Data Processing Agreement (DPA) for portslie

This agreement governs what happens to personal data that you, as a business, enter into portslie — for example, the email addresses of your employees as alert recipients. It is required under Art. 28 GDPR as soon as you enter such data, and it is free of charge for you.

It consists of the official set of clauses of the European Commission (Implementing Decision (EU) 2021/915), one additional clause (Z1) and four annexes. Nothing in the set of clauses has been changed.

It does not apply to consumers: Anyone who uses portslie privately processes data for personal or family purposes; no DPA is needed for this (Art. 2(2)(c) GDPR).

Cover sheet

Data Processing Agreement pursuant to Article 28 GDPR

based on the Standard Contractual Clauses of the European Commission (Implementing Decision (EU) 2021/915 of 4 June 2021)

between

the customer, who uses portslie as a business — hereinafter “Controller” — with the details given in Annex I

and

portslie — Maurizio Romano c/o Impressumservice Dein-Impressum Stettiner Str. 41, 35410 Hungen, Germany Email: support@mrmedia.network

— hereinafter “Processor” —

Main agreement: the agreement on the use of portslie, consisting of the Terms and the Service description of portslie (portslie.com/agb, portslie.com/leistungsbeschreibung).

Version: 2026-09-26 · Set of clauses: EU 2021/915 (unchanged) · Additional clauses: Z1

What this agreement is for — and what it is not for

(Not part of the set of clauses. Preliminary explanation.)

portslie measures servers, reports outages and displays a status page. What you enter for this — the addresses of your servers, alert recipients, the texts of your status page — we process on your behalf: you decide what is measured, who is notified and what is made public.

For our own data about you — your account, login, invoices, server log files, the security log — we ourselves are the controller. For this, it is not this agreement that applies but the Privacy policy of portslie.

Record of the choices made

Provision	Choice	Reason
Clause 1(a)	OPTION 1 (Art. 28(3) and (4) GDPR)	Option 2 applies to Union institutions.
Clause 5 (optional)	omitted	Docking clause for group structures; each customer has its own agreement.
Clause 7.7(a)	OPTION 2 (general written authorisation), notice period 30 days	The list is set out in Annex IV; you retain the right to object, and Z1 governs the consequences.
Clause 8(c)(4)	OPTION 1 (Art. 32 GDPR)	see above
Clause 9.1(b), (c) and 9.2	OPTION 1 (Art. 33(3), Art. 34 GDPR)	see above
Clause 2(b)	used — one additional clause: Z1 (Section IV)	Clause 7.7(a) does not say what applies after an objection. Z1 governs this.

How the agreement is concluded: It forms part of the main agreement if you use portslie as a business (portslie Terms, § 7.6). Art. 28(9) GDPR permits the electronic format. Choice of law and place of jurisdiction are governed by the main agreement.

STANDARD CONTRACTUAL CLAUSES

Official wording, Implementing Decision (EU) 2021/915, Annex. The options provided for in the text have been resolved; the optional Clause 5 has been omitted. Otherwise unchanged.

SECTION I

Clause 1 — Purpose and scope

(a) The purpose of these Standard Contractual Clauses (hereinafter “Clauses”) is to ensure compliance with Article 28(3) and (4) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

(b) The controllers and processors listed in Annex I have agreed to these Clauses in order to ensure compliance with Article 28(3) and (4) of Regulation (EU) 2016/679.

(c) These Clauses apply to the processing of personal data as specified in Annex II.

(d) Annexes I to IV are an integral part of the Clauses.

(e) These Clauses are without prejudice to obligations to which the controller is subject by virtue of Regulation (EU) 2016/679.

(f) These Clauses do not by themselves ensure compliance with obligations related to international transfers in accordance with Chapter V of Regulation (EU) 2016/679.

Clause 2 — Invariability of the Clauses

(a) The Parties undertake not to modify the Clauses, except for adding information to the Annexes or updating information in them.

(b) This does not prevent the Parties from including the standard contractual clauses laid down in these Clauses in a broader contract, or from adding other clauses or additional safeguards provided that they do not directly or indirectly contradict the Clauses or detract from the fundamental rights or freedoms of data subjects.

Clause 3 — Interpretation

(a) Where these Clauses use the terms defined in Regulation (EU) 2016/679, those terms shall have the same meaning as in that Regulation.

(b) These Clauses shall be read and interpreted in the light of the provisions of Regulation (EU) 2016/679.

(c) These Clauses shall not be interpreted in a way that runs counter to the rights and obligations provided for in Regulation (EU) 2016/679 or in a way that prejudices the fundamental rights or freedoms of the data subjects.

Clause 4 — Hierarchy

In the event of a contradiction between these Clauses and the provisions of related agreements between the Parties existing at the time when these Clauses are agreed or entered into thereafter, these Clauses shall prevail.

(Clause 5 — Docking clause — is marked as optional in the Decision and is not used here.)

SECTION II — OBLIGATIONS OF THE PARTIES

Clause 6 — Description of processing

The details of the processing operations, in particular the categories of personal data and the purposes of processing for which the personal data is processed on behalf of the controller, are specified in Annex II.

Clause 7 — Obligations of the Parties

Jan 7 Instructions

(a) The processor shall process personal data only on documented instructions from the controller, unless required to do so by Union or Member State law to which the processor is subject. In this case, the processor shall inform the controller of that legal requirement before processing, unless the law prohibits this on important grounds of public interest. Subsequent instructions may also be given by the controller throughout the duration of the processing of personal data. These instructions shall always be documented.

(b) The processor shall immediately inform the controller if, in the processor's opinion, instructions given by the controller infringe Regulation (EU) 2016/679 or the applicable Union or Member State data protection provisions.

Feb 7 Purpose limitation

The processor shall process the personal data only for the specific purpose(s) of the processing, as set out in Annex II, unless it receives further instructions from the controller.

Mar 7 Duration of the processing of personal data

Processing by the processor shall only take place for the duration specified in Annex II.

Apr 7 Security of processing

(a) The processor shall at least implement the technical and organisational measures specified in Annex III to ensure the security of the personal data. This includes protecting the data against a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access to the data (hereinafter “personal data breach”). In assessing the appropriate level of security, the Parties shall take due account of the state of the art, the costs of implementation, the nature, scope, context and purposes of processing and the risks involved for the data subjects.

(b) The processor shall grant access to the personal data undergoing processing to members of its personnel only to the extent strictly necessary for implementing, managing and monitoring of the contract. The processor shall ensure that persons authorised to process the personal data received have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

May 7 Sensitive data

If the processing involves personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data or biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person's sex life or sexual orientation, or data relating to criminal convictions and offences (hereinafter “sensitive data”), the processor shall apply specific restrictions and/or additional safeguards.

Jun 7 Documentation and compliance

(a) The Parties shall be able to demonstrate compliance with these Clauses.

(b) The processor shall deal promptly and adequately with inquiries from the controller about the processing of data in accordance with these Clauses.

(c) The processor shall make available to the controller all information necessary to demonstrate compliance with the obligations that are set out in these Clauses and stem directly from Regulation (EU) 2016/679. At the controller's request, the processor shall also permit and contribute to audits of the processing activities covered by these Clauses, at reasonable intervals or if there are indications of non-compliance. In deciding on a review or an audit, the controller may take into account relevant certifications held by the processor.

(d) The controller may choose to conduct the audit by itself or mandate an independent auditor. Audits may also include inspections at the premises or physical facilities of the processor and shall, where appropriate, be carried out with reasonable notice.

(e) The Parties shall make the information referred to in this Clause, including the results of any audits, available to the competent supervisory authority/ies on request.

Jul 7 Use of sub-processors

(a) (Chosen: general written authorisation.) The processor has the controller's general authorisation for the engagement of sub-processors from an agreed list. The processor shall specifically inform the controller in writing of any intended changes to that list through the addition or replacement of sub-processors at least 30 days in advance, thereby giving the controller sufficient time to be able to object to such changes prior to the engagement of the sub-processor(s) concerned. The processor shall provide the controller with the information necessary to enable the controller to exercise its right to object.

Editorial note, not part of the clause text: The “agreed list” within the meaning of this point is Annex IV. What applies if the controller objects is governed by additional clause Z1 in Section IV.

(b) Where the processor engages a sub-processor for carrying out specific processing activities (on behalf of the controller), it shall do so by way of a contract which imposes on the sub-processor, in substance, the same data protection obligations as the ones imposed on the processor in accordance with these Clauses. The processor shall ensure that the sub-processor complies with the obligations to which the processor is subject pursuant to these Clauses and to Regulation (EU) 2016/679.

(c) At the controller's request, the processor shall provide a copy of such a sub-processor agreement and any subsequent amendments to the controller. To the extent necessary to protect business secrets or other confidential information, including personal data, the processor may redact the text of the agreement prior to sharing a copy.

(d) The processor shall remain fully responsible to the controller for the performance of the sub-processor's obligations in accordance with its contract with the processor. The processor shall notify the controller of any failure by the sub-processor to fulfil its contractual obligations.

(e) The processor shall agree a third-party beneficiary clause with the sub-processor whereby – in the event the processor has factually disappeared, ceased to exist in law or has become insolvent – the controller shall have the right to terminate the sub-processor contract and to instruct the sub-processor to erase or return the personal data.

Aug 7 International transfers

(a) Any transfer of data to a third country or an international organisation by the processor shall be done only on the basis of documented instructions from the controller or in order to fulfil a specific requirement under Union law or Member State law to which the processor is subject and shall take place in compliance with Chapter V of Regulation (EU) 2016/679.

(b) The controller agrees that where the processor engages a sub-processor in accordance with Clause 7.7 for carrying out specific processing activities (on behalf of the controller) and those processing activities involve a transfer of personal data within the meaning of Chapter V of Regulation (EU) 2016/679, the processor and the sub-processor can ensure compliance with Chapter V of Regulation (EU) 2016/679 by using standard contractual clauses adopted by the Commission in accordance with Article 46(2) of Regulation (EU) 2016/679, provided the conditions for the use of those standard contractual clauses are met.

Clause 8 — Assistance to the controller

(a) The processor shall promptly notify the controller of any request it has received from the data subject. It shall not respond to the request itself, unless authorised to do so by the controller.

(b) The processor shall assist the controller in fulfilling its obligations to respond to data subjects' requests to exercise their rights, taking into account the nature of the processing. In fulfilling its obligations in accordance with points (a) and (b), the processor shall comply with the controller's instructions.

(c) In addition to the processor's obligation to assist the controller pursuant to Clause 8(b), the processor shall furthermore assist the controller in ensuring compliance with the following obligations, taking into account the nature of the data processing and the information available to the processor:

1. the obligation to carry out an assessment of the impact of the envisaged processing operations on the protection of personal data (hereinafter “data protection impact assessment”) where a type of processing is likely to result in a high risk to the rights and freedoms of natural persons;
2. the obligation to consult the competent supervisory authority/ies prior to processing where a data protection impact assessment indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk;
3. the obligation to ensure that personal data is accurate and up to date, by informing the controller without delay if the processor becomes aware that the personal data it is processing is inaccurate or has become outdated;
4. the obligations in Article 32 of Regulation (EU) 2016/679.

(d) The Parties shall set out in Annex III the appropriate technical and organisational measures by which the processor is required to assist the controller in the application of this Clause as well as the scope and the extent of the assistance required.

Clause 9 — Notification of personal data breach

In the event of a personal data breach, the processor shall cooperate with and assist the controller for the controller to comply with its obligations under Articles 33 and 34 of Regulation (EU) 2016/679, taking into account the nature of processing and the information available to the processor.

Jan 9 Data breach concerning data processed by the controller

In the event of a personal data breach concerning data processed by the controller, the processor shall assist the controller:

(a) in notifying the personal data breach to the competent supervisory authority/ies, without undue delay after the controller has become aware of it, where relevant (unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons);

(b) in obtaining the following information which, pursuant to Article 33(3) of Regulation (EU) 2016/679, shall be stated in the controller's notification, and must at least include:

1. the nature of the personal data including, where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;
2. the likely consequences of the personal data breach;
3. the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.

Where, and insofar as, it is not possible to provide all this information at the same time, the initial notification shall contain the information then available and further information shall, as it becomes available, subsequently be provided without undue delay;

(c) in complying, pursuant to Article 34 of Regulation (EU) 2016/679, with the obligation to communicate the personal data breach to the data subject without undue delay, when the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons.

Feb 9 Data breach concerning data processed by the processor

In the event of a personal data breach concerning data processed by the processor, the processor shall notify the controller without undue delay after having become aware of the breach. Such notification shall contain, at least:

(a) a description of the nature of the breach (including, where possible, the categories and approximate number of data subjects and data records concerned);

(b) the details of a contact point where more information concerning the personal data breach can be obtained;

(c) its likely consequences and the measures taken or proposed to be taken to address the personal data breach, including measures to mitigate its possible adverse effects.

Where, and insofar as, it is not possible to provide all this information at the same time, the initial notification shall contain the information then available and further information shall, as it becomes available, subsequently be provided without undue delay.

The Parties shall set out in Annex III all other elements to be provided by the processor when assisting the controller in the compliance with the controller's obligations under Articles 33 and 34 of Regulation (EU) 2016/679.

SECTION III — FINAL PROVISIONS

Clause 10 — Non-compliance with the Clauses and termination

(a) Without prejudice to any provisions of Regulation (EU) 2016/679, in the event that the processor is in breach of its obligations under these Clauses, the controller may instruct the processor to suspend the processing of personal data until the latter complies with these Clauses or the contract is terminated. The processor shall promptly inform the controller in case it is unable to comply with these Clauses, for whatever reason.

(b) The controller shall be entitled to terminate the contract insofar as it concerns processing of personal data in accordance with these Clauses if:

1. the processing of personal data by the processor has been suspended by the controller pursuant to point (a) and if compliance with these Clauses is not restored within a reasonable time and in any event within one month following suspension;
2. the processor is in substantial or persistent breach of these Clauses or its obligations under Regulation (EU) 2016/679;
3. the processor fails to comply with a binding decision of a competent court or the competent supervisory authority/ies regarding its obligations pursuant to these Clauses or to Regulation (EU) 2016/679.

(c) The processor shall be entitled to terminate the contract insofar as it concerns processing of personal data under these Clauses where, after having informed the controller that its instructions infringe applicable legal requirements in accordance with Clause 7.1(b), the controller insists on compliance with the instructions.

(d) Following termination of the contract, the processor shall, at the choice of the controller, delete all personal data processed on behalf of the controller and certify to the controller that it has done so, or return all the personal data to the controller and delete existing copies unless Union or Member State law requires storage of the personal data. Until the data is deleted or returned, the processor shall continue to ensure compliance with these Clauses.

SECTION IV — SUPPLEMENTARY AGREEMENT OF THE PARTIES

(This is where the official wording of Implementing Decision (EU) 2021/915 ends. What follows is an additional clause agreed by the Parties on the basis of Clause 2(b), which expressly permits further clauses provided that they neither directly nor indirectly contradict the Standard Contractual Clauses and do not detract from the rights or freedoms of data subjects. It is numbered separately so that it cannot be confused with the Commission's text. In the event of a contradiction, Clause 4 applies: the Standard Contractual Clauses prevail.)

Additional clause Z1 — Legal consequence of an objection under Clause 7.7(a)

(a) If the controller objects in text form, within the period specified there, to a change to the list in Annex IV notified under Clause 7.7(a), the processor shall inform the controller within 14 days of receipt of the objection whether it will refrain from the intended engagement.

(b) If the processor does not refrain from the engagement, the controller is entitled to terminate the main agreement in text form with effect from the date on which the sub-processor concerned is to be used. The processor shall refund fees paid in advance pro rata for the period that is no longer used after this termination takes effect. The termination shall not give rise to any further costs for the controller.

(c) If the controller does not object within the period, the general authorisation granted under Clause 7.7(a) remains in place. In every notification under Clause 7.7(a), the processor shall draw attention to the period and to the legal consequences of this additional clause.

(d) The controller has no claim to require the processor to carry out the processing without the sub-processor concerned or on a technical basis created separately for the controller. The right under point (b) remains unaffected.

(e) Clause 10 remains unaffected. This additional clause restricts neither the rights of data subjects nor the obligations of the processor under the Standard Contractual Clauses or under Regulation (EU) 2016/679.

Why this clause exists, in plain language: Clause 7.7(a) gives you a right to object but does not say what happens next. This supplement closes that gap in both directions. We first check whether it can be done without the new service provider — if it cannot, you can leave the agreement without any disadvantage and without any costs, and before the change takes effect. What we cannot do is operate separate infrastructure for an individual customer; that is why this is stated here expressly instead of being asserted only in the event of a dispute.

ANNEX I — List of parties

Controller

Name and address	as stored in the portslie account or in the MRMedia customer portal
Contact person	the email address of the portslie account
Data protection officer	if appointed: to be communicated by the controller

Processor

Name	portslie — Maurizio Romano, sole proprietorship
Address	c/o Impressumservice Dein-Impressum, Stettiner Str. 41, 35410 Hungen, Germany
Contact person	Maurizio Romano, owner · support@mrmedia.network · 0157 9234 1658
Data protection officer	not appointed. The requirements of Art. 37 GDPR and of § 38 BDSG are not met: sole proprietorship without employees, no large-scale processing of special categories, no large-scale regular monitoring of persons. The contact person is the owner.

ANNEX II — Description of the processing

Categories of data subjects

• Employees and persons engaged by the controller whom the controller enters as alert recipients
• Operators of the monitored servers, insofar as they are natural persons and the hostname or IP address can be attributed to them
• Persons named by the controller on its status page

Categories of personal data

• Targets: name, hostname or IP address with port, check type, expected response text, measurement interval
• Measurements and incidents: time, level reached, response time, reported player count (only the number, no player names), message text of the check
• Alert channels: email addresses, webhook addresses (Discord, Slack, Microsoft Teams, ntfy, custom), Telegram chat ID and displayed chat name
• Status page: title, texts, colours, logo, custom domain, selection of the targets shown

Sensitive data

None. The input fields are not intended for this; the controller does not enter any special categories of data (Art. 9 GDPR) there.

Nature of the processing

Storage, regular querying of the entered addresses from the probe locations, evaluation of the responses, transmission of alerts to the recipients chosen by the controller, publication of the status page to the extent chosen by the controller, backup, deletion.

Purpose

Provision of portslie in accordance with the Service description: monitoring of the controller's servers, alerting, status page.

Instructions

The controller gives instructions through the settings in portslie (what is measured, to whom it is reported, what is published) and otherwise in text form to support@mrmedia.network.

Duration

For the term of the main agreement. Measurements are deleted after the history period of the plan (7, 30 or 90 days; after a paid plan ends, they are kept to the previous extent for a further 30 days). When the account is deleted, all data is deleted immediately; after that, it remains in the backups for up to four weeks.

Return and deletion (Clause 10(d))

Return: The controller can download all data as a JSON file at any time (Account → “Download data”). Deletion: by deleting the account, or on request in text form. If we terminate the account, the export remains available for a further 30 days; after that, we delete the data. On request, we confirm the deletion in text form.

ANNEX III — Technical and organisational measures

As of Sep 26, 2026, verified on the live system.

Encryption

• Probe locations and the central server communicate with each other only via a WireGuard-encrypted overlay network (NetBird).
• The backups on the backup server are stored in encrypted form (Proxmox Backup Server with key).
• Emails leave the central server via STARTTLS through our own mail server.
• Public access to portslie takes place exclusively via TLS (Cloudflare, Annex IV No. 4); unencrypted HTTP is redirected to HTTPS, and the browser is pinned to HTTPS via HSTS.

Access and authorisation

• Administrative access to the servers only via the overlay network, SSH only with a key, password login disabled.
• The central server has no open port on the internet. Public requests reach it only via an outbound tunnel; otherwise, SSH and the application only accept connections from four approved internal addresses (packet filter, default rule “drop”). The interfaces for probe locations and billing are blocked for access via the public entry point.
• The database (PostgreSQL) has no network interface; it can only be reached via a local socket.
• Passwords are stored only as scrypt hashes; login attempts are rate-limited.
• Second factor (TOTP) available for customers, mandatory for administration.
• Session cookie HttpOnly, SameSite=Lax, over TLS Secure; protection against cross-site requests on all forms.
• Every query is bound to the account; an account sees only its own targets, alert channels and measurements (safeguarded by automated tests).
• Only the owner has access to the systems.

Separation

• The probe locations receive only the address, port, check type and expected response of the targets — neither account data nor alert data.
• Measurement processes run under a dedicated user without privileges; connections to internal and reserved networks are blocked for them by a packet filter.

Availability and recovery

• Daily backup of the database (at 03:30), retained for 14 days.
• Daily backup of the entire application container to a backup server in a different data centre (Roubaix instead of Strasbourg), retained for 14 days.
• Restoration of a database backup tested on Sep 25, 2026.
• Two probe locations; an outage only counts once the majority confirms it.

Logging

• Security log (login, password change, account operations) 12 months.
• Server logs of the central server (with IP addresses) 7 days, technically enforced.

Deletion

As described in Annex II; the automatic deletion of measurements after the history period runs every 15 minutes.

Physical security

The servers are located in data centres of the sub-processors (Annex IV); the processor has no physical access there.

Review

The measures are reviewed whenever the setup is changed and at least annually; a full security audit of the application last took place on Sep 25, 2026.

Open — expressly stated

• The servers' storage media are not additionally encrypted (data at rest outside the backups).
• There is no certification of the processor itself.

ANNEX IV — List of sub-processors

This list is the “agreed list” within the meaning of Clause 7.7(a). Changes are announced 30 days in advance in text form; the controller may object. What an objection brings about is set out in additional clause Z1.

No.	Company	Service	Place of processing
1	OVH SAS, 2 rue Kellermann, 59100 Roubaix, France	Servers for the application, database, Strasbourg probe location, mail server and backups	Strasbourg and Roubaix, France
2	Henrik Kramer e.K. (Prepaid Hoster), Kurpromenade 48, 23743 Grömitz	Server for the Frankfurt probe location; only target addresses and check data are stored there	Frankfurt am Main, Germany (Maincubes FRA01 data centre)
3	Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen	Server for managing the overlay network between the probe locations and the central server; the contents are end-to-end encrypted	Germany
4	Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA	Public access: TLS endpoint and forwarding of requests to the central server (tunnel); in the process, the transmitted data, including the input entered in the browser, is passed through	global network, requests from the EU generally handled at EU locations; registered office in the USA — see note below

The recipients to which portslie sends alerts on the instructions of the controller (its email provider, Discord, Telegram, Slack, Microsoft Teams, ntfy, custom webhooks) are not sub-processors. The controller determines which these are; it is itself responsible for the transfer to them, including any transfer to third countries.

Payment service provider: Mollie B.V. processes payment data as an independent controller; this data is not the subject of this agreement.

Note on No. 4 (Cloudflare) — transfer to a third country (Clause 7.8): Clause 1(f) makes clear that these Clauses alone do not meet the requirements for transfers to third countries. The basis here is twofold: Cloudflare, Inc. is entered in the official list of the U.S. Department of Commerce for the EU-US Data Privacy Framework (organisation ID 5666, status “Active — Re-certification under Review”, category non-HR data, valid until Sep 15, 2027; retrieved on Sep 26, 2026) — adequacy decision of the Commission, Art. 45 GDPR —, and Cloudflare's data processing agreement contains the Standard Contractual Clauses of the Commission (Art. 46(2)(c) GDPR) in the event that the certification lapses. The certification must be renewed annually; its status is checked in the official list at least annually.