Data Processing Agreement (DPA)

This English version is provided for convenience only. Only the German version is legally binding (Ausschließlich die deutsche Fassung ist rechtsverbindlich).

What the DPA covers

Logs, metrics, traces and events that you send to the Obseria platform can contain personal data. For this data, you are the controller and Just Growing GmbH acts as your processor. The data processing agreement (DPA) contains the contractual safeguards required by Art. 28 (3) GDPR: Obseria processes the data only on your documented instructions, ensures confidentiality, implements appropriate technical and organisational measures, uses sub-processors only under equivalent obligations, supports you in fulfilling data subject rights and reporting obligations, and deletes or returns the data at the end of the service.

The DPA is the standard for all customers, from the free trial to enterprise contracts. It forms an integral part of our terms of use and applies automatically when the contract is concluded. Where required, it is supplemented by the EU Standard Contractual Clauses or the UK International Data Transfer Addendum.

Subject matter, duration, nature and purpose

• Subject matter: provision of the Obseria observability platform, including Obseria Pipeline, as software as a service.
• Duration: for the term of the main contract and until the deletion of the data after the end of the contract.
• Nature of processing: collection, transmission, masking, storage, indexing, analysis, visualisation and deletion of telemetry data.
• Purpose: monitoring, troubleshooting, alerting and performance analysis of the customer's applications and infrastructure, as well as technical support at the customer's request.

Categories of data and data subjects

Which personal data occurs depends on what your systems send. Typical examples:

• Data categories: IP addresses, user IDs, session and device identifiers, e-mail addresses or names in log messages, URLs and request parameters, timestamps and location information derived from IP addresses; for platform users, also account and audit log data.
• Data subjects: end users of your applications, your employees and contractors, and users of the Obseria platform in your organisation.

Special categories of personal data under Art. 9 GDPR should not be sent to Obseria. Automatic PII masking in Obseria Pipeline helps you remove or pseudonymise such fields before storage.

Technical and organisational measures

The full description of the technical and organisational measures (TOMs) is an annex to the DPA. Overview:

Area	Measures
Access control	Single sign-on with SAML/OIDC, multi-factor authentication, role-based and field-level access control, least-privilege principle for Obseria staff, just-in-time access for support with customer approval
Encryption in transit	TLS 1.2 or higher for all connections, including agents, APIs and the web interface
Encryption at rest	AES-256 encryption of all stored data and backups; optional customer-managed keys [availability by plan]
PII masking	Automatic detection and masking of personal data in Obseria Pipeline before storage, configurable rules per data source
Logging	Tamper-proof audit logs for all access and configuration changes, viewable by the customer
Availability	Redundant operation across multiple availability zones, regular backups, tested disaster recovery, 99.95% SLA
Certifications	ISO/IEC 27001, 27017 and 27018, SOC 2 Type II, BSI C5 (EU region), TISAX

Sub-processors

Obseria uses carefully selected sub-processors, for example for cloud infrastructure and support. All sub-processors are bound by data protection obligations equivalent to those in the DPA. The current list with company, purpose and location can be found on our sub-processors page. We inform customers of intended changes at least [period, e.g. 30 days] in advance; customers may object to a change for good cause.

Data location

You choose where your telemetry is stored and processed:

• EU: Frankfurt (Germany) or Dublin (Ireland)
• UK: London
• Your own cloud account (bring your own cloud), so that data never leaves your infrastructure

Obseria does not transfer customer data out of the selected region without your instruction. Any access by sub-processors from third countries only takes place on the basis of appropriate safeguards under Art. 44 et seq. GDPR.

Deletion and return

During the term, data is deleted automatically according to the retention periods you configure. After the end of the contract, you can export your data for [period, e.g. 30 days]. Obseria then deletes all customer data, including backups, within [period, e.g. 90 days], unless statutory retention obligations apply. Deletion is confirmed on request.

Audits

You may verify Obseria's compliance with the DPA. As a rule, this is done by providing current certificates and audit reports (such as ISO 27001 certificates and the SOC 2 Type II report) under a confidentiality agreement. Where these are not sufficient, on-site audits are possible after reasonable prior notice, during normal business hours and without disrupting operations.

How to obtain and sign the DPA

The DPA applies automatically with the conclusion of the contract and does not need to be signed separately. If you require a countersigned copy for your records, please send an e-mail to info@webect.de stating your company name and account ID. You will receive the DPA, including annexes, for electronic signature. You can also send any other data protection questions to this address.