Data processing agreement

1. What this is

This agreement is part of the terms of service of Helios. It applies between you, the customer, as the controller, and Networkguys, Smitspol 7-a7, 3861 RS Nijkerk, the Netherlands, Chamber of Commerce (KVK) 92258727, VAT NL865960859B01, as the processor, for the personal data that you put in your Helios instance or that Helios collects for you.

It is the agreement meant in article 28 of the General Data Protection Regulation (GDPR). If you need a signed copy, write to info@networkguys.nl.

2. What is processed

• Subject and purpose: providing Helios to you, which is monitoring your networks and devices and sending alerts about them.
• Duration: for as long as you have a Helios instance, and until the data is deleted after that.
• Kinds of data: names and email addresses of your users, phone numbers and identifiers of alert destinations, names and locations of sites and devices, IP addresses, the names and addresses of devices connected to your network, and what you write in notes, outages and reports.
• People concerned: your staff, your customers and their staff, and the people who use the networks you monitor.

You do not put special categories of personal data in Helios.

3. What we commit to

• We process the data only to provide Helios and on your documented instructions, which include these terms and the settings you choose in Helios. If we think an instruction breaks the law, we tell you.
• Everybody at Networkguys who can reach the data is bound to confidentiality.
• We take appropriate technical and organisational measures to protect the data, including an instance and a database of your own, encrypted connections, encrypted storage of keys and tokens, and access limited to the people who need it.
• We help you, within reason, to answer requests from people who use their privacy rights, and with impact assessments and questions from the regulator, as far as these concern Helios.
• If we discover a breach of your personal data, we tell you without undue delay, with what we know about what happened and what we are doing about it.

4. Suppliers we use

You give us general permission to use sub-processors. At the moment these are a hosting provider in the Netherlands, a payment provider, an invoicing service and an email service. We bind each of them to duties that protect the data at least as well as this agreement, and we remain responsible to you for what they do.

We tell you before we add or replace a sub-processor. If you object on reasonable grounds and we cannot find a solution, you may stop your plan.

The alert channels you connect yourself, such as WhatsApp, Telegram, Slack or Discord, are your own choice. Their providers are not our sub-processors.

5. Where the data is

The data in your instance is stored in the Netherlands, within the European Union. We do not move it outside the European Economic Area, unless you instruct us to, for example by connecting an alert channel outside it, or unless a legal basis for the transfer is in place.

6. Checking on us

We give you the information you reasonably need to see that we keep to this agreement. You may have this checked once a year by an independent auditor who is bound to confidentiality, announced at least 30 days ahead, during office hours and without disturbing our service more than needed. You pay the costs of the audit, unless it shows that we seriously failed to keep to this agreement.

7. When it ends

When your agreement for Helios ends, we delete the data in your instance within 90 days, unless the law requires us to keep it. Until your instance is removed you can take out your own data with the exports and reports Helios offers.

8. Liability

The limits of liability in the terms of service also apply to this agreement, as far as the law allows.