at least 30 days before the new subprocessor starts processing Customer Personal Data. If you have a reasonable data protection objection, email privacy@visualsentinel.com within that period. We will work with you in good faith to resolve it. If we cannot, you may cancel your subscription before the change takes effect. If we have to replace a subprocessor urgently, for example because a provider stops working or poses a security risk, we may give shorter notice, and we will tell you as soon as we can.

8. International transfers

Our main servers are in the EU. Some subprocessors process data in other countries, as the subprocessor list shows. Where Data Protection Law requires a safeguard for a transfer, we rely on an adequacy decision (such as the EU-US Data Privacy Framework, where the recipient is certified) or on the Standard Contractual Clauses adopted by the European Commission (Decision (EU) 2021/914, the "SCCs"), with the UK Addendum and the changes needed for Swiss law where those apply.

Where your transfer of Customer Personal Data to us is a restricted transfer, the SCCs are incorporated into this DPA: Module 2 where you are a controller, and Module 3 where you are a processor. For the SCCs: the optional Clause 7 does not apply; under Clause 9, option 2 (general authorisation) applies, with the notice period in section 7; the optional wording in Clause 11 does not apply; under Clauses 17 and 18, the law and courts of Ireland apply; Annex I is section 4 of this DPA, Annex II is section 12 and Annex III is the subprocessor list described in section 7.

9. Security Incidents

We will tell you without undue delay after we become aware of a Security Incident that affects your Customer Personal Data. We will email the owner of your account with the information we have at the time, add more as we learn it, and take reasonable steps to contain the incident and reduce its effects. Telling you about a Security Incident is not an admission of fault.

10. Audits and information

We will make available the information you reasonably need to show that we meet our obligations under GDPR Article 28, for example by answering a reasonable written security questionnaire once a year. If that information is not enough, or a supervisory authority requires it, you or an independent auditor bound by confidentiality may audit our compliance with this DPA. Audits are at your cost, need at least 30 days' written notice, take place during normal business hours, happen no more than once in any 12 months (unless a Security Incident or a supervisory authority makes another one necessary), and must not disrupt the Service or expose other customers' data.

11. Return and deletion

When your use of the Service ends, you may ask us for an export of your data within 30 days, as the Terms describe. After that, or when you delete your account, we delete Customer Personal Data from the Service. Copies in our backups are removed as those backups expire (the oldest are kept for up to three years, as our Privacy Policy says). Until then they stay protected and are not used for any other purpose. We keep data longer only where the law requires it.

12. Security measures

We take these technical and organisational measures:

• Connections to the Service are encrypted in transit with HTTPS (TLS).
• Secrets for alert channels and connected integrations (such as webhook addresses, bot tokens, API keys and passwords you give us) are encrypted at rest with AES-256-GCM. Your Visual Sentinel API keys are stored only as a one-way hash, and account passwords are hashed with bcrypt.
• Access inside the Service is limited by workspace membership and roles. Access to our production servers is limited to authorised staff.
• Our production servers sit behind a network firewall that allows only the connections the Service needs.
• We keep encrypted backups in storage separate from the main servers, and check on a schedule that they can be restored.
• Session recordings in our product analytics mask all page text and form input.
• We record errors and monitor our own systems so we can find and fix problems, and we publish a way to report security issues (see our Security page).

We may change these measures over time, as long as the overall level of protection does not go down.

13. Liability and order of precedence

Each party's liability under this DPA is subject to the limits and exclusions in the Terms, as far as the law allows. If this DPA conflicts with the Terms on the processing of Customer Personal Data, this DPA wins. If the SCCs apply and conflict with this DPA, the SCCs win.

14. Changes to this DPA

We may update this DPA, for example when the law or the Service changes. We will tell you about material changes by email and with a notice in the Service at least 30 days before they take effect. Changes to subprocessors follow section 7.

15. Governing law

This DPA is governed by the same law, and disputes go to the same courts, as the Terms, except where Data Protection Law or the SCCs require otherwise.

16. Contact us

• Privacy and data protection: privacy@visualsentinel.com
• Legal: legal@visualsentinel.com
• Postal address: ACEFINA LLC, 9550 Ploof Rd SE, Unit 2B, Leland, NC 28451, USA