Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between Simplisik LLC, a Tennessee limited liability company (“we”), and the customer that owns a Pulseback workspace (“you”). It applies automatically whenever we process personal data on your behalf, and it is the agreement required by Article 28 of the GDPR and the UK GDPR and by US state privacy laws. If you need a countersigned copy for your records, email privacy@pulseback.io (section 14).

1. Scope and roles

• You are the controller (or “business”) of the personal data in your workspace (“Customer Personal Data”), and we are your processor (or “service provider”). Where you are yourself a processor for your own customers, we are your subprocessor, and you confirm your controller has authorized our appointment.
• This DPA doesn’t cover information we handle as a controller (your account, billing, support and the security of the Services), which our Privacy Policy describes.

2. Processing on your instructions

We process Customer Personal Data only on your documented instructions: these Terms and this DPA, and how you configure and use the Services (the monitors, schedules, notification rules, integrations, status pages and AI features you turn on). We will tell you if we believe an instruction breaks data protection law, and we won’t process Customer Personal Data for any other purpose unless the law requires it, in which case we will tell you first unless the law forbids that. You are responsible for having a lawful basis for the processing and for the accuracy of the data.

3. Details of the processing

Subject matter and duration	Providing the Services for the term of your subscription, and until deletion as described in section 11.
Nature and purpose	Hosting, storage and processing to run checks, open and route incidents, page on-call responders, publish status pages, email subscribers, deliver integrations, and draft AI summaries where enabled.
Data subjects	Your workspace members and on-call responders; people named in incidents, notes and deploys; status-page subscribers; anyone whose data appears in what your monitors check or your systems send us.
Categories of data	Names, email addresses, time zones, push device tokens and device names, on-call schedules and notification rules, delivery and acknowledgement records, incident content, commit authors, subscriber email addresses, and anything else you put in the Services.
Special categories	None intended. Don’t put special-category or sensitive personal data in the Services.

4. Confidentiality

Everyone we authorize to process Customer Personal Data is bound by confidentiality obligations, and gets access only as needed to provide, secure and support the Services.

5. Security measures

We maintain appropriate technical and organizational measures, which our security page describes, including: TLS for data in transit; Cloudflare’s encryption of data at rest; AES-256-GCM encryption of integration secrets; passwords hashed with PBKDF2 and sessions, API keys and email links stored only as hashes; role-based access to workspace data; signed webhooks; point-in-time database recovery; and restricted, multi-factor-protected production access. We may update these measures as long as the overall level of protection doesn’t decrease.

6. Subprocessors

• You authorize the subprocessors listed on our subprocessors page. We engage each one under written terms that protect Customer Personal Data at least as well as this DPA, and we remain responsible for their performance.
• We will tell account owners by email at least 15 days before a new subprocessor starts processing Customer Personal Data. If you object on reasonable data protection grounds, we will work with you in good faith on an alternative; if we can’t offer one, you may terminate the affected Services and we will refund prepaid fees for the rest of the billing period.

7. Requests and assistance

Taking into account the nature of the processing, we will help you respond to requests from data subjects (most can be handled directly in the dashboard), and with data protection impact assessments and consultations with supervisory authorities, where you can’t reasonably do so with the information available to you. If a data subject contacts us directly about Customer Personal Data, we will pass the request to you and not answer it ourselves unless you ask us to.

8. Personal data breaches

We will notify you without undue delay, and in any case within 72 hours, after we become aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data. The notice goes to your workspace admins and describes, as far as we know it, what happened, the data and people affected, the likely consequences and what we are doing about it; we will update it as we learn more. Notifying you is not an admission of fault.

9. International transfers

We process Customer Personal Data in the United States and wherever our subprocessors operate. For transfers from the EEA, the UK or Switzerland to a country without an adequacy decision, the European Commission’s Standard Contractual Clauses (Module 2, controller to processor, or Module 3, processor to processor) are incorporated into this DPA by reference, together with the UK International Data Transfer Addendum and the Swiss adjustments, with you as data exporter and us as data importer. Where a transfer is covered by the EU-U.S. Data Privacy Framework (or its UK and Swiss extensions), it may rely on that instead. Under the Clauses, the optional docking clause and option 2 of clause 9 (general authorization) apply, clause 17 is governed by Irish law, and disputes go to the courts of Ireland.

10. Audits and information

We will make available the information reasonably needed to show compliance with this DPA, including answers to a security questionnaire and our providers’ audit reports where they allow it. If that isn’t enough, or a supervisory authority requires it, you may audit our compliance once a year, at your expense, with at least 30 days’ notice, during business hours and under confidentiality terms, in a way that doesn’t compromise other customers’ data. Email security@pulseback.io to start.

11. Return and deletion

You can delete Customer Personal Data in the dashboard at any time, and deleting a workspace deletes it all. When your subscription ends, you can request a copy of your data within 30 days; after that, or on deletion, we delete Customer Personal Data from our live systems, and copies in backups and logs expire within the periods in our Privacy Policy (database backups after 30 days), unless the law requires us to keep it.

12. US state privacy laws

Where US state privacy laws (such as the CCPA as amended by the CPRA) apply, we act as your service provider or processor: we will not sell or share Customer Personal Data, retain, use or disclose it outside our direct business relationship with you or for any purpose other than providing the Services, or combine it with personal information from other sources except as those laws allow. We will tell you if we can no longer meet these obligations, and you may take reasonable steps to stop and remediate unauthorized use. We certify that we understand and will comply with these restrictions.

13. Liability, term and precedence

• Each party’s liability under this DPA is subject to the limitations and exclusions in the Terms, to the extent the law allows.
• This DPA lasts as long as we process Customer Personal Data for you.
• If this DPA conflicts with the Terms, this DPA prevails for the processing of Customer Personal Data; if the Standard Contractual Clauses conflict with either, the Clauses prevail.

14. Signing the DPA

This DPA applies without a signature. To get a signed copy, or to sign your own DPA instead, email privacy@pulseback.io with your company’s legal name, address and workspace name, and the name and email of the person who will sign. We will send the DPA, with its annexes (the details above, our security measures and the subprocessor list), for electronic signature.

Simplisik LLC
Attn: Privacy (Pulseback)
5510 Old Hickory Blvd, Suite B #32
Hermitage, TN 37076
United States