Data Processing Addendum

1. Application and roles

• This DPA applies where, and to the extent that, SOFTIVO INNOVATIONS S.R.L. processes Customer Personal Data on your behalf — for example email addresses you configure as notification recipients, personal data contained in the URLs you monitor, and free-text incident notes.
• For that data you are the controller (or a processor acting for a third-party controller) and SOFTIVO INNOVATIONS S.R.L. is your processor (or sub-processor).
• For personal data where SOFTIVO INNOVATIONS S.R.L. determines the purposes and means — account administration, billing, security and improving the Service — SOFTIVO INNOVATIONS S.R.L. is the controller and its Privacy Policy applies instead of this DPA.

2. Definitions

“GDPR” means Regulation (EU) 2016/679 and, where applicable, the UK GDPR and the Swiss FADP. “Data Protection Law” means all laws on the processing of personal data that apply to a party. Terms such as “personal data”, “processing”, “controller”, “processor”, “data subject” and “personal data breach” have the meanings in the GDPR. “SCCs” means the Standard Contractual Clauses in Commission Implementing Decision (EU) 2021/914.

3. Processing on documented instructions

• SOFTIVO INNOVATIONS S.R.L. processes Customer Personal Data only on your documented instructions, including as to international transfers. The Terms of Service, this DPA and your configuration and use of the Service are your complete and final instructions. Additional instructions require agreement in writing and may be subject to a fee.
• SOFTIVO INNOVATIONS S.R.L. processes Customer Personal Data only to provide, secure and support the Service, and for the subject matter, duration, nature and purposes set out in Annex 1.
• SOFTIVO INNOVATIONS S.R.L. will inform you if, in its opinion, an instruction infringes Data Protection Law, and may suspend the affected processing until the instruction is confirmed or changed.
• You are responsible for the accuracy and lawfulness of Customer Personal Data and for having a valid legal basis and any required notices or consents for its processing through the Service.

4. Confidentiality

SOFTIVO INNOVATIONS S.R.L. ensures that persons authorised to process Customer Personal Data are bound by an appropriate obligation of confidentiality and are granted access only on a need-to-know basis.

5. Security

SOFTIVO INNOVATIONS S.R.L. implements and maintains the technical and organisational measures set out in Annex 2, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing as well as the risks to data subjects, in accordance with Article 32 GDPR.

6. Sub-processors

• You give SOFTIVO INNOVATIONS S.R.L. general authorisation to engage sub-processors to process Customer Personal Data. The current sub-processors are listed on our Sub-processors List and summarised in Annex 3.
• SOFTIVO INNOVATIONS S.R.L. will give at least 30 days’ notice (by email or in-app) before adding or replacing a sub-processor. If you have a reasonable data-protection objection, tell us within that period; the parties will work in good faith to resolve it, and if they cannot, you may terminate the affected part of the Service.
• SOFTIVO INNOVATIONS S.R.L. imposes data-protection obligations on each sub-processor that are no less protective than those in this DPA, and remains responsible to you for a sub-processor’s performance.

7. Assistance to the customer

• Taking into account the nature of the processing, SOFTIVO INNOVATIONS S.R.L. assists you with appropriate technical and organisational measures, insofar as possible, to respond to data-subject requests. The Service provides self-service export and deletion tools that you can use for this purpose. SOFTIVO INNOVATIONS S.R.L. will pass on to you, without undue delay, any request it receives directly from a data subject relating to Customer Personal Data.
• SOFTIVO INNOVATIONS S.R.L. assists you in ensuring compliance with Articles 32 to 36 GDPR (security, breach notification, data-protection impact assessments and prior consultation), taking into account the information available to SOFTIVO INNOVATIONS S.R.L..

8. Personal data breach

SOFTIVO INNOVATIONS S.R.L. notifies you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and provides information reasonably available to it to help you meet your own notification obligations. Such notification is not an acknowledgement of fault or liability.

9. Return and deletion

On termination or expiry of the Service, SOFTIVO INNOVATIONS S.R.L. deletes or, at your choice, returns Customer Personal Data, and deletes existing copies, unless Data Protection Law requires storage. Monitoring history is in any event deleted automatically once it passes your plan’s retention window, and account data is deleted or anonymised following account closure as described in the Privacy Policy. Residual copies in routine backups are overwritten in the ordinary backup cycle.

10. Information and audits

SOFTIVO INNOVATIONS S.R.L. makes available to you the information reasonably necessary to demonstrate compliance with Article 28 GDPR and this DPA, and allows for and contributes to audits, including inspections, conducted by you or an auditor you mandate. Audits take place on at least 30 days’ notice, during business hours, no more than once per year (unless a supervisory authority requires otherwise or a breach has occurred), subject to confidentiality undertakings and without unreasonably disrupting SOFTIVO INNOVATIONS S.R.L.’s operations. SOFTIVO INNOVATIONS S.R.L. may satisfy an audit request by providing relevant third-party reports or certifications where available.

11. International transfers

Where SOFTIVO INNOVATIONS S.R.L. or a sub-processor processes Customer Personal Data outside the EEA, the transfer is made under an adequacy decision, under the SCCs, or under another valid transfer mechanism. The SCCs are incorporated into this DPA by reference: Module Two (controller to processor) applies where you are a controller, and Module Three (processor to processor) applies where you are a processor; the optional docking clause applies; the audit option reflecting clause 10 applies; the governing law and forum are those of Romania where permitted; and Annexes 1 to 3 of this DPA populate the corresponding SCC Annexes. For transfers subject to UK or Swiss law, the UK Addendum and the Swiss amendments apply respectively.

12. Liability and precedence

Each party’s liability under this DPA is subject to the limitations and exclusions in the Terms of Service, except that nothing limits either party’s liability to a data subject or under Data Protection Law where such limitation is not permitted. If there is a conflict, this DPA prevails over the rest of the Terms of Service on data-protection matters, and the SCCs prevail over this DPA to the extent of a conflict. Enterprise customers who require a countersigned copy can request one from office@softivo.ro.

Annex 1 – Details of processing

• Data exporter / controller: the Customer identified in the account and its billing details.
• Data importer / processor: SOFTIVO INNOVATIONS S.R.L., Bucureşti Sectorul 1, Strada Lt. Radu Beller, Nr. 3-5, România, Romania.
• Subject matter: provision of the evo uptime uptime-monitoring, status-page and notification Service.
• Duration: the term of the Terms of Service, plus any period until deletion or return of Customer Personal Data.
• Nature and purpose: hosting, storage, transmission, and processing of configuration data to run availability checks, record incidents, render status pages and deliver notifications on the Customer’s instructions.
• Types of personal data: email addresses of notification recipients; names and identifiers contained in monitored URLs, monitor names, status-page text and incident notes; webhook URLs and messaging identifiers configured by the Customer; related delivery metadata.
• Special categories: none is intended or requested; the Customer must not submit special-category data through free-text fields.
• Categories of data subjects: the Customer’s staff, contractors and other individuals whom the Customer chooses to include in monitors, status pages or notifications.
• Frequency: continuous, for the duration of the Service.
• Competent supervisory authority: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP).

Annex 2 – Technical and organisational measures

• Encryption: TLS for data in transit; encryption at rest for notification-channel secrets; password hashing.
• Access control: role-based, least-privilege access to production systems; individual accounts; access reviews; multi-factor authentication for administrative access.
• Network and application security: blocking of requests to private and reserved network ranges (server-side request forgery protection) at every redirect hop; redirect and timeout limits; rate limiting; an identifiable monitoring user-agent; a circuit breaker that halts checks on loss of outbound connectivity.
• Hosting: reputable infrastructure provider; segregation of the production environment; managed database and queue.
• Resilience and backups: regular backups on a short rolling cycle; restoration procedures.
• Logging and monitoring: security and application logging; alerting on anomalies.
• Vulnerability management: dependency and platform updates; patching of known vulnerabilities.
• Organisational: confidentiality obligations on personnel; security awareness; a documented incident-response process; sub-processor due diligence and contractual flow-down.
• Data minimisation: per-request monitoring results are not retained; only daily aggregates are kept, and only for the plan retention window.

These measures may be updated as the Service evolves, provided the level of protection is not reduced.

Annex 3 – Sub-processors

The authorised sub-processors, their roles, the personal data involved, their processing locations and the transfer mechanisms are maintained on our Sub-processors List, which forms part of this Annex and is updated in accordance with clause 6.