<header id="pagmt">
    <h1>Data Processing Agreement</h1>
</header>

<section>

    <h2>1. Introduction</h2>
    <p>
        This Data Processing Agreement ("DPA") forms part of the Customer Terms of Service or other written agreement
        between HackerBay, Inc. doing business as OneUptime ("Processor", "we", "us") and the entity agreeing to these
        terms ("Controller", "Customer", "you") for the provision of OneUptime services (the "Agreement").
    </p>
    <p>
        This DPA reflects the parties' commitment to abide by applicable Data Protection Laws concerning the processing
        of Personal Data in connection with the Services provided under the Agreement.
    </p>

    <h2>2. Definitions</h2>
    <p>In this DPA, the following terms have the meanings set out below. Capitalized terms not defined herein have the
        meanings given to them in the Agreement.</p>
    <ul>
        <li><strong>"Controller"</strong> means the entity that determines the purposes and means of Processing Personal
            Data, as defined in applicable Data Protection Laws.</li>
        <li><strong>"Data Protection Laws"</strong> means all applicable legislation relating to data protection and
            privacy, including the EU General Data Protection Regulation (GDPR) 2016/679, the California Consumer Privacy
            Act (CCPA), and any applicable national implementing or supplementary legislation.</li>
        <li><strong>"Data Subject"</strong> means an identified or identifiable natural person to whom Personal Data
            relates.</li>
        <li><strong>"Personal Data"</strong> means any information relating to a Data Subject that is processed by the
            Processor on behalf of the Controller in connection with the Services.</li>
        <li><strong>"Processing"</strong> (and "Process") means any operation performed on Personal Data, including
            collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation,
            use, disclosure, dissemination, restriction, erasure, or destruction.</li>
        <li><strong>"Processor"</strong> means the entity that Processes Personal Data on behalf of the Controller, as
            defined in applicable Data Protection Laws.</li>
        <li><strong>"Security Incident"</strong> means any accidental or unlawful destruction, loss, alteration,
            unauthorized disclosure of, or access to Personal Data.</li>
        <li><strong>"Services"</strong> means the monitoring and incident management services provided by OneUptime to the
            Customer under the Agreement.</li>
        <li><strong>"Subprocessor"</strong> means any third party engaged by the Processor to Process Personal Data on
            behalf of the Controller. A current list of Subprocessors is available at
            <a href="/legal/subprocessors">/legal/subprocessors</a>.</li>
    </ul>

    <h2>3. Scope and Purpose of Processing</h2>
    <h3>3.1 Scope</h3>
    <p>
        This DPA applies to the Processing of Personal Data by the Processor on behalf of the Controller in connection
        with the provision of the Services under the Agreement.
    </p>
    <h3>3.2 Purpose</h3>
    <p>
        The Processor shall Process Personal Data only for the purposes of providing the Services as described in the
        Agreement and as further documented in the Controller's instructions. The categories of Personal Data and Data
        Subjects are determined by the Controller's use of the Services and typically include:
    </p>
    <ul>
        <li><strong>Categories of Data Subjects:</strong> Customer's end users, employees, contractors, and other
            individuals whose data is submitted to the Services.</li>
        <li><strong>Types of Personal Data:</strong> Name, email address, IP address, user agent information, and any
            other data submitted through the Services by the Controller.</li>
        <li><strong>Processing Activities:</strong> Storage, analysis, monitoring, alerting, and incident management as
            necessary to provide the Services.</li>
    </ul>

    <h2>4. Obligations of the Processor</h2>
    <h3>4.1 Processing Instructions</h3>
    <p>
        The Processor shall Process Personal Data only on documented instructions from the Controller, including with
        regard to transfers of Personal Data to a third country, unless required to do so by applicable law. In such a
        case, the Processor shall inform the Controller of that legal requirement before Processing, unless prohibited
        by law.
    </p>
    <h3>4.2 Confidentiality</h3>
    <p>
        The Processor shall ensure that persons authorized to Process Personal Data have committed themselves to
        confidentiality or are under an appropriate statutory obligation of confidentiality.
    </p>
    <h3>4.3 Security Measures</h3>
    <p>
        The Processor shall implement appropriate technical and organizational measures to ensure a level of security
        appropriate to the risk, including as appropriate:
    </p>
    <ul>
        <li>Encryption of Personal Data in transit and at rest</li>
        <li>Measures to ensure ongoing confidentiality, integrity, availability, and resilience of processing systems</li>
        <li>The ability to restore the availability and access to Personal Data in a timely manner in the event of an
            incident</li>
        <li>Regular testing, assessing, and evaluating the effectiveness of technical and organizational measures</li>
    </ul>
    <h3>4.4 Subprocessing</h3>
    <p>
        The Processor shall not engage another processor (Subprocessor) without prior specific or general written
        authorization of the Controller. In the case of general written authorization, the Processor shall inform the
        Controller of any intended changes concerning the addition or replacement of Subprocessors, giving the Controller
        the opportunity to object to such changes. A current list of Subprocessors is maintained at
        <a href="/legal/subprocessors">/legal/subprocessors</a>.
    </p>
    <p>
        Where the Processor engages a Subprocessor, the Processor shall impose on the Subprocessor the same data
        protection obligations as set out in this DPA by way of a written contract, ensuring that the Subprocessor
        provides sufficient guarantees to implement appropriate technical and organizational measures.
    </p>
    <h3>4.5 Assistance to the Controller</h3>
    <p>
        Taking into account the nature of the Processing, the Processor shall assist the Controller by appropriate
        technical and organizational measures, insofar as possible, for the fulfilment of the Controller's obligation to
        respond to requests from Data Subjects exercising their rights under Data Protection Laws.
    </p>

    <h2>5. Obligations of the Controller</h2>
    <p>The Controller warrants and represents that:</p>
    <ul>
        <li>It has complied and will continue to comply with all applicable Data Protection Laws in respect of its use of
            the Services and its Processing instructions to the Processor.</li>
        <li>It has obtained all necessary consents or has another lawful basis for the transfer of Personal Data to the
            Processor for Processing in accordance with this DPA.</li>
        <li>It shall be responsible for the accuracy, quality, and legality of Personal Data and the means by which it
            acquired the Personal Data.</li>
        <li>It shall inform the Processor without undue delay if it becomes aware of any circumstances that could affect
            the lawfulness of the Processing of Personal Data under this DPA.</li>
    </ul>

    <h2>6. Data Subject Rights</h2>
    <p>
        The Processor shall, to the extent legally permitted, promptly notify the Controller if the Processor receives a
        request from a Data Subject to exercise any of the following rights with respect to their Personal Data:
    </p>
    <ul>
        <li>Right of access</li>
        <li>Right to rectification</li>
        <li>Right to erasure ("right to be forgotten")</li>
        <li>Right to restriction of processing</li>
        <li>Right to data portability</li>
        <li>Right to object to processing</li>
        <li>Rights related to automated decision-making and profiling</li>
    </ul>
    <p>
        The Processor shall not independently respond to such requests except on the documented instructions of the
        Controller or as required by applicable law.
    </p>

    <h2>7. Security Incident Notification</h2>
    <p>
        The Processor shall notify the Controller without undue delay after becoming aware of a Security Incident
        affecting Personal Data processed on behalf of the Controller. Such notification shall include:
    </p>
    <ul>
        <li>A description of the nature of the Security Incident, including the categories and approximate number of
            Data Subjects and Personal Data records affected</li>
        <li>The name and contact details of the Processor's data protection contact</li>
        <li>A description of the likely consequences of the Security Incident</li>
        <li>A description of the measures taken or proposed to be taken to address the Security Incident, including
            measures to mitigate its possible adverse effects</li>
    </ul>
    <p>
        The Processor shall cooperate with the Controller and take reasonable commercial steps to assist in the
        investigation, mitigation, and remediation of each Security Incident.
    </p>

    <h2>8. International Data Transfers</h2>
    <p>
        The Processor shall not transfer Personal Data to a country outside the European Economic Area (EEA) unless
        appropriate safeguards are in place as required by applicable Data Protection Laws, such as:
    </p>
    <ul>
        <li>Standard Contractual Clauses (SCCs) approved by the European Commission</li>
        <li>Binding Corporate Rules</li>
        <li>An adequacy decision by the European Commission for the recipient country</li>
        <li>The EU-U.S. Data Privacy Framework, where applicable</li>
    </ul>
    <p>
        For information about where Customer Data is stored, please refer to our
        <a href="/legal/data-residency">Data Residency</a> page.
    </p>

    <h2>9. Duration and Termination</h2>
    <p>
        This DPA shall remain in effect for the duration of the Agreement. Upon termination of the Agreement, the
        Processor shall, at the choice of the Controller, delete or return all Personal Data to the Controller and delete
        existing copies, unless applicable law requires storage of the Personal Data. The Processor shall certify in
        writing that it has complied with this provision upon the Controller's request.
    </p>

    <h2>10. Audit Rights</h2>
    <p>
        The Processor shall make available to the Controller all information necessary to demonstrate compliance with the
        obligations laid down in this DPA and applicable Data Protection Laws, and shall allow for and contribute to
        audits, including inspections, conducted by the Controller or another auditor mandated by the Controller.
    </p>
    <p>
        The Controller shall provide reasonable prior written notice of any audit request. Audits shall be conducted
        during normal business hours and shall not unreasonably interfere with the Processor's business operations. The
        Controller shall bear the costs of any such audit unless the audit reveals a material breach of this DPA by the
        Processor.
    </p>

    <h2>11. Liability</h2>
    <p>
        Each party's liability arising out of or related to this DPA is subject to the limitations of liability set forth
        in the Agreement. In no event shall either party's aggregate liability for claims arising out of or related to
        this DPA exceed the limitations set forth in the Agreement.
    </p>

    <h2>12. Contact Information</h2>
    <p>
        For questions or concerns about this DPA or our data processing practices, please contact us:
    </p>
    <ul>
        <li><strong>Entity:</strong> HackerBay, Inc. (doing business as OneUptime)</li>
        <li><strong>Email:</strong> <a href="mailto:legal@oneuptime.com">legal@oneuptime.com</a></li>
        <li><strong>Address:</strong> 1111B S Governors Ave STE 39378, Dover, DE 19904, United States</li>
    </ul>
    <p>
        For more information about our privacy practices, please see our
        <a href="/legal/privacy">Privacy Policy</a>. For details on GDPR compliance, visit our
        <a href="/legal/gdpr">GDPR</a> page.
    </p>

</section>
