Data Processing Agreement (DPA)

1. Scope & Definitions

This Data Processing Agreement ("DPA") supplements the Terms of Service entered into between Evergreen Infrastructure Inc. ("Evergreen", "Processor") and the entity or individual customer subscribing to the Service ("Customer", "Controller").

This DPA applies to the processing of personal data governed by Data Protection Legislation (including Regulation (EU) 2016/679 - GDPR, the UK GDPR, the Swiss Federal Data Protection Act, and the Brazilian General Data Protection Law - LGPD Lei 13.709/2018) submitted by or on behalf of Customer in connection with Evergreen services.

2. Details of Processing

• Subject Matter: The provision of infrastructure monitoring, synthetic health checks, incident alerting, and status page hosting as described in the Terms.
• Duration: The term of Customer's subscription plus any retention period prior to permanent deletion as set forth in the Terms.
• Nature and Purpose: Executing periodic network pings, testing API responsiveness, asserting HTTP status codes/payloads, and routing alert notifications to designated teams.
• Categories of Data Subjects: Customer employees, contractors, developers, end-users, or third parties whose identifiers, hostnames, or endpoints are registered in monitors.
• Types of Personal Data: IP addresses, endpoint domain names, email addresses of alert recipients, request headers, error logs, and synthetic test payloads.

3. Processor Obligations

Evergreen warrants and covenants that it shall:

• Process Customer Personal Data only on documented, reasonable instructions from Customer, including with respect to transfers of personal data outside the EEA, unless required to do so by applicable law;
• Ensure that persons authorized to process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
• Implement and maintain the Technical and Organizational Measures specified in Section 6 below;
• Assist Controller, insofar as is technically feasible, in responding to requests from data subjects exercising their statutory rights under GDPR / LGPD.

4. Customer Obligations

Customer represents and warrants that:

• It has obtained all necessary consents, legal bases, and provided all necessary notices required under Data Protection Laws to submit endpoint URLs, webhooks, and contact data to Evergreen;
• It will not configure monitors to intentionally capture, store, or transmit Special Categories of Personal Data (such as health, biometric, or political data) or raw credit card data within HTTP test payloads without prior written agreement.

5. Subprocessors

Customer grants general authorization to Evergreen to engage sub-processors to assist in delivering the Service. Evergreen maintains an up-to-date list of sub-processors and will provide notice of new sub-processors at least thirty (30) days prior to authorization by updating its subprocessor registry or notifying account administrators.

Evergreen imposes data protection terms on each subprocessor that provide no less protection than those set forth in this DPA.

6. Technical & Organizational Measures (TOMs)

Evergreen maintains state-of-the-art security safeguards, including:

• Encryption in Transit: Strict TLS 1.3/1.2 encryption for all external and internal API traffic;
• Encryption at Rest: Industry-standard AES-256 encryption across all persistent databases, backups, and secret vaults;
• Access Control: Zero-trust network access, mandatory MFA on all internal administrative systems, and role-based access control (RBAC);
• Vulnerability Management: Continuous automated dependency vulnerability scanning and structured code reviews;
• Resilience: Distributed probe architecture across 20+ edge regions ensuring high availability and fault isolation.

7. Security Incident Notification

In the event of a confirmed Security Incident resulting in the unauthorized access, disclosure, alteration, or destruction of Customer Personal Data, Evergreen shall:

• Notify Customer without undue delay, and in any event within forty-eight (48) hours of becoming aware of the incident;
• Provide timely updates containing information regarding the nature of the breach, affected data categories, likely consequences, and remediation measures taken or planned;
• Cooperate reasonably with Customer in fulfilling Customer's breach notification obligations to regulatory authorities or data subjects.

8. Data Subject Rights Assistance

Taking into account the nature of the processing, Evergreen provides self-service features in the dashboard allowing Customer to export, delete, or correct monitoring configurations. For requests that cannot be fulfilled self-service, Evergreen will provide commercially reasonable assistance upon written request to privacy@evergreen.watch.

9. Audits & Certifications

Upon written request no more than once per twelve-month period, Evergreen will make available documentation demonstrating compliance with its obligations under this DPA (such as summary reports, SOC 2 / ISO certifications or third-party penetration test executive summaries).

10. Cross-Border Data Transfers

Where the performance of the Service involves the transfer of personal data from the European Economic Area, Switzerland, or the United Kingdom to countries not recognized as providing an adequate level of data protection, the parties agree to abide by the European Commission's Standard Contractual Clauses (Module 2: Controller to Processor).

11. Data Deletion & Return

Upon termination of Customer's account and written request within thirty (30) days following termination, Evergreen shall delete all Customer Personal Data from active production systems, unless applicable law requires retention of such data.