This Data Processing Agreement ("DPA") is entered into between the customer agreeing to Kawze's Terms and Conditions ("Controller", "you") and Peterbrook Trading Ltd, trading as Kawze, a company registered in England and Wales under company number 15540069, of Peterbrook Close, Redditch, B98 7YF, United Kingdom ("Processor", "Kawze", "we"). This DPA forms part of, and is incorporated into, the Terms and applies where Kawze processes personal data on your behalf in connection with our uptime monitoring service, including status page subscriber data as described in our Privacy Policy.
1. Definitions
Terms such as "Personal Data", "Processing", "Controller", "Processor", "Data Subject", and "Data Breach" have the meanings given to them under the UK General Data Protection Regulation ("UK GDPR") and, where applicable, the EU GDPR (together, "Applicable Data Protection Laws"). "Customer Personal Data" means personal data processed by Kawze on the Controller's behalf in connection with the Service, including account and contact information, alert recipient details, and status page subscriber data.
2. Roles of the parties
You are the Controller of Customer Personal Data and Kawze is the Processor. Kawze will process Customer Personal Data only on your documented instructions, including as set out in this DPA and the Terms, unless required to do otherwise by law - in which case we will inform you of that legal requirement before processing, unless the law prohibits us from doing so.
3. Details of processing
- Subject matter: provision of website monitoring, uptime monitoring, HTTP endpoint monitoring, alerting, and status page services.
- Duration: the term of the Terms, plus any period during which Kawze retains Customer Personal Data under our Data Retention Policy.
- Nature and purpose: operating automated monitoring checks against Controller-specified endpoints, delivering downtime alerts, hosting status pages, and providing associated account, billing, and support functions.
- Types of personal data: account holder and team member names and email addresses; alert contact names, email addresses, and phone numbers; monitored endpoint configuration and, where supplied, authentication credentials; status page subscriber email addresses; billing contact and transaction metadata; technical and usage logs.
- Categories of data subjects: Controller's account holders and authorised users, alert recipients, status page subscribers, and billing contacts.
4. Processor obligations
Kawze shall:
- process Customer Personal Data only on your documented instructions;
- ensure personnel authorised to process Customer Personal Data are subject to confidentiality obligations;
- implement appropriate technical and organisational security measures, as described in Section 7;
- assist you, taking into account the nature of processing, in responding to data subject requests and in meeting your security, breach notification, and data protection impact assessment obligations;
- delete or return Customer Personal Data on termination of the Service, as set out in Section 9; and
- make available information reasonably necessary to demonstrate compliance with this DPA.
5. Sub-processors
You provide a general authorisation for Kawze to engage the following sub-processors to process Customer Personal Data in connection with our uptime monitoring service. We impose data protection obligations on each sub-processor no less protective than those in this DPA, and remain responsible for their performance.
| Purpose | Sub-processor | Categories of data processed |
|---|---|---|
| Cloud hosting and infrastructure | Microsoft Azure | Hosted account, monitor, and check data |
| Database storage | MongoDB Atlas | Monitor configuration, check logs, uptime summaries |
| Email delivery | Azure Communication Services | Alert recipient email addresses, message content |
| SMS alert delivery | Azure Communication Services (UK Mobile Number sender) | Alert recipient phone numbers, message delivery metadata |
| Payment processing | Stripe | Billing contact details, transaction metadata |
We will give you at least fourteen (14) days' notice, by email or in-app notification, before appointing a new sub-processor. You may object on reasonable data protection grounds within that notice period by contacting [email protected]; if we cannot resolve your objection, you may terminate the affected part of the Service without penalty.
6. Personal data breaches
We will notify you without undue delay, and in any event within seventy-two (72) hours of becoming aware, of any personal data breach affecting Customer Personal Data, together with information reasonably available to us about its nature, likely consequences, and the steps we are taking to address it. This notification does not constitute an acknowledgement of fault or liability.
7. Security measures
Kawze maintains appropriate technical and organisational measures appropriate to the risk, including encryption of data in transit and at rest, role-based access controls, network security controls on our monitoring infrastructure, and regular review of our security practices. Further detail is available on request.
8. International transfers
Customer Personal Data is primarily processed in the UK and West Europe. Where Customer Personal Data is transferred outside the UK or European Economic Area, such transfers are subject to appropriate safeguards, including the UK International Data Transfer Addendum or the EU Standard Contractual Clauses, as applicable.
9. Deletion and return of data
On termination or expiry of the Service, Kawze will delete or, on your written request, return Customer Personal Data in accordance with our Data Retention Policy, except to the extent we are required by law to retain some or all of that data, in which case it will be isolated from further processing until it can lawfully be deleted.
10. Audit rights
On reasonable written notice, and no more than once every twelve (12) months (unless required following a confirmed personal data breach or by a supervisory authority), you may request information reasonably necessary to demonstrate our compliance with this DPA. We may satisfy such requests by providing relevant documentation, security summaries, or responses to reasonable questionnaires, subject to confidentiality safeguards protecting our security posture and other customers' data.
11. Liability
This DPA does not expand either party's liability beyond the limits set out in our Terms and Conditions. Nothing in this DPA limits liability that cannot lawfully be limited or excluded under Applicable Data Protection Laws.
12. Governing law
This DPA is governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction over any dispute arising out of or in connection with it.
13. Contact
Questions about this DPA or Kawze's data processing practices can be sent to [email protected].