Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between you, the customer, and Atlas IT S.à r.l.-S ("we", "us"). It applies whenever we process personal data on your behalf to provide BackupSentinel, and sets out the terms required by Article 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR"). Words defined in the Terms have the same meaning here; "controller", "processor", "personal data", "processing", "data subject" and "personal data breach" have the meaning given in the GDPR. "Customer Personal Data" means the personal data contained in Your Data.

1. Roles and scope

1.1 Roles. You are the controller of Customer Personal Data and we are your processor. Where you process that data on behalf of your End Clients, you act as their processor and we act as your subprocessor; you remain our only point of contact.

1.2 What this DPA does not cover. Personal data we process as a controller in our own right, such as your account, billing and contact details and visits to our website, is covered by our Privacy Policy, not by this DPA.

1.3 Details. Annex 1 describes the processing: its subject matter, duration, nature and purpose, and the categories of data and data subjects.

2. Your instructions

2.1 Documented instructions. We process Customer Personal Data only on your documented instructions. Your instructions are the Terms, this DPA, and the way you use and configure the Service. Further instructions must be in writing and consistent with the Terms.

2.2 Legal requirements. If European Union or member-state law requires us to process Customer Personal Data in another way, we tell you before processing, unless that law forbids it.

2.3 Unlawful instructions. We tell you promptly if, in our opinion, an instruction infringes the GDPR or other data protection law.

2.4 Your responsibilities. You are responsible for having a lawful basis for the processing and for informing data subjects, including your End Clients' staff, as required by law (Terms section 5.6). You will not send special categories of personal data to the Service.

3. Confidentiality

Everyone we authorise to process Customer Personal Data is bound by a duty of confidentiality and has access only as far as their work requires it. When our support accesses a workspace, the activity log shows it as support access.

4. Security

We apply the technical and organisational measures described in Annex 2, as required by Article 32 of the GDPR. We may change them as technology evolves, provided the overall level of protection is not reduced.

5. Subprocessors

5.1 Authorisation. You give us general authorisation to engage subprocessors. The current subprocessors, what each one does, and where, are listed on our subprocessors page.

5.2 New subprocessors. We give at least 30 days' notice by email before a new subprocessor processes Customer Personal Data, and update the subprocessors page. You may object on reasonable grounds within that period. If we cannot resolve the objection, you may cancel without charge, and we refund the fees paid for the period after the cancellation.

5.3 Same obligations. We impose on each subprocessor, by written contract, data protection obligations that offer at least the same protection as this DPA. We remain liable to you for the performance of their obligations.

6. Where the data is processed

The Service is hosted in the European Union. Some subprocessors process limited data outside the European Economic Area, as shown on the subprocessors page; for example, when AI explanations are on, the redacted excerpt of a report is processed by our AI provider outside the European Union. Any such transfer is covered by a safeguard under Chapter V of the GDPR: an adequacy decision of the European Commission or the Commission's standard contractual clauses.

7. Assistance

7.1 Data subject requests. The Service lets you find, export, correct and delete Customer Personal Data. If a data subject contacts us directly about Customer Personal Data, we pass the request to you without undue delay and do not answer it ourselves, except to tell the person that we have done so.

7.2 Other obligations. Taking into account the nature of the processing and the information available to us, we assist you with your obligations under Articles 32 to 36 of the GDPR: security, notification of personal data breaches, data protection impact assessments and prior consultation of a supervisory authority.

8. Personal data breaches

8.1 Notification. If we become aware of a personal data breach affecting Customer Personal Data, we notify the workspace owner by email without undue delay, and no later than 72 hours after becoming aware of it.

8.2 Content. The notification describes, as far as we know at the time, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Where we cannot give all of this at once, we give it in stages without further undue delay.

8.3 Response. We take reasonable steps to contain the breach and limit its consequences. A notification is not an admission of fault or liability.

9. Deletion and return

9.1 During the agreement. Report emails, alert history and report history are deleted once they are older than your plan's retention period, shown on the pricing page. The workspace owner can delete the whole workspace at any time in its settings; it is then removed at once and cannot be recovered.

9.2 At the end. When the agreement ends, you can export your clients, jobs, alerts and contacts for 30 days (Terms section 10.6). After that, we delete Customer Personal Data, unless European Union or member-state law requires us to keep it.

10. Information and audits

10.1 Information. On request, we make available the information needed to demonstrate compliance with this DPA, including written answers to reasonable security questionnaires.

10.2 Audits. Where that information is not enough, or where a supervisory authority requires it, you may audit our compliance with this DPA, no more than once a year, with at least 30 days' written notice, during business hours, at your own cost, and through an auditor bound by confidentiality. An audit does not give access to other customers' data or to our subprocessors' premises; for subprocessors, we provide their own reports and certifications where available.

11. General

11.1 Duration. This DPA applies for as long as we process Customer Personal Data on your behalf.

11.2 Liability. Each party's liability under this DPA is subject to section 12 of the Terms, to the extent permitted by the GDPR.

11.3 Precedence. If this DPA and the Terms conflict on the processing of personal data, this DPA prevails (Terms section 1.5).

11.4 Governing law. This DPA is governed by the same law and the same courts as the Terms (Terms section 17).

11.5 Contact. Questions about this DPA and data protection go to security@backupsentinel.com.

Annex 1: Description of the processing

• Subject matter: providing the Service under the Terms.
• Duration: the term of the agreement, plus up to 30 days for export, then deletion (section 9).
• Nature and purpose: receiving and reading backup report emails; storing clients, jobs, statuses, alerts and reports; detecting missing reports; sending alerts and reports through the channels you configure; generating AI explanations when they are on; providing support.
• Data subjects: your users; the contact persons of your End Clients; recipients of alerts and reports; and people whose names or addresses appear in report emails, such as senders and administrators of backup software.
• Personal data: names, email addresses and phone numbers you enter for users, contacts and on-call people; sign-in data such as email address and two-factor settings; activity log entries; report emails and their sender and recipient addresses; any personal data that backup software includes in its reports, such as user, device or host names; device logins you choose to record, stored encrypted.
• Special categories: none. The Service is not designed for them, and you will not send them (section 2.4).
• Frequency: continuous, for as long as the Service is used.
• Retention: as in section 9.

Annex 2: Technical and organisational measures

• Encryption in transit: every page and API call uses HTTPS, and browsers are told to accept nothing else (HSTS).
• Encryption at rest: the database and file storage are encrypted at rest by the hosting providers listed on the subprocessors page.
• Secrets: device logins are encrypted with AES-256-GCM before they are stored, and only owners and admins can reveal one, each reveal being logged. API keys are shown once and only a hash is kept. Webhook signing secrets are shown once and stored encrypted.
• Access control: each workspace's data is separated from other workspaces' in the database. Roles (owner, admin, member, viewer) limit what each user can see and do. Two-factor sign-in is available to every user, and an owner or admin can require it for the whole workspace.
• Activity log: actions taken in the workspace, by your team and by BackupSentinel, are recorded; entries cannot be edited or deleted, and support access is labelled as such.
• Ingest addresses: the addresses that receive report emails contain random tokens.
• AI explanations: before an excerpt is sent to our AI provider, host names, addresses, paths, keys, identifiers and client, job and workspace names are removed. The provider does not use it to train its models.
• Retention and deletion: data older than the plan's retention period is deleted each night (section 9.1).
• Monitoring: the scheduled checks and background tasks are watched by a separate health check that alerts us when one stops.
• Personnel: access to production systems is limited to the people who need it to run the Service, who are bound by confidentiality.