DomainCare.
Start free trial
What breaksCoverageDocsBlogPricing
ToolsDomain health checkDNS propagation checkerSitemap validatorBlacklistsOpen portsMCP server (AI)
Sign in
Legal

Data Processing Agreement

Version 4 · Last updated: 2026-11-06

This Data Processing Agreement ("DPA") is part of the terms of service between Artificial Systems SRL, Oradea Citadel, Building I, Office 6, Oradea, Bihor County, Romania, trade register number J2024001677058, CUI 42509655("DomainCare") and the customer that uses DomainCare ("Customer"). It applies whenever DomainCare processes personal data on the Customer's behalf, and it is accepted together with the terms. A counter-signed copy is available from legal@domaincare.io.

1. Definitions

"Personal data", "processing", "controller", "processor", "data subject", "personal data breach" and "supervisory authority" have the meanings in Regulation (EU) 2016/679 ("GDPR"). "Subprocessor" means another processor DomainCare engages to process Customer personal data.

2. Roles

For the personal data described in Annex 1, the Customer is the controller and DomainCare is the processor. For the data it needs to run its own business (account and sign-in data of the Customer's users, invitations and team memberships, billing, security logs, support and, with consent, analytics) DomainCare is a controller and the privacy policy applies.

3. Instructions

DomainCare processes Customer personal data only on the Customer's documented instructions, including with regard to transfers to a third country, unless Union or Member State law requires otherwise; in that case DomainCare tells the Customer before processing, unless that law forbids it. The instructions are these terms and this DPA, the settings the Customer chooses in DomainCare, and any other written instructions the parties agree. DomainCare informs the Customer immediately if, in its opinion, an instruction infringes data protection law.

4. Confidentiality

DomainCare ensures that everyone it authorises to process Customer personal data is bound by confidentiality.

5. Security

DomainCare implements the measures in Annex 2 and keeps them appropriate to the risk, as Article 32 GDPR requires.

6. Subprocessors

The Customer gives DomainCare a general authorisation to engage the subprocessors on the subprocessors page. DomainCare informs the Customer's owners by email at least 30 days before it adds or replaces a subprocessor, so the Customer can object. If DomainCare cannot address an objection, the Customer may end the contract before the change takes effect and receives a refund of the unused part of any prepaid period.

DomainCare imposes on each subprocessor, by contract, the same data protection obligations as in this DPA, in particular sufficient guarantees of appropriate security measures, and remains fully liable to the Customer for its subprocessors.

7. Data subject requests

Taking into account the nature of the processing, DomainCare helps the Customer, with appropriate technical and organisational measures, to answer requests from data subjects exercising their rights. If DomainCare receives such a request directly, it forwards it to the Customer without undue delay and does not answer it unless the Customer asks it to or the law requires it.

8. Assistance, breaches and impact assessments

DomainCare helps the Customer comply with Articles 32 to 36 GDPR, taking into account the nature of the processing and the information available to it. DomainCare notifies the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer personal data, with the information Article 33(3) GDPR requires as it becomes available.

9. Transfers outside the EEA

Some subprocessors process personal data outside the European Economic Area. DomainCare ensures that each such transfer has a basis under Chapter V GDPR: an adequacy decision of the European Commission (including the EU-US Data Privacy Framework for certified companies) or the Standard Contractual Clauses of Commission Implementing Decision (EU) 2021/914 (Module 3, processor to processor) in the subprocessor's agreement. The basis for each subprocessor is on the subprocessors page; copies of the safeguards are available on request.

10. Return and deletion

When the Customer's organisation is deleted (by an owner, or under section 6.8 of the terms), DomainCare deletes or returns the Customer personal data, at the Customer's choice, and deletes existing copies within 30 days, unless law requires DomainCare to keep them. Owners can export the data and delete the organisation themselves in Settings → Account. If the contract ends because of non-payment (section 6.8 of the terms), the Customer can ask for an export until the deletion date; after that, DomainCare deletes the data. Backups are overwritten in the normal backup cycle.

11. Information and audits

DomainCare makes available to the Customer the information necessary to demonstrate compliance with Article 28 GDPR and this DPA, and allows for and contributes to audits, including inspections, by the Customer or an auditor it mandates. Audits are requested in writing at least 30 days ahead, take place during business hours, at most once a year unless a breach or an authority requires more, are done by an auditor bound by confidentiality, and are at the Customer's cost.

12. Records

DomainCare keeps, and makes available to the supervisory authority on request, a record of the categories of processing it carries out on behalf of its customers, as Article 30(2) GDPR requires.

13. Liability, precedence and term

The liability provisions of the terms apply to this DPA, without limiting a data subject's rights under the GDPR. If the terms and this DPA conflict on personal data, this DPA prevails. This DPA lasts as long as DomainCare processes Customer personal data. Sections 4, 10 and 11 survive the end of the contract.

14. Law and courts

This DPA is governed by Romanian law. Disputes go to the courts named in section 17 of the terms.

Annex 1: The processing

  • Subject matter and purpose:monitoring the Customer's domains, sending alerts, publishing status pages and giving the Customer's team access to them.
  • Nature: collection, storage, organisation, transmission (email, push, chat and webhook alerts, status pages), retrieval and deletion.
  • Duration: the term of the contract, plus the deletion period in section 10.
  • Data subjects: people whose email addresses or webhook endpoints the Customer sets up to receive alerts; people whose names appear in domains, status pages or other content the Customer adds.
  • Types of personal data: email addresses and names of alert recipients, notification channel settings (email addresses, Slack, Discord and webhook URLs), the content of status pages, domain names and check results that relate to an identifiable person.
  • Special categories: none intended. The Customer should not put special categories of data into DomainCare.

Annex 2: Security measures

  • Encryption of traffic with TLS 1.2 or later.
  • Access to production systems limited to the people who need it.
  • Separation of each customer's data by organisation in the application, with role-based access inside an organisation.
  • Passwordless sign-in; API keys stored only as hashes; tokens from Google sign-in not stored.
  • Rate limits on sign-in, the API and public tools.
  • Regular backups and the ability to restore them.
  • Dependency and subprocessor review; a security contact at security@domaincare.io.