Data Processing Addendum

This is an outline of the Data Processing Addendum ("DPA") we intend to offer business customers. The final version, with its annexes and the Standard Contractual Clauses, will be available to sign on request at [email protected].

1. Parties and scope

The DPA is between the customer (the "Controller") and Synergia Solutions Holding Ltd., a British Columbia company (the "Processor"), and applies when Pingerer processes personal data on the customer's behalf in providing the Service under the Terms of Service.

2. Details of processing (Annex 1)

• Subject matter and duration: providing the Service for as long as the customer's account is open, plus the deletion period.
• Nature and purpose: storing, organizing and transmitting data to run checks, send alerts, publish status pages and produce reports.
• Categories of data subjects: the customer's team members; people who receive alerts; status page subscribers; any individuals whose data appears in monitored content or settings.
• Categories of personal data: names, email addresses, phone numbers, chat destinations, IP addresses in heartbeat pings, and any personal data the customer chooses to put in URLs, headers or status page content.
• Special categories: none intended; the customer agrees not to submit them.

3. Processor obligations

• Process personal data only on the Controller's documented instructions (the Terms, the DPA and the customer's use of the Service).
• Make sure staff with access are bound by confidentiality.
• Keep appropriate technical and organizational security measures (Annex 2), including encryption in transit, encryption of sensitive settings at rest, access controls and backups.
• Help the Controller respond to data subject requests and with security, breach notification and impact assessments, where reasonable.
• Notify the Controller without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach.
• Delete or return personal data at the end of the Service, except where the law requires keeping it.
• Make available information needed to show compliance and allow reasonable audits (normally by providing reports and answering questionnaires).

4. Subprocessors

The Controller authorizes the subprocessors listed in our Privacy Policy. We'll give at least 30 days' notice of a new subprocessor, during which the Controller may object on reasonable data protection grounds. We remain responsible for our subprocessors.

5. International transfers

Transfers outside the EEA, UK or Switzerland are made under the EU Standard Contractual Clauses (Module 2 and, where relevant, Module 3), the UK International Data Transfer Addendum, or another lawful mechanism.

6. Liability and precedence

The liability limits in the Terms apply. If the DPA and the Terms conflict on data protection, the DPA wins.

Annexes to complete

• Annex 1: details of processing (above, to be finalized).
• Annex 2: technical and organizational measures.
• Annex 3: list of subprocessors.
• Standard Contractual Clauses and UK Addendum, with the parties' details: Synergia Solutions Holding Ltd., a British Columbia company, 502 Smith Avenue, Coquitlam, BC V3J 0H9, Canada.