Data processing agreement

Controller: the customer named in the order or account details. Processor: the operator of Tenium, whose full registration details are given on every invoice and to any customer on request, which provides Tenium.

The processor handles personal data only to provide the Tenium monitoring service, for as long as the customer has an account.

• People: the customer's team members, client viewers and alert contacts.
• Data: name, e-mail, sign-in data, alert contacts (e-mail addresses, chat IDs) and billing details the customer enters.
• Check results: status codes, timings, IP addresses and, for failed checks, a response excerpt, which may incidentally contain personal data.

The processor acts on the customer's documented instructions, which are the use of the service and the settings the customer chooses. It tells the customer if it believes an instruction breaks data protection law.

Everyone at the processor with access to personal data is bound to keep it confidential.

The measures described on the security page apply. The detailed list of technical and organisational measures is available on request.

• DigitalOcean: hosting in Amsterdam, the Netherlands.
• A payment partner: card payments.
• An e-mail provider: transactional e-mail.
• Telegram: only if the customer enables Telegram alerts.
• Current sub-processors: DigitalOcean (hosting, Amsterdam, the Netherlands), WayForPay (card payments, Ukraine), an email delivery provider, and Telegram (only if the customer turns on Telegram alerts). The processor tells the customer by email at least 14 days before it adds or replaces a sub-processor.

Account data is stored in the EU. Checks also run from regions outside the EU, and only the target URL and the result pass through them. Where a transfer outside the European Economic Area needs a safeguard, the parties rely on the European Commission's standard contractual clauses.

The processor helps the customer answer requests for access, correction, deletion and portability within a reasonable time.

The processor informs the customer without undue delay after it becomes aware of a breach affecting the customer's data. It does so without undue delay and in any case within 72 hours.

When the account ends, the processor deletes the customer's account data. It deletes it within 30 days after the account is closed or the customer asks. Invoices are kept for as long as accounting rules require.

The processor provides the information needed to show compliance. We hold no SOC 2 report. The customer may audit once a year, remotely and at its own cost, with 30 days' written notice. The processor also answers reasonable security questionnaires.

This agreement is governed by the laws of Ukraine. Disputes go to the courts of Ukraine at the processor's place of registration.

This agreement takes effect when the customer starts using the service. A signed copy is available on request.