This Data Processing Agreement ("DPA") forms part of the agreement between uokay ("Processor") and the customer ("Controller") and applies where uokay processes personal data on the customer's behalf within the meaning of Art. 28 GDPR. A countersigned copy is available on request via [email protected].

1. Subject matter and duration

Processing of personal data contained in monitoring configurations, prompts, endpoint responses, and alert destinations, for the duration of the customer's account.

2. Nature and purpose

Executing scheduled checks against customer-configured endpoints, evaluating responses against customer-defined assertions, storing results, and dispatching alerts.

3. Categories of data and data subjects

Categories depend on what the Controller configures: typically contact details of alert recipients (team members) and any personal data the Controller includes in prompts or that appears in endpoint responses. Data subjects are the Controller's personnel and, where the Controller includes such data, its end users.

4. Obligations of the Processor

Process personal data only on documented instructions from the Controller (the configuration made in the dashboard constitutes such instructions).
Ensure persons authorized to process the data are bound by confidentiality.
Implement appropriate technical and organizational measures: encryption in transit (TLS) and at rest, API key encryption with restricted decryption, access controls, and logging. See the security page.
Notify the Controller without undue delay after becoming aware of a personal data breach.
Assist the Controller with data subject requests and Art. 32–36 obligations, taking into account the nature of the processing.
Delete or return personal data after the end of the provision of services, unless storage is required by law.
Make available information necessary to demonstrate compliance and allow audits, at most once per year with reasonable notice.

5. Subprocessors

The Controller grants general authorization for the subprocessors listed in the Privacy Policy. The Processor notifies the Controller of intended changes at least 14 days in advance, giving the Controller the opportunity to object. Where a subprocessor is established outside the EEA or is subject to third-country law, transfers are safeguarded by EU Standard Contractual Clauses or an adequacy decision.

6. Liability and governing law

Liability follows the limitations in the Terms of Service. This DPA is governed by Dutch law.