Data processing agreement

Who this is for

This agreement is for customers who use Up’n’Top to monitor websites of their own clients — usually agencies — or who otherwise put personal data of others into Up’n’Top. It is part of the Terms of service (https://upntop.com/terms) and applies automatically: you do not need to sign anything. If you need a signed copy for your records or your client, write to support@upntop.com and we will send one.

Roles

You (the customer) are the controller of the personal data in your organization: data of your clients and their sites in reports, alerts, notification recipients and the members you invite. We, Denis Malov s.p., Mlinska ulica 22, 2000 Maribor, Slovenia, are your processor (GDPR Art. 28). For our own account, billing and security data we are the controller, as described in the Privacy policy (https://upntop.com/privacy).

What we process

Subject matter: monitoring of the websites you add and the reports and alerts you configure. Data: addresses and public content of the sites, names and email addresses of members and notification recipients, data of services you connect. Data subjects: your staff, your clients and their contacts. Duration: as long as your organization exists, plus the deletion period below.

Our commitments

We process the data only on your documented instructions — your settings and use of the service — unless the law requires otherwise; if we believe an instruction breaks the law, we tell you.

Everyone who can access the data is bound to confidentiality.

We help you answer requests from data subjects and, where needed, with data protection impact assessments and consultations with authorities.

We tell you about a personal data breach that affects your data without undue delay, and in any case within 72 hours of becoming aware of it.

On request we give you the information needed to show compliance with this agreement and answer reasonable audit questions in writing.

Security

Data is hosted within the European Union (Germany). Traffic is encrypted with TLS; access tokens and keys of connected services are stored encrypted (AES-256-GCM) with a key kept outside the database; backups are encrypted before they leave our server. Access to production systems is limited to the people who run the service.

Subprocessors

You authorize the subprocessors listed at https://upntop.com/subprocessors. We bind each of them to data protection obligations at least as strict as these. We give at least 30 days’ notice of a new subprocessor to customers who asked for it; you may object on reasonable data protection grounds, and if we cannot address the objection you may cancel and get a refund of the unused part of the period.

Transfers

We keep your data in the EU. Where a subprocessor or its group is outside the EU, the transfer is covered by the EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework.

Deletion and return

You can delete sites, the organization or your account at any time. When the organization is deleted or the contract ends, we delete the personal data from the live database within 30 days, and encrypted backup copies are overwritten within 90 days, unless the law requires us to keep it.

Liability and law

Liability under this agreement follows the Terms of service. This agreement is governed by the law of Slovenia. If it conflicts with the Terms of service on data protection, this agreement prevails.