This Data Processing Agreement is part of our Terms of Service. It applies to every account, free accounts included, from the moment you accept the Terms, and needs no signature. Where it and the Terms differ on personal data, this agreement applies.

1. Who does what

  • You decide which sites you connect, back up and monitor, and what they hold. For the personal data in them, you are the controller.
  • We process that data only on your behalf, to run the service for you. For it, we are your processor.
  • Data about you as our customer, such as your account and your payments, is not covered here: our Privacy Policy covers it, and for it we are the controller.

2. The data we process for you

  • What the service does: stores backups of your sites in Hera Backup Hub so that you can restore them; checks that your sites answer, takes screenshots of the pages you choose and compares them, records the events the Hera Site Monitor plugin reports, and sends alerts to the recipients you choose (Hera Site Monitor).
  • Personal data: whatever personal data your sites hold, in the backups you send to Hera Backup Hub (for example accounts, orders and comments in your database); whatever personal data your chosen pages show to any visitor, in their screenshots (for example names, photos and comments); what remains in site events after we remove email addresses, IP addresses, keys and server paths from them; the email addresses and Telegram chats you choose to receive alerts.
  • Whose data: visitors, users and customers of your sites; people named or shown on your pages; the people you choose to receive alerts.
  • How long: for as long as you use the service, and then as section 9 describes.

You choose what reaches us: which sites you connect, which pages are captured, and who receives alerts. Do not send us special categories of personal data (such as health data) unless the service is the right place for it, and choose pages to capture that do not show personal data where you can.

3. Your instructions

We process the data only to provide the service as the Terms describe and as you set it up in your account; those are your instructions. If we think an instruction breaks data protection law, we tell you. If the law makes us process the data in another way, we tell you first, unless that law forbids it.

4. Confidentiality

Everyone who can reach the data for us is bound to keep it confidential, and reaches only what their work needs.

5. Security

We protect the data with measures suited to the risk, including:

  • encryption of all traffic between your sites, your browser and our servers (HTTPS);
  • servers in data centres in the European Union, reachable only through the ports the service needs, with administrative access by SSH key only;
  • separate storage, with separate keys, for backups, screenshots and our own database backups, none of them public;
  • copies of our database for recovery, kept on our own server and in private storage;
  • two-step sign-in on our administrative accounts, and available to every customer;
  • keys, passwords and site tokens stored hashed or encrypted, and removed from our logs;
  • a record of administrative actions on customer accounts.

6. Sub-processors

You authorise us to use the sub-processors listed on our Sub-processors page. Each one is bound by written terms that protect the data at least as this agreement does, and we remain responsible to you for them. We email every customer at least 30 days before we add or replace a sub-processor. If you object, tell us within those 30 days; if we cannot meet your objection, you can end the plan that the change affects before the change takes effect, and we refund what you paid for the time left in its current billing period.

7. Transfers outside the European Economic Area

We store the data in the European Union. Two sub-processors are outside it: alert and account emails are sent through Amazon SES in Australia, and our support desk runs on Zoho in the United States. These transfers rely on the European Commission's Standard Contractual Clauses, or for a company certified under the EU-US Data Privacy Framework, on that framework.

8. Helping you

  • Requests from people. If someone asks us directly about data we hold for you, we pass the request on to you and help you answer it. One exception: anyone shown on a screenshot can ask us at contact@herapress.com to delete the screenshots of that page. We delete them within 30 days and tell you which site and page.
  • Personal data breaches. If a breach affects the data we process for you, we tell you without undue delay, and at the latest within 48 hours after we learn of it, with what we know and what we are doing, and keep you informed.
  • Other duties. We give you the information you reasonably need for a data protection impact assessment or for questions from a supervisory authority about the service.

9. When it ends

  • A disconnected site: its history, events and screenshots are deleted, except the latest and the approved screenshot of each page and the site's settings (its pages and where its alerts go), which we keep for 30 days in case you connect the site again. You can delete the screenshots at once from your dashboard.
  • A Hera Backup plan that ends: you can download your backups for 30 days, and then they are deleted.
  • Your account: when you ask to delete it, its screenshots are deleted at once. Everything else we hold for you is deleted 30 days later, the period in which you can change your mind.
  • Copies of our database made before each update of the service keep deleted data for up to 30 days, except that the most recent one stays until a newer one replaces it.

10. Showing that we comply

We answer your reasonable written questions about how we process the data, and make available in writing the information you need to show that this agreement is followed. If our written answers are not enough, if a supervisory authority requires it, or after a personal data breach that affects your data, an independent auditor bound to confidentiality can review our compliance: once a year, at your cost, with 30 days' notice and without access to other customers' data.

11. Liability

Each party's liability under this agreement is subject to the limits in the Terms of Service, except where the law does not allow them.