Data Processing Agreement
Processor: Wild Protection Korlátolt Felelősségű Társaság (Wild Protection Kft.), Aranyág Kert 23, Hódmezővásárhely 6800, Hungary
Contact: [email protected]
Version: 1.0 | Effective date: 2026-10-28
This Data Processing Agreement ("DPA") forms part of the SteadyNode Terms of Service ("Terms") and applies when Wild Protection Kft. processes personal data on behalf of a customer ("Customer"). The Customer and Wild Protection Kft. agree to comply with this DPA and applicable Data Protection Law, including Article 28 GDPR.
Definitions. Capitalized terms not defined here have the meaning given in the Terms. "Customer Content" and the "Service" have the meanings given in the Terms. "Customer Personal Data" means personal data contained in Customer Content that Wild Protection Kft. processes as processor on Customer's behalf. "Data Protection Law" means Regulation (EU) 2016/679 (GDPR) and applicable Hungarian and EU data-protection law. This DPA is incorporated into the Terms and takes effect when Customer accepts the Terms; no separate signature is required.
1. Roles and scope
For personal data processed in Customer Content, Customer determines the purposes and means of processing and acts as controller. Wild Protection Kft. acts as processor and processes that data only on Customer's documented instructions to provide the Service. The parties' roles are determined by the actual processing. Wild Protection Kft. acts as an independent controller for account, security, and operational data described in the Privacy Policy, including the limited security and abuse-prevention processing described there.
2. Processing details
| Detail | Description |
|---|---|
| Subject matter | Hosting and operation of Customer's SteadyNode monitoring workspace |
| Duration | The term of Customer's use of the Service and the deletion period in Section 8 |
| Nature and purpose | Receiving, storing, retrieving, transmitting, and deleting monitor configuration and results; executing authorised checks; generating screenshots and alerts; providing support and protecting the Service |
| Personal-data types | Names, business contact details, account identifiers, IP addresses, URLs and request metadata, credentials and tokens configured in monitors, and personal data that may be included in request or response content, monitor results, or screenshots |
| Data subjects | Customer's users and alert recipients; visitors or users of monitored systems whose data is incidentally captured; and other individuals whose data Customer places in or returns through the Service |
| Special-category data | Special-category data (Art. 9 GDPR) and data relating to criminal convictions and offences (Art. 10 GDPR) are not authorised for intentional processing under the Terms. If included incidentally in Customer Content, Customer must promptly notify the Processor and remove it where possible. |
3. Processor obligations
Wild Protection Kft. will:
- process Customer Personal Data only on documented instructions, including instructions in the Terms, this DPA, and Customer's use and configuration of the Service, unless applicable law requires otherwise;
- inform Customer if, in its opinion, an instruction infringes Data Protection Law;
- ensure that persons authorised to process Customer Personal Data are bound by confidentiality obligations;
- implement appropriate technical and organisational measures, taking account of the nature and risks of processing;
- assist Customer, taking account of the processing, with requests from data subjects and obligations under Articles 32–36 GDPR;
- make information reasonably necessary to demonstrate compliance available to Customer and permit audits under Section 7; and
- not sell Customer Personal Data or use it for advertising.
Customer's instructions include processing reasonably necessary to secure the Service, enforce the AUP, prevent abuse, comply with legal obligations that apply to Wild Protection Kft., and produce aggregated, de-identified statistics about the operation of the Service as permitted by Section 6.2(d) of the Terms.
The current security measures include encryption in transit, access controls, least-privilege access, network isolation, and administrative-access logging. Wild Protection Kft. may update these measures where the overall level of protection is not materially reduced.
4. Sub-processors
Customer gives general written authorisation to use the sub-processors listed in Section 6 of the Privacy Policy. The current list identifies each provider's role, data, and configured processing region. Wild Protection Kft. will impose data-protection obligations on each sub-processor that are no less protective than the applicable obligations in this DPA and remains responsible for its sub-processors' performance as required by law.
Wild Protection Kft. will give Customer at least 30 calendar days' prior notice before adding or replacing a direct sub-processor, by email or in-app notice, and update the public list. Customer may object in writing on reasonable data-protection grounds during that period. The parties will work in good faith to resolve the objection. If they cannot, Customer may terminate the affected Service before the change takes effect, subject to the Terms.
Where an urgent replacement is necessary because of a provider failure, a security risk, or a legal requirement, Wild Protection Kft. may give shorter notice and will inform Customer as soon as reasonably possible and update the public list. Customer may object on reasonable data-protection grounds after the change; the parties will work in good faith to resolve the objection. If they cannot, Customer may terminate the affected Service, subject to the Terms.
5. Data-subject requests and assistance
Wild Protection Kft. will promptly forward to Customer any data-subject request it receives that relates to Customer Personal Data and will not respond to that request unless instructed or legally required. Taking account of the processing and information available, Wild Protection Kft. will reasonably assist Customer with requests to exercise rights and with Customer's obligations under Articles 32–36 GDPR. Customer remains responsible for determining and responding to requests.
Assistance beyond the Service's standard functionality and ordinary support may be charged at reasonable cost, with advance notice to Customer and in accordance with any applicable fee-notice requirements in the Terms.
6. Personal-data breaches
Wild Protection Kft. will notify Customer without undue delay after becoming aware of a personal-data breach affecting Customer Personal Data. The notice will include information reasonably available to help Customer meet its obligations and will be supplemented as the investigation progresses. Wild Protection Kft. will take reasonable steps to contain, investigate, and remediate the breach.
7. Compliance information and audits
On reasonable request, Wild Protection Kft. will provide information reasonably necessary to demonstrate compliance with this DPA, such as completed security questionnaires and available third-party reports or certifications. If that information does not reasonably satisfy Customer's audit rights under Art. 28(3)(h) GDPR, Customer may conduct an audit, including an inspection, on at least 30 days' written notice, no more than once in any 12-month period unless a breach, regulator request, or material compliance concern requires otherwise. Customer must treat all information obtained through the audit as confidential under the Terms. Audits must be limited to relevant processing, protect other customers' information, and avoid unreasonable disruption. Customer bears its audit costs. These limits do not restrict rights that cannot be limited under applicable law.
8. Return and deletion
When Customer's use of the Service ends, Wild Protection Kft. will, at Customer's choice and where technically available, return or delete Customer Personal Data within 30 days, unless applicable law requires retention. If enabled, DigitalOcean retains native Droplet backups for four weeks on weekly schedules or seven days on daily schedules; usage-based backups follow their configured retention period, and snapshots remain until deleted. Separately configured application-consistent backups follow the retention period set for their private destination. These copies remain protected under this DPA and are not restored except for recovery or legal obligations. Data that must be retained will remain protected and will be deleted when the retention obligation ends.
9. International transfers
Wild Protection Kft. will ensure that any transfer of Customer Personal Data outside the European Economic Area complies with Chapter V GDPR. For transfers to the United States, we rely on EU-U.S. Data Privacy Framework certification where the recipient holds an active certification; otherwise, or if the EU-U.S. Data Privacy Framework ceases to be a valid transfer mechanism, we rely on Standard Contractual Clauses. Other restricted transfers use an adequacy decision or Standard Contractual Clauses, together with supplementary measures where required. Current direct sub-processors and their configured processing regions are listed in the Privacy Policy; information about applicable safeguards is available from the contact above. Customer authorises the transfers to the sub-processors listed in the Privacy Policy, on the safeguards described there.
10. Customer responsibilities
Customer is responsible for ensuring it has a lawful basis and provides required notices to data subjects, for giving lawful documented instructions, and for configuring monitors to minimise personal data. Customer must not intentionally submit special-category data, data relating to criminal convictions and offences, payment-card data, or real users' financial credentials, as provided in Section 7.3 of the Terms. Section 7.4 of the Terms applies to personal data that Customer includes in Customer Content contrary to the Terms or this DPA.
11. Order of precedence and liability
If this DPA conflicts with the Terms, this DPA controls only for the processing of Customer Personal Data by Wild Protection Kft. as processor. The Terms continue to govern all other use of the Service. Each party's liability arising out of or in connection with this DPA is subject to the limitations and exclusions in the Terms (including Section 10), to the maximum extent permitted by law. Nothing in this DPA limits the rights of data subjects under Art. 82 GDPR or liability that cannot be limited under mandatory law. As between the parties, each is liable for the share of any damage for which it is responsible, as provided in Art. 82(5) GDPR.