Data processing agreement

Last updated: 17 October 2026

This agreement covers the personal data that SitePing processes for the agency when it monitors, scans, backs up and changes the agency's sites (article 28 of Regulation (EU) 2016/679, "GDPR"). It is part of the terms of service and applies from the moment the agency accepts them. If the two differ on data protection, this agreement prevails. A copy signed by us is available on request at privacy@siteping.it.

1. Roles

The agency is the controller of the personal data on its connected sites, or a processor acting for its end clients. In the second case we are its sub-processor, and the agency makes sure its end clients have authorised this.

We (Alexander Kovacic Ditta Individuale, details in the terms) are the processor. For the agency's own account data (users, billing, logins) we are an independent controller, as the privacy notice explains.

2. Subject, duration, nature and purpose

We process personal data only to provide the service described in the terms, for as long as the contract lasts and until the deletion in section 11. The data, the people they concern and the processing operations are described in annex I.

3. Instructions

We process the data only on the agency's documented instructions. The terms, the settings chosen in the dashboard and the actions started there are those instructions. We tell the agency if we think an instruction breaks the GDPR, and we may refuse to carry it out until it is confirmed or changed. If a law requires us to process data otherwise, we tell the agency first, unless that law forbids it.

4. Confidentiality

Only the provider and the people we authorise, bound by a duty of confidentiality, can access the data, and only as far as the service needs it (support, cleanup requests, security incidents).

5. Security

We apply the technical and organisational measures in annex II. We may update them as long as the level of protection does not go down.

6. Sub-processors

The agency gives a general authorisation to use sub-processors. The current list is on the sub-processors page (annex III). We impose on each sub-processor data protection duties equivalent to this agreement, and we stay responsible to the agency for their work.

We tell the account owner by email and on that page at least 30 days before adding or replacing a sub-processor. The agency can object on reasonable data protection grounds within those 30 days. If we cannot find a solution together, the agency can end the affected service, and we refund the part of a prepaid period that remains.

7. Transfers outside the EU

The service and its database run in the European Union. Where a sub-processor processes data outside the European Economic Area, the transfer relies on an adequacy decision (such as the EU-US Data Privacy Framework for certified companies) or on the standard contractual clauses of Commission Decision (EU) 2021/914.

8. Help with data subjects' requests

We forward to the agency, within 5 working days, any request from a data subject about data we process for it, and we do not answer it ourselves unless the agency asks. The agency can find and delete most data itself in the dashboard (sites, users, backups); for the rest we help within a reasonable time.

9. Personal data breaches

We tell the agency about a personal data breach that affects its data without undue delay and no later than 48 hours after we become aware of it, with the information in article 33(3) GDPR that we have at that time, and the rest as soon as we have it. We take steps to contain the breach and help the agency notify the authority and the people concerned.

10. Help with other duties and audits

We give the agency the information it needs about our processing for data protection impact assessments and prior consultations (articles 35 and 36 GDPR).

We answer a written security questionnaire once a year. If that is not enough, the agency can have an audit carried out, remote or on site, by itself or an independent auditor bound by confidentiality, with 30 days' notice, at most once in 12 months and at its own cost. These limits do not apply after a personal data breach or when a supervisory authority requests the audit.

11. Deletion and return

At the end of the contract the agency can download its backups and reports from the dashboard first. Within 60 days of the end we delete the personal data we process for the agency, including copies, except backups under Object Lock, which are deleted when the lock ends, and data a law requires us to keep.

12. Liability and law

Liability under this agreement follows the terms of service, without prejudice to article 82 GDPR and to the rights of data subjects. Law, courts and language are those of the terms.

Annex I: description of the processing

Data subjects:

• members of the agency's team and its client users;
• administrators, editors and other users of the connected sites;
• visitors and customers of the connected sites, whose data can appear in backups, files and logs;
• people who subscribe to the agency's status pages.

Personal data:

• usernames, email addresses and roles of the sites' administrators, from the inventory;
• security events: logins, failed logins, new administrators and changes, with IP address, user agent and time;
• file paths and hashes from file scans; the content of a flagged file when the agency opens it, asks for an AI review or sends a cleanup request;
• backups of databases and files, encrypted: they can contain any data the site holds, including special categories if the site processes them;
• email addresses of status page subscribers; the HTML of public pages for the SEO Shield.

Processing: collection through the agent and from public pages, storage, comparison and analysis, encryption, transfer to storage, restore, deletion.

Retention in the service: uptime checks 90 days, then hourly and daily summaries up to 730 days; security events 180 days; the agency's activity log 365 days; backups as the agency's schedules set them; everything until the end of the contract at most, plus the deletion time in section 11.

Annex II: technical and organisational measures

• HTTPS for the dashboard, the agents and the probes, with HSTS. Every request between platform and agent is signed with a secret per site and a timestamp, and replays are refused.
• Backups are encrypted on the site with AES-256-GCM and a key per backup, before they leave the site. With the agency's own key (RSA-3072) the platform keeps only the public key.
• Secrets of the sites, API keys and tokens are stored encrypted. Passwords are stored as bcrypt hashes.
• Two-factor authentication is required for every user. Sign-in, sign-up and other public forms have rate limits.
• Every query is limited to the data of the agency that makes it, and client users see only the sites of their own client.
• The activity log records the agency's sensitive actions (logins, restores, updates, key changes) and keeps them 365 days.
• Checks towards addresses the agency chooses are limited to public addresses and checked on the address actually contacted.
• Backup storage in the EU, private, with Object Lock against deletion and ransomware.
• Dependencies pinned with lockfiles and audited when they change; code changes tested before release; security fixes for the agents distributed through the dashboard.
• Access to production systems only by the provider, with two-factor authentication on the hosting, storage and code accounts.

Annex III: sub-processors

The list, with purpose, data and location of each sub-processor, is on the sub-processors page.