Data Processing Agreement
Last updated
This agreement supplements the Terms of Service between the customer ("Controller") and Unhandled ("Processor") and applies when the telemetry the Controller sends to Unhandled contains personal data subject to the GDPR or similar laws.
1. Subject matter and duration
The Processor stores, indexes and displays telemetry (traces, logs, metrics, exceptions and analytics events) on the Controller’s behalf for the term of the Terms of Service and the retention period that follows.
2. Nature of the data
Categories of data subjects: end users of the Controller’s applications and the Controller’s staff.
Categories of personal data: whatever the Controller’s applications include in telemetry, typically user ids, email addresses, IP addresses, user agents and request URLs. The Controller decides what is sent and should avoid special categories of data.
3. Processor obligations
The Processor processes personal data only on the Controller’s documented instructions, which are the Terms of Service, this agreement and the Controller’s use of the product settings.
Everyone authorized to process the data is bound by confidentiality.
The Processor applies appropriate technical and organizational measures, including encryption in transit, access control by organization and team, encrypted storage of secrets, and audit of administrative access.
The Processor assists the Controller, taking into account the nature of the processing, with data subject requests, security, breach notification and data protection impact assessments.
4. Sub-processors
The Controller gives general authorization for the Processor to use sub-processors. The Processor keeps a current list, gives at least 30 days notice of additions, and lets the Controller object on reasonable grounds.
Current sub-processors: Hetzner Online GmbH (EU) for hosting, and Cloudflare, Inc. for edge delivery and email delivery.
5. Personal data breaches
The Processor notifies the Controller without undue delay, and in any case within 48 hours, after becoming aware of a breach affecting the Controller’s personal data, with the information the Controller needs to meet its own obligations.
6. Deletion and return
Telemetry is deleted automatically when it passes the plan retention period. When the agreement ends the Processor deletes remaining personal data within 30 days unless the law requires it to be kept. The Controller can export data through the product before then.
7. Audits
The Processor makes available the information needed to show compliance with this agreement and allows audits by the Controller or an auditor it appoints, on reasonable notice and no more than once a year unless a breach has occurred.
8. International transfers
Where personal data is transferred outside the European Economic Area, the parties rely on an adequacy decision or the Standard Contractual Clauses (Module 2 or Module 3 as applicable), which are incorporated by reference.