Data Processing Agreement (DPA)

Executive Summary

• • Under this DPA, the Customer acts as the Data Controller and WebPixie acts as the Data Processor.
• • Primary customer data is stored in the EU.
• • New sub-processor additions are notified 7-14 days in advance.
• • International transfers rely on EU SCCs (2021/914) with the UK International Data Transfer Addendum; UK IDTA may be used where appropriate.
• • Personal data breach notifications are provided without undue delay.

Table of Contents

• 1. Introduction & Parties
• 2. Definitions
• 3. Subject Matter & Duration of Processing
• 4. Categories of Data & Data Subjects
• 5. Obligations of the Processor
• 6. Security Measures
• 7. Sub-Processors
• 8. International Data Transfers
• 9. Assistance to the Controller
• 10. Data Breach Obligations
• 11. Return or Deletion of Data
• 12. Audits & Certifications
• 13. Liability & Limitations
• 14. Governing Law
• 15. Contact Information

This Data Processing Agreement ("DPA") forms part of the Terms of Service. It governs the processing of Personal Data by WebPixie on behalf of the Customer during the provision of monitoring, uptime, and analysis services. The Customer acts as the Data Controller, and WebPixie acts as the Data Processor.

WebPixie processes Personal Data solely for the purpose of providing the WebPixie platform: domain monitoring, uptime checks, technical analysis, notifications, and related features. Processing continues for the duration of the Customer's use of the Service and ends upon the deletion or return of Personal Data in accordance with this DPA.

• • Primary customer data is stored in the EU.
• • Certain operational data may be processed globally (e.g., Cloudflare edge locations).
• • Personal Data may be processed in the United States by service category, including analytics (e.g., Amplitude, Google Analytics), transactional messaging (e.g., SendGrid), payment operations (e.g., Stripe), and error monitoring (e.g., Sentry).
• • For restricted transfers, WebPixie relies on the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) and the UK International Data Transfer Addendum. UK IDTA may be used where appropriate as an alternative UK transfer mechanism.

Upon termination of the Service, WebPixie will delete or return the Personal Data at the Customer's choice. Unless required by law, all Personal Data is deleted within 30 days. Customers can export their data before deletion.

Retention for Customer workspace data is applied according to the Customer's selected plan and related retention limits published on the Pricing page, subject to applicable legal obligations.

• • Customers may request audits of WebPixie's data processing activities.
• • Audits may not occur more than once per year unless legally required.
• • WebPixie may provide third-party certifications (e.g., infrastructure compliance) as proof of controls.

Except as restricted by applicable law, the liability limitations specified in the Terms of Service apply.

This DPA is governed by and construed in accordance with the laws of England and Wales. Any dispute arising from this DPA shall be resolved by the competent courts in London, without prejudice to mandatory rights under applicable law.