Data processing agreement

This data processing agreement is between you, the organization that holds a Moonitor account (the “Customer”), and Edington Ltd, a company registered in England and Wales (company number 15548727), whose registered office is at 7 Hardwicke Road, Reigate, RH2 9HJ, United Kingdom, which runs Moonitor (“we”, “us”).

It forms part of our terms of service and applies whenever we process Customer Personal Data to provide the service. If you need a countersigned copy for your records, print this page or save it as a PDF (signature blocks appear at the end), sign it and send it to hello@moonitor.dev, and we’ll countersign and return it.

If this agreement and the terms conflict, this agreement wins on anything to do with personal data. Where the standard contractual clauses apply (section 8), they win over both.

• Data Protection Law means the EU General Data Protection Regulation (Regulation (EU) 2016/679), the UK GDPR and the Data Protection Act 2018, and any other data protection law that applies to the processing.
• Customer Personal Data means personal data that the Customer, or people using its account, put into Moonitor and that we process on the Customer’s behalf. Annex 1 describes it.
• Controller, processor, data subject, personal data, personal data breach, processing and supervisory authority have the meanings Data Protection Law gives them.
• Subprocessor means a third party we engage to process Customer Personal Data.
• SCCs means the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914, and the UK Addendum means the International Data Transfer Addendum to them issued by the UK Information Commissioner.

For Customer Personal Data, the Customer is the controller and we are its processor. If the Customer processes it on behalf of its own clients (an agency running their status pages, for example), the Customer is their processor and we are its subprocessor. The Customer is then responsible for passing their instructions on to us and for having their authorisation for this agreement, including our subprocessors.

This agreement doesn’t cover personal data we handle for our own purposes as a controller, such as login and team details, billing, support conversations and website analytics. Our privacy policy covers those.

The Customer is responsible for having a lawful basis for the Customer Personal Data it puts into Moonitor and for anything it owes the people that data is about, such as telling them. The Customer won’t put special category data (health, biometric or genetic data, for example) or criminal offence data into Moonitor; the service isn’t designed for it.

We process Customer Personal Data only on the Customer’s documented instructions: the terms of service, this agreement, and the way the Customer configures and uses Moonitor (the monitors, alert contacts and status pages it sets up). We don’t sell Customer Personal Data or use it for purposes of our own.

If the law requires us to process Customer Personal Data in any other way, we’ll tell the Customer first, unless the law forbids that. If we believe an instruction breaks Data Protection Law, we’ll say so.

Everyone we authorise to process Customer Personal Data is bound by confidentiality, and access is limited to the people who need it to run or support the service.

We protect Customer Personal Data with the technical and organisational measures in Annex 2, which are designed to meet Article 32 of the GDPR. We may change them over time, but never in a way that lowers the overall level of protection.

The Customer gives us general authorisation to use subprocessors. Annex 3 lists the ones we use today.

Before we add or replace a subprocessor, we’ll update that list and email the Customer’s account owner at least 30 days in advance. If the Customer objects on reasonable data protection grounds within that period, we’ll work with it in good faith to find a solution. If we can’t, the Customer may close its account, and we’ll refund any prepaid subscription fees for the period after it closes.

Every subprocessor is bound by a written contract with data protection obligations at least as protective as this agreement’s, and we remain responsible to the Customer for how each of them meets those obligations.

We store Customer Personal Data in the European Union, on our server in Hetzner’s Helsinki data centre in Finland. Edington Ltd is established in the United Kingdom, which the European Commission has recognised as providing an adequate level of protection (a decision renewed on 19 December 2025 and in force until 27 December 2031). Transfers of Customer Personal Data from the EEA to us rely on that decision.

Some subprocessors in Annex 3 are outside the UK and the EEA. Where one of them processes Customer Personal Data, we make sure the transfer is covered by an adequacy decision or by appropriate safeguards under Article 46 of the GDPR, such as the SCCs (with the UK Addendum for data subject to the UK GDPR).

If the UK adequacy decision stops applying, or a supervisory authority or court decides that transfers of Customer Personal Data from the EEA to us need further safeguards, the SCCs apply between the Customer (as data exporter) and us (as data importer). They are incorporated into this agreement by reference, as follows:

• Module Two (controller to processor) applies where the Customer is a controller, and Module Three (processor to processor) where it is a processor.
• Clause 7 (docking clause) applies.
• Clause 9: option 2 (general written authorisation) applies, with the 30-day notice period in section 6.
• Clause 11: the optional wording does not apply.
• Clause 13: the competent supervisory authority is the one Clause 13(a) identifies.
• Clauses 17 and 18: the SCCs are governed by Irish law, and the courts of Ireland decide disputes about them.
• Annexes I, II and III of the SCCs are completed by section 1 and Annexes 1, 2 and 3 of this agreement.

If anything in this agreement conflicts with the SCCs, the SCCs prevail.

If we become aware of a personal data breach affecting Customer Personal Data, we’ll notify the Customer’s account owner without undue delay, and in any event within 48 hours. We’ll share what we know (what happened, the kinds and approximate number of people and records involved, the likely consequences and what we’re doing about it) and keep the Customer updated as we learn more, so it can meet its own obligations. Telling the Customer about a breach is not an admission of fault.

Most requests from the people the data is about (access, correction, deletion, export) the Customer can handle itself in the dashboard or through the public API. If we receive such a request directly about Customer Personal Data, we’ll pass it to the Customer rather than answer it, unless the law requires otherwise. We’ll also give reasonable help with data protection impact assessments and with consultations with a supervisory authority, taking into account what we process and what we know.

The Customer can export Customer Personal Data through the public API at any time, and delete it from the dashboard. When the Customer deletes its account, we delete Customer Personal Data from our live systems straight away, and it leaves our backups within 14 days. If a subscription ends without the account being deleted, we keep the data so the Customer can come back or export it; it can delete it at any time, or ask us to. The only exception is data the law requires us to keep.

We’ll make available the information the Customer reasonably needs to show that we comply with this agreement, including answers to reasonable security questionnaires. If that isn’t enough, the Customer, or an independent auditor bound by confidentiality, may audit our compliance once a year, with at least 30 days’ written notice, during business hours and at the Customer’s cost. More frequent audits are allowed where a supervisory authority requires one or after a personal data breach. An audit can’t give access to other customers’ data or put the security of the service at risk.

Each party’s liability under this agreement is subject to the limits and exclusions in the terms of service, except where Data Protection Law doesn’t allow liability to be limited. Nothing here limits the rights data subjects have under the SCCs.

This agreement lasts for as long as we process Customer Personal Data for the Customer. We may update it to reflect changes in the law or in the service. We’ll change the date at the top when we do, and email account owners before any change that reduces the Customer’s protection takes effect.

This agreement is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction over any dispute about it, except the SCCs, which are governed as section 8 sets out.

How long each kind of data is kept:

• Hosting and network. Customer Personal Data is stored on our server in Hetzner’s Helsinki data centre in Finland. Its firewall refuses all inbound traffic except SSH, HTTP and HTTPS, and the database and cache accept connections only from the server itself.
• Encryption in transit. The service is only served over HTTPS (TLS), with HTTP Strict Transport Security, and certificates are issued and renewed automatically. Requests between our servers and our verification locations travel over TLS and are signed.
• Credentials and secrets. Account passwords and status page passwords are hashed with scrypt. API keys are stored only as hashes. Webhook signing secrets are encrypted at rest with AES-256-GCM.
• Access control. The server accepts SSH logins by key only, from a single administrative account, with root login disabled and repeated failed attempts blocked. In the application, every request is scoped to one organization, owners and members have separate roles, and sign-in and API requests are rate limited.
• Data minimisation. Our verification locations receive only what they need to repeat a check, the target and its configured request headers, and never account, team or alerting details. Failure evidence is limited to allow-listed headers and 8 KB of response body. Full payment card numbers never reach us.
• Backups and availability. The database is backed up daily, and backups are kept for 14 days. We monitor the service ourselves, from several countries.
• Errors and logs. Error reports and application logs are kept on our own infrastructure, not sent to a third-party tracking service.
• People. Access to production systems is limited to the people who run the service, who are bound by confidentiality.
• Incidents. We tell you about a personal data breach within 48 hours of becoming aware of it (section 9).

Transfers outside the UK and EEA are covered as section 7 describes. The same list is in our privacy policy, and changes to it follow section 6.