Data processing agreement (dpa) — Phare Uptime

Cited by

Facts read from this source

• DPA available Report an error

  “This Data Processing Agreement ("DPA") forms part of the Phare Terms of Service”

• Entity Report an error

  “It applies when Lightkeeper OÜ, trading as Phare, processes personal data on behalf of a customer using the Phare uptime monitoring platform.”

• Jurisdiction Report an error

  “This DPA is governed by Estonian law and the GDPR. The courts of Tallinn, Estonia have exclusive jurisdiction over disputes arising out of or in connection with this DPA”

• Roles Report an error

  “For the processing covered by this DPA, the customer is the Controller and Phare is the Processor.”

• Breach notification Report an error

  “Notify the Controller without undue delay after becoming aware of a Personal Data Breach affecting personal data processed under this DPA.”

• Subprocessor notice Report an error

  “Publish updates to its Sub-processor list and provide at least 30 days notice before adding or replacing a Sub-processor that materially affects the processing of personal data under this DPA.”

• Sccs incorporated Report an error

  “Where SCCs are required and not otherwise separately executed, they are incorporated by reference into this DPA to the extent necessary for the relevant transfer.”

• Deletion request Report an error

  “Upon termination or expiry of the services, Phare will, at the Controller's written request, return or delete personal data processed under this DPA, unless Applicable Data Protection Law requires retention.”

• Inactive account deletion Report an error

  “Phare deletes account data in accordance with the Terms of Service, including its policy of deleting inactive accounts after 4 months, unless applicable law requires retention.”

• Encryption Report an error

  “Data is encrypted in transit using TLS 1.2 or higher. Data at rest is encrypted using industry-standard encryption, including AES-256 or equivalent where applicable.”

• Access controls Report an error

  “Access to personal data is limited to authorised personnel on a need-to-know basis. Internal systems are protected by MFA and role-based access controls.”

• Provider Report an error

  “Application and database hosting is provided by Hetzner in Germany. Encrypted backups are stored with Scaleway in France. CDN, DNS, WAF, and monitoring agents are provided by Bunny.net.”

• Security tooling Report an error

  “Phare uses Aikido to support good security practices through dependency scanning and code auditing. Aikido analyses source code and related security signals and does not access customer personal data processed through the service.”

• Paddle billing excluded Report an error

  “Billing details handled by Paddle are not processed by Phare as Processor under this DPA. Paddle acts under its own terms and privacy documentation.”

• Special category data Report an error

  “Phare does not intentionally require or seek special category data under Article 9 GDPR. The Controller must not submit such data unless Phare has agreed to process it in writing.”

• DPA precedence Report an error

  “If there is a conflict between this DPA and the Terms of Service solely in relation to data protection matters, this DPA prevails for that conflict.”

• List URL Report an error

  “Phare maintains its current list of Sub-processors, including location and transfer information where relevant, at https://phare.io/legal/sub-processors.”

3 facts read from this page are not shown because they could not be confirmed on the page as captured.

Scores citing this record

• The Agency Developer European sovereignty
• The Customer Support Lead European sovereignty
• The E-Commerce Operations Manager European sovereignty
• The SaaS Platform Engineer European sovereignty
• The Information Security Officer European sovereignty
• The Skeptic API, monitoring as code & team administration
• The Skeptic European sovereignty