Skip to content
Pingwell

Data processing agreement

Effective

This data processing agreement ("DPA") is part of the terms of service between APUAMA TECNOLOGIA LTDA, CNPJ55.038.380/0001-45, Rua Deputado Lacerda Franco, 144, São Paulo/SP, 05418-000, Brazil ("Pingwell", "we") and a customer who uses Pingwell for a business ("you"). It applies to the personal data we process on your behalf while providing the Service, and takes effect when you accept the terms. Words such as controller, processor (operator), personal data and data subject have the meaning the applicable data protection law gives them: Brazil's LGPD and, where they apply, the EU and UK GDPR.

1. Roles and scope

  • You are the controller of the personal data you put into your workspaces, or a processor acting for your own customer; we are your processor (operator). For your account, billing and our website we are a controller, as our privacy policyexplains, and this DPA does not apply to that data.
  • Subject matter and duration: providing the Service under the terms, for as long as your account exists and until the data is deleted as section 8 describes.
  • Nature and purpose: storing, running and displaying what you configure: checks against the systems you name, heartbeat pings, alerts to the recipients you choose, status pages and incidents.
  • Data subjects: the members of your workspaces, the recipients of your alerts, and any person whose data appears in what you monitor, send or publish.
  • Personal data: names and email addresses, chat and webhook identifiers, IP addresses and user agents of heartbeat senders, and whatever you place in monitor settings, heartbeat bodies, status pages or incidents. The Service is not meant for sensitive personal data; do not send it.

2. Our obligations

  • We process the personal data only on your documented instructions: the terms, this DPA and what you configure in the Service. If we think an instruction breaks the law, we tell you. If a law that applies to us requires us to process the data otherwise (for data under the EU or UK GDPR, only the law of the EU, a Member State or the UK counts), we tell you first, unless that law forbids it.
  • Everyone at Pingwell with access to the data is bound to keep it confidential.
  • We help you, by the means the Service provides and by answering you at[email protected], to answer requests from data subjects, to keep the data secure, and with data protection impact assessments and consultations with authorities about the processing. A request a data subject sends to us about your data, we pass to you without answering it ourselves.

3. Security

We keep technical and organizational measures suited to the risk, including:

  • HTTPS for every connection to the Service over the internet, and TLS for our database's connections from outside its private network;
  • sign-in with a required second factor, and API keys stored only as hashes;
  • access to production systems limited to the people who run the Service;
  • daily database backups, encrypted at rest at our storage provider, kept for 14 days;
  • error reports with request bodies, cookies and known secrets removed before they leave our servers.

4. Subprocessors

You authorize the subprocessors below. Each is bound by written terms that protect the data at least as this DPA does, and we remain responsible to you for their work. Stripe, which handles our billing, processes our own data as a controller, not yours, and is not one of them.

  • Amazon Web Services: sign-in, email delivery and the checks themselves (United States, Germany, Brazil, Singapore, Australia, Japan, India).
  • Hetzner Online: application servers and database (Ashburn, Virginia, United States).
  • Cloudflare: DNS, network protection, status page hosting and backup storage (global network).
  • Sentry: error reports (United States).

We email the owners of your workspaces at least 30 days before we add or replace a subprocessor. If you object on reasonable data protection grounds and we cannot address the objection, you may close your paid plan before the change, and we refund the unused part of the period.

5. Security incidents

If a security incident affects your personal data, we tell the owners of your workspaces without undue delay, and within 48 hours of becoming aware of it, with what we know: its nature, the data and data subjects involved, its likely consequences and what we are doing about it. We add details as we learn them, and help you meet your own duties to notify authorities and data subjects.

6. International transfers

The data is processed in Brazil, the United States and the other countries listed in section 4. Where the law requires a safeguard for those transfers, the parties incorporate the standard contractual clauses approved by ANPD Resolution CD/ANPD 19/2024 for data under the LGPD, in full; the EU standard contractual clauses (Commission Implementing Decision (EU) 2021/914) for data under the EU GDPR, with module two where you are a controller and module three where you are a processor, the optional clause 7, option 2 of clause 9 with the notice period of section 4, the supervisory authority clause 13 points to, and the law and courts of Ireland for clauses 17 and 18; and the UK International Data Transfer Addendum for data under the UK GDPR, completed with those same clauses. In every set, the parties and their details are those named at the top of this DPA, the description of the transfer is section 1, the security measures are section 3 and the subprocessors are section 4. If those clauses conflict with this DPA, the clauses prevail.

7. Audits

We make available the information needed to show we meet this DPA, and answer a reasonable written security questionnaire once a year. An inspection at our premises happens only when an authority requires it or the information we gave is not enough, with 30 days' notice (or the shorter notice an authority or a security incident requires), during business hours, at your cost and under confidentiality.

8. End of the processing

You can retrieve your data through the API at any time, and when your account is closed you may choose to have a copy of all of it returned to you first. Within 30 days of the closure, we delete the personal data, except what a law that applies to us requires us to keep (for data under the EU or UK GDPR, the law of the EU, a Member State or the UK); copies in our backups are removed as those backups expire, within 14 days after that.

9. General

Each party's liability under this DPA is subject to the limits in the terms, as far as the law allows. On the protection of personal data, this DPA prevails over the terms. It is governed by the law and forum the terms name, except where the clauses of section 6 require otherwise. We may update this DPA as the terms allow; a change that reduces the protection of your data needs your agreement.