Data processing agreement (dpa) — UptimeRobot

Cited by

Facts read from this source

• Entity Report an error

  “UptimeRobot s. r. o. Obchodná 507/2, 811 06 Bratislava, Slovak Republic Registration No. 561 73 067, VAT SK2122231749”

• DPA version Report an error

  “Version: 2.2 | Last updated: August 28, 2026”

• DPA countersigned copy Report an error

  “Need a countersigned copy of this DPA? Book a demo with our team to discuss your requirements and receive the relevant documentation.”

• DPA no separate signature Report an error

  “No separate signature is required unless specifically requested by Customer.”

• Laws covered Report an error

  “(i) the GDPR; (ii) the UK GDPR; (iii) the Swiss Federal Act on Data Protection (FADP); (iv) Directive 2002/58/EC (ePrivacy Directive)”

• Breach notification hours Report an error

  “UptimeRobot shall notify Customer without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Security Incident affecting Customer Personal Data.”

• General authorization Report an error

  “Customer provides general authorization to UptimeRobot to engage Sub-processors to Process Customer Personal Data, provided that UptimeRobot complies with the requirements set out in this Section 8.”

• List URL Report an error

  “A current list of Sub-processors engaged by UptimeRobot is set out in Annex 3 (List of Sub-processors) to this DPA and is also available online at https://uptimerobot.com/privacy/.”

• Change notice days Report an error

  “UptimeRobot shall provide Customer with at least thirty (30) days prior written notice (via email to the email address associated with Customer’s account or through an in-app notification) of any intended changes concerning the addition or replacement of Sub-processors.”

• Full liability Report an error

  “Where the Sub-processor fails to fulfill its data protection obligations, UptimeRobot shall remain fully liable to Customer for the performance of the Sub-processor’s obligations.”

• Processing locations Report an error

  “Primary: European Union (data centers operated by Sub-processors) Secondary: United States (data centers operated by Sub-processors: AWS, Digital Ocean, Hetzner, Limestone Networks)”

• Scc modules Report an error

  “Module Two (Controller-to-Processor) of the Standard Contractual Clauses shall apply where Customer is a Controller; Module Three (Processor-to-Processor) of the Standard Contractual Clauses shall apply where Customer is a Processor acting on behalf of another Controller.”

• Scc governing law Report an error

  “Clause 17 (Governing law): The laws of the Slovak Republic shall govern the Standard Contractual Clauses; Clause 18 (Choice of forum and jurisdiction): Disputes shall be resolved by the courts of Bratislava, Slovak Republic”

• DPA governing law Report an error

  “This DPA and any dispute or claim arising out of or in connection with it or its subject matter (including non-contractual disputes or claims) shall be governed by and construed in accordance with the laws of the Slovak Republic”

• DPA jurisdiction Report an error

  “Any disputes arising out of or in connection with this DPA shall be subject to the exclusive jurisdiction of the courts of Bratislava, Slovak Republic, with appeals to the Regional Court of Bratislava and the Supreme Court of the Slovak Republic”

• Deletion days Report an error

  “UptimeRobot shall delete all Customer Personal Data within ninety (90) days of termination unless: Customer has made a written request for return of the data; or UptimeRobot is required by applicable law to retain some or all of the Customer Personal Data.”

• Backup deletion days Report an error

  “Customer Personal Data that has been archived on backup systems shall be securely isolated and protected from further Processing and shall be deleted in accordance with UptimeRobot’s backup retention and deletion policies, which shall not exceed one hundred eighty (180) days from the date of termination.”

• Export functionality Report an error

  “Customer may retrieve Customer Personal Data prior to termination using the export functionality provided within the Services as described in the UptimeRobot support documentation.”

• Deletion certification Report an error

  “Upon Customer’s written request, UptimeRobot shall provide written certification to Customer that it has complied with the requirements of this Section 12.”

• SOC 2 type1 Report an error

  “UptimeRobot itself holds SOC 2 Type I; infrastructure providers AWS and Digital Ocean hold SOC 2 Type II and ISO 27001; Limestone Networks holds SOC 2 Type II”

• SOC 2 audit reports Report an error

  “Summary reports of third-party security audits (such as SOC 2 attestation reports);”

• Encryption Report an error

  “Strong encryption of Personal Data in transit and at rest;”

• MFA customer accounts Report an error

  “Multi-factor authentication (MFA) available for Customer accounts Two-factor authentication (2FA) required for privileged administrative access”

• Services scope Report an error

  “The subject matter of the Processing is the provision of website and application uptime monitoring services, including: Automated monitoring of websites, APIs, servers, and applications Detection and notification of downtime or performance issues Collection and storage of uptime statistics and performance metrics Status page hosting Alerting and notification services”

• Notification channels Report an error

  “to deliver notifications via email, SMS, push notifications, voice calls, and integrations.”

• Credit card storage Report an error

  “credit card information (collected and processed by third-party payment processors; UptimeRobot does not store full credit card numbers)”

• Sensitive data Report an error

  “UptimeRobot does not intentionally collect or Process special categories of Personal Data (sensitive data) as defined in Article 9 GDPR.”

• General inquiries email Report an error

  “For questions about this DPA or data protection matters, please contact: Email: support@uptimerobot.com”

• Data subject rights assistance Report an error

  “Right of access by the Data Subject (Article 15 GDPR); Right to rectification (Article 16 GDPR); Right to erasure (“right to be forgotten”) (Article 17 GDPR); Right to restriction of Processing (Article 18 GDPR); Right to data portability (Article 20 GDPR); Right to object (Article 21 GDPR); Rights in relation to automated decision making and profiling (Article 22 GDPR).”

• Dpia assistance Report an error

  “UptimeRobot shall provide reasonable assistance to Customer (at Customer’s cost) in conducting Data Protection Impact Assessments where required under Applicable Data Protection Laws.”

• Scc docking clause Report an error

  “Clause 7 (Docking clause): The optional docking clause applies; Clause 9 (Use of sub-processors): Option 2 (General written authorization) applies”

• Security measures annex Report an error

  “The technical and organizational security measures implemented by UptimeRobot are described in Annex 2(Security Measures) to this DPA.”

• API security Report an error

  “Secure API authentication using OAuth 2.0 or private app tokens Rate limiting to prevent abuse API key rotation capabilities Encrypted API communications (HTTPS/TLS)”

4 facts read from this page are not shown because they could not be confirmed on the page as captured.

Scores citing this record

• The Agency Developer API, monitoring as code & team administration
• The Agency Developer European sovereignty
• The Customer Support Lead API, monitoring as code & team administration
• The Customer Support Lead Uptime reports, data & the vendor's own reliability
• The Customer Support Lead European sovereignty
• The E-Commerce Operations Manager Uptime reports, data & the vendor's own reliability
• The E-Commerce Operations Manager European sovereignty
• The SaaS Platform Engineer Uptime reports, data & the vendor's own reliability
• The SaaS Platform Engineer European sovereignty
• The Information Security Officer API, monitoring as code & team administration
• The Information Security Officer European sovereignty
• The Skeptic API, monitoring as code & team administration
• The Skeptic European sovereignty