Data processing agreement
Annex to the terms of service. Version 1.0, 12 September 2026.
For most data in your account (your email address, your domains, your reports, your invoices) we are the controller ourselves; that is described in the privacy policy. For data about other people that you enter in the portal yourself, such as team members and domain owners, you are the controller and we are the processor. This annex governs that second case, as Article 28 GDPR requires. It applies automatically as soon as you enter such data; nothing to sign.
1. Parties and subject matter
This annex applies between you, as customer and controller, and Upstream Consulting bv, as processor, for the personal data you enter in the DomainCheckup customer portal about persons other than yourself. It forms part of the terms of service and lasts as long as your account exists.
2. Nature and purpose of the processing
We process that data solely to deliver the service: giving access to the portal, delivering reports and alerts to the persons you designate, and managing the team access you configure. We do not process it for our own purposes and follow only your documented instructions, including the settings you choose in the portal. If Union or Member State law requires us to process otherwise, we inform you beforehand unless that law prohibits it.
3. Data subjects and categories of data
Data subjects: your employees, team members and the domain owners or contacts to whom you give access or send reports. Data: name, email address, phone number where SMS notifications are configured, language, role and rights in the portal, the domains they are linked to, and the technical data of their sign-ins (time, IP address). No special categories of data.
4. Confidentiality
Only staff who need the data to deliver or support the service have access to it. They are bound by a duty of confidentiality.
5. Security
We take appropriate technical and organisational measures, including: encryption of data in transit and at rest, encrypted storage of passwords, role-based access with logging, redundant infrastructure in the European Union with encrypted backups, separation of customer data per account, and periodic checks of our own services with the same measurement engine we offer you. Measures are kept in line with the state of the art.
6. Sub-processors
You give us general authorisation to engage sub-processors. The current list is in the privacy policy under "Who else sees it". We impose the same obligations as this annex on every sub-processor and remain liable to you for their work. A new sub-processor is announced thirty days in advance via the portal or by email; if you object with reasons within that period and no solution is found, you may end your account free of charge.
7. Transfers outside the EEA
Data is stored in the European Union. Transfers outside the European Economic Area take place only with an adequate level of protection (adequacy decision, including the EU-US Data Privacy Framework, or standard contractual clauses), as stated for the sub-processor concerned in the privacy policy.
8. Assistance
We assist you, as far as reasonable, in answering data subject requests (access, rectification, erasure, portability, objection) and in your obligations regarding security, breach notification and data protection impact assessments. Requests that reach us directly are forwarded to you. Most requests you can handle yourself in the portal.
9. Breaches
If we establish a personal data breach affecting your data, we notify you without undue delay and at the latest within 48 hours of establishing it, at your administrator's email address, with what we know at that time about nature, scope, consequences and measures taken, supplemented as more becomes known.
10. Audit
On request we make available the information needed to demonstrate compliance with this annex. Once a year, or after a breach, you or an auditor appointed by you and bound by confidentiality may verify our compliance, with thirty days' notice, during office hours and without disrupting the service for other customers. You bear the cost of the audit unless it reveals a material failure.
11. Termination
When your account ends, we delete or anonymise the data within thirty days, as described in the privacy policy. If you want it back first, you can export it from the portal or ask us for a copy in a common format. Data we are legally required to keep is retained until that period expires.
12. Liability and governing law
Liability is governed by section 7 of the terms of service. Belgian law applies. In case of conflict between this annex and the terms, this annex prevails as regards the processing of personal data.
Upstream Consulting bv, Schoolgatweg 2, 1501 Buizingen (Halle), Belgium, BE 0648.724.221, .