Data Processing Agreement

1. Roles of the parties

For personal data contained in the error events you send to Vakt360 ("Customer Data"), you are the controller and Dalysie AS is the processor. Where you are yourself a processor for your own customers, we act as a sub-processor. This DPA applies to the extent the GDPR or equivalent data-protection law applies to your use of the service.

2. Subject matter, nature, purpose and duration

We process Customer Data to provide the Vakt360 error-monitoring service: receiving events, grouping them into issues, symbolicating stack traces, storing them for your retention window, and alerting you. Processing lasts for the duration of your subscription and the applicable retention period, after which the data is deleted.

3. Types of personal data and categories of data subjects

The personal data processed is whatever your applications include in their events, which you control through your SDK configuration. It may include identifiers such as user id, email, username or IP address, and request and device context. Data subjects are the end users and systems of your applications. You agree not to route special-category data through the service, and our pipeline redacts common sensitive values before storage.

4. Processing on your instructions

We process Customer Data only on your documented instructions, which include your configuration of the service and this DPA, unless required otherwise by law (in which case we will tell you, unless the law forbids it). We ensure that personnel authorised to process Customer Data are bound by confidentiality.

5. Security measures

We implement appropriate technical and organisational measures, including: encryption of data in transit; a private database reachable only from our own services; secrets held in a managed key vault; server-side redaction of sensitive values in events before storage; access controls with hashed passwords and optional two-factor authentication; a web application firewall; and audit logging of security-relevant actions. Measures may evolve, but we will not materially reduce the overall level of security.

6. Subprocessors

You authorise us to engage the subprocessors listed on our subprocessors page to help provide the service. We impose data-protection obligations on each subprocessor no less protective than those in this DPA, and we remain responsible for their performance. We will update the list before adding or replacing a subprocessor that processes Customer Data; you may object on reasonable data-protection grounds by contacting us.

7. Assisting with data-subject requests

Taking into account the nature of the processing, we assist you with appropriate measures to fulfil your obligation to respond to data-subject requests (access, rectification, erasure, and so on). Because you control your events, you can also locate and delete affected events through the service and your retention settings.

8. Personal data breaches

We notify you without undue delay after becoming aware of a personal data breach affecting Customer Data, with the information reasonably available to help you meet your own notification obligations.

9. Deletion and return

On expiry or termination of your subscription, we delete Customer Data in line with the retention window and our routine deletion processes, unless retention is required by law. You can also export your account before deletion.

10. Audits and information

We make available the information reasonably necessary to demonstrate compliance with this DPA and, on reasonable prior notice and subject to confidentiality, will contribute to audits conducted by you or an auditor you mandate, limited to the processing of your Customer Data and to what is proportionate.

11. International transfers

Customer Data is hosted and processed in the European Union. Where a subprocessor processes data outside the EU/EEA, we rely on an appropriate transfer mechanism, such as the EU Standard Contractual Clauses, together with additional safeguards as needed. See the subprocessors page for locations.

12. Term and precedence

This DPA takes effect when you accept the Terms of Service and remains in force while we process Customer Data for you. If there is a conflict on data-protection matters, this DPA prevails over the Terms of Service for Customer Data.

This document is written in plain language and reflects how we operate. It is not legal advice; for a countersigned agreement or specific contractual terms, contact support@vakt360.com.