Data processing agreement

Parties and scope

This agreement is between you, the organisation that holds a WP Moo account ("you"), and tukkr LLC, 30 N Gould St Ste R, Sheridan, WY 82801, United States of America ("we"). It is part of the terms of service and you accept it together with them when you create an account. It applies for as long as we process personal data for you.

For the personal data in your account, you are the controller and we are your processor. Words like "personal data", "processing" and "personal data breach" mean what they mean in the General Data Protection Regulation (EU) 2016/679 (GDPR).

What we process

• Purpose and nature: monitoring the uptime and health of the sites you add, storing the results, showing them in the dashboard and sending alerts.
• Personal data: the names and email addresses of your users and of the alert addresses you add; site addresses, page addresses and server names that may identify a person; and what our checker reads on a monitored site, such as response headers, page titles and DNS and domain records. We store facts about a page, not the page itself.
• Data subjects: your users, the people who receive alerts, and the owners or visitors of monitored sites, as far as their personal data shows up in the site's address or content.
• Special categories: none are intended. Don't add sites or pages whose address or content reveals them.
• Duration: as long as you have an account. Check results are deleted after 90 days.

Your instructions

We only process the personal data on your documented instructions. This agreement, the terms of service and what you set up in the dashboard, such as the sites, pages and alert addresses you add, are your complete instructions. Further instructions need our written agreement, and we may charge for them. If we think an instruction breaks the GDPR, we tell you. If the law makes us process data otherwise, we tell you first, unless the law forbids that.

Your responsibilities

You are responsible for the personal data you add and for your instructions. You confirm that you have a legal basis to monitor the sites you add and to send alerts to the addresses you add, and that you have informed the people concerned where the law requires it. Claims that arise because you didn't are covered by Claims by others in the terms of service.

Our obligations

• Everyone at tukkr LLC with access to the data is bound to confidentiality.
• We protect the data with the measures under Security measures.
• We help you answer requests from data subjects, and with data protection impact assessments and prior consultations, as far as our part of the processing goes. Help beyond what the dashboard and this agreement offer is charged at reasonable rates.
• We tell you about a personal data breach that affects your data without undue delay after becoming aware of it, with what we know and what we're doing about it.
• We keep a record of the processing we do for you.

Sub-processors

You allow us to use sub-processors. We use these:

Each sub-processor is bound by a contract with the same data protection obligations as this agreement. We remain responsible for them.

Before we add or replace a sub-processor, we update this list and email account owners at least 14 days ahead. You can object on reasonable data protection grounds, by email to [email protected] with your reasons. If we can't solve your objection, your only remedy is to end the agreement by deleting your account.

Transfers outside the EU

WP Moo and its database are hosted in the European Union. tukkr LLC is a company in the United States. As far as our processing of your data counts as a transfer to a country outside the European Economic Area, the standard contractual clauses of the European Commission (Implementing Decision (EU) 2021/914) apply, module two (controller to processor), and are part of this agreement:

• clause 7 (docking) does not apply;
• clause 9: option 2, general authorisation, with the 14 days' notice above;
• clause 11: the optional language does not apply;
• clause 13: the supervisory authority of the EU country you're established in, or of your representative;
• clauses 17 and 18: the law and the courts of Ireland;
• annexes I to III: the sections What we process, Security measures and Sub-processors of this agreement.

A sub-processor outside the European Economic Area, or with a parent company outside it, is covered by the EU-US Data Privacy Framework or by standard contractual clauses.

Security measures

• All traffic to the dashboard and between our servers is encrypted.
• Passwords are stored hashed, and passwords known from data breaches are refused.
• Every account's data is kept apart: each query is limited to the organisation it belongs to.
• Logins and account email are rate limited, and deleting an account ends its sessions on every device.
• Access to the servers and the database is limited to the people who build WP Moo, and the hosting accounts are protected with two-step login.
• Our checker only sends GET requests, never logs in and refuses private and internal network addresses.
• Logs leave out passwords and are deleted after 14 days. Software and servers are kept up to date.

Audits

We give you the information you need to show that this agreement is followed, and answer reasonable security questionnaires in writing.

If our written answers aren't enough to show that, you may audit us, or have an independent auditor bound to confidentiality do so:

• once a year, with 30 days' notice and at your own cost;
• remotely where possible, and otherwise during business hours without disrupting the service;
• only for the processing we do for you, without access to other customers' data or to information that would harm our security.

If a supervisory authority requires an audit, the yearly limit doesn't apply.

When the service ends

When you delete your account, we stop processing straight away and delete all your personal data after 14 days, unless you restore the account before then or the law requires us to keep it. Ask [email protected] before deleting if you want a copy of your data.

Liability and precedence

The liability rules of the terms of service apply to this agreement, as far as the GDPR allows, with one limit for the terms and this agreement together. When this agreement and the terms differ on data protection, this agreement wins; when the standard contractual clauses and this agreement differ, the clauses win. This agreement is governed by the law of Ireland.