Data Processing Agreement

Version 1.0 · Effective date: 9 October 2026

1. Parties and scope

This Data Processing Agreement ("DPA") is between the customer that has accepted the Pharosite Terms of Service ("Customer", the controller) and Georgios Chreiazomenos (ΧΡΕΙΑΖΟΜΕΝΟΣ ΓΕΩΡΓΙΟΣ), a sole proprietorship registered in Greece, VAT number EL066364326, 17 Nikou Xylouri, 71307 Heraklion, Crete, Greece ("Pharosite", the processor).

It forms part of the Terms of Service ("Terms") and applies whenever Pharosite processes personal data on the Customer's behalf while providing the Service, as required by Article 28 of Regulation (EU) 2016/679 ("GDPR"). Terms defined in the GDPR have the same meaning here. If this DPA and the Terms conflict on the protection of personal data, this DPA prevails.

It does not cover personal data for which Pharosite is itself the controller, such as account and sign-in data about the Customer's members; the Pharosite Privacy Policy covers that.

2. Details of the processing

The subject matter, nature, purpose and duration of the processing, and the types of personal data and categories of data subjects, are described in Annex I.

3. Customer's responsibilities

The Customer is responsible for the lawfulness of the processing it instructs, including having a legal basis for any personal data that reaches Pharosite through the sites it monitors, and for giving data subjects any information the law requires.
The Customer will configure the Service in line with the Terms: monitoring only sites it is authorised to monitor, and using test accounts and test data for journeys, so that personal data of real customers of the monitored sites is processed only where unavoidable.

4. Pharosite's obligations

Instructions. Pharosite processes personal data only on the Customer's documented instructions, which are the Terms, this DPA and the Customer's configuration and use of the Service, unless EU or Greek law requires otherwise; in that case Pharosite will tell the Customer first unless the law prohibits it. Pharosite will inform the Customer if, in its opinion, an instruction infringes the GDPR.
Confidentiality. Pharosite ensures that everyone authorised to process the personal data is bound by confidentiality.
Security. Pharosite implements the technical and organisational measures in Annex II, which provide a level of security appropriate to the risk as required by Article 32 GDPR. Pharosite may update them, provided the overall level of protection is not reduced.
Data subject requests. Taking into account the nature of the processing, Pharosite assists the Customer, by appropriate technical and organisational measures, in responding to requests from data subjects exercising their rights. If Pharosite receives such a request directly, it will forward it to the Customer without undue delay and will not answer it except on the Customer's instructions.
Other assistance. Pharosite assists the Customer, taking into account the information available to it, with security, breach notification, data protection impact assessments and prior consultation under Articles 32 to 36 GDPR. Assistance beyond what the Service provides may be charged at reasonable cost.

5. Personal data breaches

Pharosite will notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer personal data. The notice will describe, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Pharosite will provide further information as it becomes available and take reasonable steps to contain the breach. Notifying a breach is not an admission of fault.

6. Sub-processors

The Customer gives Pharosite general authorisation to engage sub-processors. The sub-processors in use at the effective date are listed in Annex III.
Pharosite will inform the Customer at least 30 days before adding or replacing a sub-processor, by email to the account owner and by updating Annex III on this page. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may terminate the affected Service and receive a refund of prepaid fees for the period after termination.
Pharosite imposes on each sub-processor, by written contract, data protection obligations no less protective than this DPA, and remains liable to the Customer for its sub-processors' performance of those obligations.
Services the Customer chooses to connect, such as its own Slack or Microsoft Teams workspace, its own mail server, its own SMS account such as Twilio, or a webhook it configures, are not sub-processors of Pharosite. Data sent to them is sent on the Customer's instruction.

7. Transfers outside the EEA

Pharosite processes Customer personal data in the European Economic Area: its servers, database, backups and mail server are all in the EU. Any transfer to a country without an adequacy decision will take place only under the European Commission's Standard Contractual Clauses (Decision 2021/914) or another safeguard under Chapter V GDPR, with supplementary measures where needed.

8. Audits

Pharosite will make available to the Customer the information necessary to demonstrate compliance with this DPA, including written answers to reasonable security questionnaires. Where that is not sufficient, or where a supervisory authority requires it, the Customer may carry out an audit, itself or through an independent auditor bound by confidentiality, no more than once a year, with at least 30 days' notice, during business hours and without disrupting the Service or exposing other customers' data. Each party bears its own costs of an audit.

9. Deletion and return

The Customer can export its data through the API at any time while its account is active. When the Service ends, Pharosite deletes Customer personal data within 30 days, unless EU or Greek law requires it to be kept. Copies in backups are overwritten in the normal rotation within a further 30 days and are not used in the meantime. On request, Pharosite will confirm the deletion in writing.

10. Liability and term

Each party's liability under this DPA is subject to the limitations and exclusions in the Terms, except where the GDPR does not allow them. This DPA lasts as long as Pharosite processes Customer personal data. It is governed by Greek law, and disputes go to the courts named in the Terms.

This DPA is accepted together with the Terms. A copy signed by Pharosite is available on request at [email protected].

Annex I · Description of the processing

Subject matter	Provision of the Pharosite website monitoring service under the Terms.
Nature of the processing	Collection through automated checks of the Customer's websites, storage, organisation, display to the Customer, transmission in alerts and reports, encryption, and deletion.
Purpose	To monitor the availability, functioning and security of the Customer's websites, to alert the Customer to problems, and, where the Customer approves, to carry out WordPress updates through the Pharosite agent.
Duration	For the term of the Customer's account, followed by deletion as described in section 9.
Categories of data subjects	Visitors and customers of the monitored websites, only to the extent their data appears on pages the Service checks. People whose details the Customer enters, such as alert recipients who are not members of the Customer's account. Holders of the test accounts the Customer configures for journeys.
Types of personal data	Content of monitored web pages, including screenshots taken when a check fails. Text of emails sent by the monitored websites to Pharosite's test addresses during journeys (sender, subject and body as text; attachments are discarded unread). Usernames and passwords of journey test accounts. Names, email addresses, phone numbers and messaging handles of alert recipients. Usernames and versions of software reported by the Pharosite agent from the Customer's site. The Customer does not instruct Pharosite to process special categories of personal data, and the Service is not designed for it.
Retention	Screenshots and received emails: 7 days. Check results: while the account is active, or a shorter period the Customer sets. Journey logins and alert recipients: until the Customer deletes them or the account ends.

Annex II · Technical and organisational measures

Encryption	All connections to the Service use HTTPS/TLS. Journey logins and two-factor secrets are encrypted at rest with AES-256-GCM, using keys held separately from the database and supporting rotation. Database backups are kept in private storage, separate from the server, that only the backup job can reach.
Credentials	Passwords are stored only as salted argon2id hashes; API keys, session tokens and recovery codes only as hashes. Two-factor sign-in is available to every member. Sign-in attempts are rate-limited.
Separation of customers	Every database query is scoped to the requesting account, and the API cannot address another account's data.
Access control	Production access is limited to named people who need it, over authenticated and encrypted connections. Roles within a customer account (owner, admin, member, read-only) limit who can change configuration or approve changes.
Data minimisation	Emails received for journeys are kept as plain text only; attachments are discarded and HTML is never rendered. Screenshots are replaced per check and deleted after 7 days. Pharosite holds no credentials that can change a customer's site; the agent acts only on work a person approved.
Accountability	An activity record shows customers which member changed configuration, acknowledged incidents or approved changes, and when.
Availability and resilience	The database is backed up daily to storage separate from the server, and restoring from a backup is tested. Services restart automatically.
Software security	Source code is version-controlled; every change passes automated tests before an automated, reproducible deployment. Dependencies and the server operating system are kept up to date.
Incidents	Security incidents are investigated and, where they affect Customer personal data, notified as set out in section 5.

Annex III · Sub-processors

Sub-processor	Processing	Location of processing
OVH SAS, 2 rue Kellermann, 59100 Roubaix, France	Hosting of servers and database; storage of database backups	EU (servers in Germany)
Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany	Hosting of Pharosite's own mail server, which delivers the alerts and reports sent by Pharosite's email channel	Germany (EU)