Data Processing Agreement

Version: 1.1 Effective Date: August 19, 2026 (Version 1.0, August 9, 2026 — changed in 1.1: Twilio added to Annex III for the server-provided SMS and voice sending mode.)

This Data Processing Agreement ("DPA") forms part of the Terms of Service between WEBINGENIA SARL ("SolidPing", "Processor", "we") and the customer using the SolidPing hosted service ("Customer", "Controller", "you").

It reflects the requirements of Article 28 of Regulation (EU) 2016/679 ("GDPR"). It takes effect automatically when you start using the hosted service; no signature is required. If your procurement process needs a countersigned copy, email contact@solidping.io.

1. Definitions​

Terms defined in the GDPR — personal data, processing, controller, processor, sub-processor, data subject, personal data breach, supervisory authority — carry the same meaning here.

• Customer Personal Data means personal data contained in the data the Customer submits to, or which is generated by, the hosted service, and which SolidPing processes on the Customer's behalf.
• Service means the SolidPing hosted (SaaS) monitoring service, including its dashboard, API, notification channels, status pages, and check agents.
• EU SCCs means the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914.

2. Roles of the parties​

The Customer is the controller of Customer Personal Data. SolidPing is the processor, and processes Customer Personal Data only on the Customer's documented instructions.

SolidPing acts as an independent controller — not a processor — for a limited set of data it needs for its own purposes: account and billing records, security and audit logs, abuse prevention, and aggregated product analytics. That processing is described in the Privacy Policy and is outside the scope of this DPA.

3. Scope and instructions​

3.1 SolidPing processes Customer Personal Data only to provide the Service in accordance with the Terms of Service, this DPA, and any further documented instructions the Customer gives (including instructions given through the Service's own configuration, such as which channels receive notifications).

3.2 The subject matter, duration, nature, purpose, categories of data, and categories of data subjects are set out in Annex I.

3.3 SolidPing will inform the Customer if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection law, and may suspend execution of that instruction until it is confirmed or withdrawn.

3.4 SolidPing does not sell Customer Personal Data, does not use it for advertising, and does not use it to train machine-learning models.

4. Confidentiality​

SolidPing ensures that every person authorised to process Customer Personal Data is bound by an obligation of confidentiality, whether contractual or statutory, and is subject to the access controls described in Security measures.

5. Security​

SolidPing implements appropriate technical and organisational measures under Article 32 GDPR. Those measures are described in Annex II and maintained in detail at Security measures. SolidPing may update them, but will not reduce the overall level of protection during the term of this DPA.

6. Sub-processors​

6.1 The Customer gives SolidPing general written authorisation to engage sub-processors, subject to this clause.

6.2 The sub-processors engaged on the Effective Date are listed in Annex III and kept current at Sub-processors.

6.3 Before adding or replacing a sub-processor, SolidPing will give the Customer at least 30 days' notice by email to the account's administrative contacts and by updating the sub-processor page.

6.4 The Customer may object to a new sub-processor on reasonable, documented data-protection grounds within that 30-day period. The parties will discuss the objection in good faith. If it cannot be resolved, the Customer may terminate the affected part of the Service without penalty and receive a pro-rata refund of any prepaid fees for the unused period.

6.5 SolidPing imposes on each sub-processor data protection obligations no less protective than those in this DPA, and remains fully liable to the Customer for its sub-processors' performance.

7. International transfers​

7.1 The Service's core infrastructure — application servers, the database, and backups — is located in France (EU). Regional check workers, which receive check definitions and return their results but hold no database, additionally run in the United States and in whichever other regions the Customer selects. Where SolidPing sends SMS or voice alerts on its own provider credentials, the recipient's phone number and the alert text are additionally processed in the United States and delivered onward by the recipient's mobile network.

7.2 Where personal data is transferred to a country outside the EEA without an adequacy decision, the transfer is covered by the EU SCCs, which are incorporated into this DPA by reference, with:

• Module Two (controller to processor) applying between the Customer and SolidPing where the Customer is established outside the EEA;
• Module Three (processor to processor) applying between SolidPing and any sub-processor located outside the EEA;
• Clause 7 (docking clause) not applying;
• Clause 9(a) Option 2 (general written authorisation) applying, with the 30-day notice period in clause 6.3 above;
• Clause 11 optional independent dispute resolution not applying;
• Clause 17: the law of France;
• Clause 18(b): the courts of Paris, France;
• Annexes I, II, and III of the EU SCCs populated by Annexes I, II, and III of this DPA.

7.3 Transfers to the United Kingdom rely on the UK adequacy decision; where that decision lapses, the UK International Data Transfer Addendum applies to the EU SCCs above.

7.4 The transfers actually taking place today, and the safeguards for each, are listed at Sub-processors → International transfers.

8. Assistance with data subject rights​

8.1 The Service gives the Customer direct, self-service means to access, export, correct, and delete Customer Personal Data — see Exercise your rights.

8.2 Where a data subject contacts SolidPing directly with a request concerning Customer Personal Data, SolidPing will not respond on the merits. It will forward the request to the Customer without undue delay and, where it can be identified, tell the data subject to contact the Customer.

8.3 Taking into account the nature of the processing, SolidPing assists the Customer by appropriate technical and organisational measures, insofar as possible, in fulfilling requests under Chapter III GDPR. Where self-service tooling does not cover a request, SolidPing provides reasonable assistance at no charge for requests of ordinary scope.

9. Assistance with Articles 32 to 36​

SolidPing assists the Customer, taking into account the nature of processing and the information available to it, in complying with:

• Article 32 — security of processing (see Security measures);
• Articles 33 and 34 — personal data breach notification (clause 10 below);
• Articles 35 and 36 — data protection impact assessments and prior consultation, by providing the information in this DPA and, on request, reasonable additional detail about the Service's architecture.

10. Personal data breach​

10.1 SolidPing notifies the Customer without undue delay and in any event within 48 hours of becoming aware of a personal data breach affecting Customer Personal Data.

10.2 The notification describes, to the extent known: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point for further information. Where the full picture is not available at once, SolidPing provides information in phases without further undue delay.

10.3 SolidPing does not notify supervisory authorities or data subjects on the Customer's behalf unless the Customer instructs it to in writing.

11. Audit​

11.1 SolidPing makes available to the Customer all information necessary to demonstrate compliance with Article 28 GDPR, primarily through the documentation published at Legal & GDPR.

11.2 The Customer may, at most once per twelve-month period, request an audit. SolidPing will first offer to satisfy it with existing documentation and a written questionnaire. Where that is genuinely insufficient, the Customer (or an independent auditor bound by confidentiality and not a competitor of SolidPing) may conduct an on-site or remote audit during business hours, on at least 30 days' written notice, at the Customer's cost, and in a way that does not compromise the security or availability of the Service or the confidentiality of other customers' data.

11.3 An additional audit may be conducted, at the Customer's cost, following a personal data breach affecting the Customer or where a supervisory authority requires it.

12. Deletion and return​

12.1 On termination or expiry of the Customer's use of the Service, SolidPing deletes Customer Personal Data in accordance with the retention schedule in the Privacy Policy. The Customer may export its data through the Service at any time before deletion, and for 30 days afterwards on request.

12.2 Backups containing Customer Personal Data expire on their own rolling schedule and are not selectively purged. Data in expired-but-not-yet-overwritten backups remains subject to the security measures in this DPA and is not restored into production.

12.3 SolidPing may retain Customer Personal Data where Union or Member State law requires it — notably accounting and invoicing records — and in that case processes it only for the purpose and duration of that obligation.

13. Liability​

Each party's liability under this DPA is subject to the limitations and exclusions of liability set out in the Terms of Service. Nothing in this DPA limits any liability that cannot be limited under applicable law, including liability to data subjects under Article 82 GDPR.

14. Term, order of precedence, and changes​

14.1 This DPA takes effect when the Customer starts using the Service and continues until the Customer stops using it and all Customer Personal Data has been deleted or returned.

14.2 In case of conflict, the order of precedence is: (1) the EU SCCs where they apply, (2) this DPA, (3) the Terms of Service, (4) any other document.

14.3 SolidPing may update this DPA to reflect changes in law, in the Service, or in its sub-processors. Material changes are announced on this page and, where they affect the Customer's rights, by email at least 30 days in advance. The version number and Effective Date at the top of this page identify the current version.

14.4 This DPA is governed by French law. Disputes fall under the exclusive jurisdiction of the courts of Paris, France.

Annex I — Description of the processing​

A. Parties​

Controller / data exporter: the Customer, i.e. the legal entity or individual holding the SolidPing account. Contact details are those recorded in the account's billing and administrative settings. Activities relevant to the transfer: use of a monitoring and incident-management service for its own IT systems.

Processor / data importer: WEBINGENIA SARL, 14 rue Félix Faure, 75015 Paris, France — SIREN 519 411 680. Contact: contact@solidping.io. Activities relevant to the transfer: providing a hosted monitoring and incident-management service.

B. Description of the processing​

Subject matter. Provision of the SolidPing hosted monitoring and incident-management service.

Duration. For the term of the Customer's use of the Service, plus the retention periods in the Privacy Policy.

Nature and purpose. Collection, storage, structuring, consultation, use, transmission (to notification channels the Customer designates), erasure — for the purpose of running availability checks, detecting and managing incidents, notifying the people the Customer designates, publishing status pages the Customer creates, authenticating users, and supporting the Customer.

Categories of data subjects:

• the Customer's users of the Service (administrators, responders, viewers);
• individuals the Customer adds as notification recipients or places on on-call schedules, whether or not they hold an account;
• individuals who subscribe to a status page the Customer publishes;
• individuals whose personal data the Customer chooses to place in free-text fields (check names, incident comments, runbooks, webhook payloads).

Categories of personal data:

Special categories of data (Article 9). None are requested and none are required by the Service. The Customer must not place special-category data in free-text fields.

Frequency of processing. Continuous, for the duration of the Service.

Retention. Per the schedule in the Privacy Policy.

C. Competent supervisory authority​

The Commission Nationale de l'Informatique et des Libertés (CNIL), France — www.cnil.fr — as the authority of the processor's place of establishment. Where the Customer is established in another EEA state and acts as data exporter under the EU SCCs, the competent authority is that of the Customer's place of establishment.

Annex II — Technical and organisational measures​

The measures below are summarised here for contractual purposes and described in full, with current detail, at Security measures.

Annex III — Sub-processors​

The authorised sub-processors as of the Effective Date. The current list, including any changes since, is always at Sub-processors.

Notification channels the Customer configures — Slack, Discord, Microsoft Teams, Mattermost, Google Chat, Pushover, ntfy, Opsgenie, Twilio under the Customer's own credentials, generic webhooks, and similar — are recipients designated by the Customer, not sub-processors of SolidPing. The Customer is responsible for its own relationship with those providers, including any transfer safeguards. The same applies to identity providers the Customer chooses for single sign-on.

Twilio appears in the table above only for the server-provided sending mode, where SolidPing sends on its own credentials and on its own account. A Customer that connects its own Twilio integration is covered by the paragraph immediately above instead, and self-hosted deployments have no sub-processors at all.