Legal

Data Processing Agreement

Last updated: March 2026

Auftragsverarbeitungsvertrag gemäß Art. 28 DSGVO

Preamble

This Data Processing Agreement ("DPA") is entered into between the customer who has accepted the Hoppla Terms of Service ("Controller") and Jakob Bennemann, Neubrückenstraße 73, 48143 Münster, Germany ("Processor") pursuant to Article 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR").

This DPA forms an integral part of the Terms of Service and applies whenever the Processor processes personal data on behalf of the Controller in connection with the Hoppla monitoring service ("Main Agreement").

1. Subject Matter, Duration, and Scope

1.1 Subject Matter

The Processor provides website monitoring, alerting, and reporting services as described in the Main Agreement. In delivering these services, the Processor processes personal data on behalf of the Controller.

1.2 Duration

This DPA is effective for the duration of the Main Agreement. It terminates automatically upon termination of the Main Agreement, subject to the data deletion provisions in Section 11.

1.3 Nature and Purpose of Processing

Processing includes:

  • Storage and management of account and team member data
  • Execution of monitoring checks against configured targets
  • Storage and retrieval of monitoring results
  • Delivery of notifications to configured channels
  • Provision of public status pages
  • Generation of reports and analytics
  • Automated incident detection and alerting

2. Types of Personal Data

  • Account data: name, email address, hashed password, language preference
  • Team membership data: user roles, team assignments
  • Monitoring target data: URLs, domains, IP addresses
  • Notification recipient data: email addresses, webhook URLs, messaging channel identifiers
  • Check result data: response times, HTTP status codes, certificate metadata, DNS records
  • Technical data: IP addresses, session identifiers, audit log entries
  • Server agent data: hostname, CPU/memory/disk metrics

3. Categories of Data Subjects

  • Account holders and team members of the Controller
  • Individuals whose contact information is configured in notification channels
  • Individuals identifiable through monitoring target URLs or domains (indirectly)

4. Obligations of the Processor

4.1 Processing Instructions

The Processor shall process personal data only on documented instructions from the Controller, including with regard to transfers to third countries or international organizations, unless required to do so by EU or Member State law. In such case, the Processor shall inform the Controller of that legal requirement before processing, unless the law prohibits such information on important grounds of public interest.

The instructions of the Controller are generally defined by the Main Agreement, the configuration of the Service by the Controller (e.g., adding monitors, configuring notifications), and any written instructions provided separately.

4.2 Confidentiality

The Processor ensures that all persons authorized to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

4.3 Security

The Processor implements appropriate technical and organizational measures pursuant to Art. 32 GDPR to ensure a level of security appropriate to the risk. These measures are described in Annex 1: Technical and Organizational Measures (TOM).

4.4 Sub-Processors

The Controller grants general authorization for the Processor to engage sub-processors as listed in Annex 2: Sub-Processor List.

The Processor shall:

  • Inform the Controller of any intended changes concerning the addition or replacement of sub-processors at least 30 days in advance
  • Ensure each sub-processor is bound by data protection obligations no less protective than those in this DPA
  • Remain fully liable to the Controller for the performance of each sub-processor's obligations

If the Controller objects to a new sub-processor within the 30-day notice period, the parties shall discuss the objection in good faith. If no resolution is reached, the Controller may terminate the Main Agreement with effect at the date the new sub-processor would be engaged.

4.5 Data Subject Rights

The Processor shall assist the Controller, by appropriate technical and organizational measures and insofar as possible, in fulfilling the Controller's obligations to respond to data subject requests under Chapter III GDPR (access, rectification, erasure, restriction, portability, objection).

If a data subject contacts the Processor directly with a request, the Processor shall promptly forward the request to the Controller and shall not respond directly unless instructed to do so.

4.6 Assistance with Compliance

Taking into account the nature of processing and the information available, the Processor shall assist the Controller in ensuring compliance with:

  • Security of processing (Art. 32 GDPR)
  • Notification of personal data breaches to the supervisory authority (Art. 33 GDPR)
  • Communication of personal data breaches to data subjects (Art. 34 GDPR)
  • Data protection impact assessments (Art. 35 GDPR)
  • Prior consultation with the supervisory authority (Art. 36 GDPR)

5. Obligations of the Controller

The Controller shall:

  • Ensure that the processing of personal data through the Service is lawful and that it has a valid legal basis
  • Provide instructions for data processing in writing or text form (including via Service configuration)
  • Inform the Processor immediately if it identifies errors or irregularities in the processing
  • Be responsible for maintaining and exercising data subject rights
  • Designate a contact person for data protection matters if required

6. Data Breach Notification

The Processor shall notify the Controller without undue delay after becoming aware of a personal data breach. Notification shall be provided within 48 hours (to allow the Controller sufficient time to meet the 72-hour obligation under Art. 33 GDPR) and shall include:

  • Description of the nature of the breach, including approximate categories and number of data subjects and records affected
  • Name and contact details of the Processor's data protection contact
  • Description of the likely consequences of the breach
  • Description of measures taken or proposed to address the breach and mitigate its effects

The Processor shall cooperate with the Controller and take commercially reasonable steps to assist in the investigation, mitigation, and remediation of the breach.

7. Audit Rights

7.1 Information and Audit

The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Art. 28 GDPR and this DPA, and shall allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller.

7.2 Audit Procedure

Audits shall be conducted with reasonable advance notice (at least 30 days), during normal business hours, and in a manner that minimizes disruption to the Processor's operations. The Controller shall bear the costs of any audit unless the audit reveals material non-compliance by the Processor.

7.3 Certifications and Reports

Where available, the Processor may satisfy audit obligations by providing: up-to-date security certifications, third-party audit reports (e.g., SOC 2), or completed security questionnaires. The Controller shall consider such documentation before requesting an on-site audit.

8. International Data Transfers

All primary data storage occurs within the European Union (Hetzner Cloud, Germany and Finland).

Where personal data is transferred to sub-processors outside the EU/EEA, the Processor ensures that appropriate safeguards are in place in accordance with Chapter V GDPR, including:

  • EU Standard Contractual Clauses (SCCs) per Commission Implementing Decision (EU) 2021/914
  • Transfer impact assessments per EDPB Recommendations 01/2020
  • Supplementary measures where necessary (encryption, access controls, pseudonymization)

9. Data Protection Impact Assessment

Where a type of processing is likely to result in a high risk to the rights and freedoms of natural persons, the Processor shall assist the Controller in carrying out a data protection impact assessment (DPIA) pursuant to Art. 35 GDPR, and where appropriate, prior consultation with the supervisory authority pursuant to Art. 36 GDPR.

10. Instruction Handling

If the Processor considers that an instruction from the Controller infringes the GDPR or other EU or Member State data protection provisions, it shall immediately inform the Controller. The Processor is entitled to suspend the execution of the relevant instruction until it is confirmed or modified by the Controller.

11. Data Return and Deletion

11.1 Data Export

The Controller may export its data at any time during the term of the Main Agreement via the data export functionality (Settings > Data & Privacy > Export Data). Data is provided in JSON format.

11.2 Deletion Upon Termination

Upon termination of the Main Agreement, the Processor shall:

  • Maintain the Controller's data for a 30-day grace period to allow final data export
  • After the grace period, delete all personal data processed on behalf of the Controller within 30 additional days
  • Confirm deletion upon request from the Controller

11.3 Retention Exceptions

Data may be retained beyond termination only where required by EU or Member State law (e.g., tax records per §147 AO). Such retained data will be restricted from further processing and deleted once the legal retention period expires.

12. Governing Law

This DPA is governed by the laws of the Federal Republic of Germany. The provisions of the GDPR and the German Federal Data Protection Act (BDSG) apply.

13. Annexes

Contact

To request a signed copy of this DPA, report a data breach, or for questions:
Email: [email protected]