Part A. Scope And Roles

When this agreement applies, who is controller, who is processor, and exactly what gets processed.

1. What This Document Is

This is the Data Processing Agreement (DPA) between Viktor Jamrich Enterprises s.r.o., Dolná Poruba 10, 914 43 Dolná Poruba, Slovakia, EU (IČO 50657461; DIČ 2120415561; IČ DPH SK2120415561), and you as our customer. It is the written contract required by Article 28(3) of Regulation (EU) 2016/679 (the GDPR).

It forms part of our Terms of Service and takes effect automatically when you start sending us content that contains personal data. You do not have to sign anything to rely on it. If your procurement process needs a signed copy, email info@heapwatch.com and we will sign this document as it stands.

For data protection questions, this DPA takes precedence over the Terms of Service and over our Privacy Policy.

2. Who Is Controller And Who Is Processor

There are two separate relationships here, and it matters which one you are in.

Your account, your team, your billing, and your use of our website and app. We are the controller. We decide what we need and why, and the Privacy Policy explains it. This DPA does not cover that processing.
The content your devices and your workspace send us. You are the controller and we are your processor. You decide what your firmware sends; we only do what the Service does on your instructions. This DPA covers exactly this.

If you are processing that content on behalf of someone else, for example because you build devices for your own client, then you act as their processor and we are a sub-processor. That is fine, but it is your job to have the agreement in place with them that allows it.

3. What We Process, Why, And For How Long

Subject matter and purpose. Providing the Heapwatch service to you: receiving device telemetry and crash data, storing it, decoding core dumps into stack traces, showing it to you and your team, answering your API, MCP, and real-time requests, carrying out the commands you issue to your devices, and keeping all of that secure.

Nature of the processing. Collection by ingest, recording, storage, organisation, decoding and analysis, display, transmission back to you and your tools, erasure according to your plan's retention window, and backup.

Duration. For as long as your agreement with us runs, and then for the period in clause 13. Telemetry and crash history are deleted earlier, automatically, when they fall outside the retention window of your plan.

Types of personal data. Only what your devices and your team actually send. Typically there is none, or very little. In practice it can include device identifiers that are linked to a person or a location, network identifiers such as IP and MAC addresses, free-text log lines and event payloads written by your firmware, custom parameter values you define, data read out of a device filesystem, and whatever happens to be in memory at the moment a core dump is captured.

Categories of data subjects. Whoever your devices relate to: your own customers and the users of your products, your employees and testers handling lab devices, and any individual whose data your firmware processes in the field.

Special categories. None. Heapwatch is not designed for health, biometric, or other Article 9 data, and our Terms ask you not to send it. If your devices handle such data, keep it out of what you send us.

Part B. How We Process

Your instructions, our people, and the security we keep around your data.

4. Your Instructions

We process your content only on your documented instructions. Your instructions are: this DPA, the Terms of Service, the configuration and retention settings of your workspace, and the actions you (or your coding agent) take in the product, the API, or the MCP endpoint. We do not process your content for our own purposes.

If a law requires us to process or disclose your content for some other reason, we will tell you before we do it, unless that law forbids us from telling you. If we think an instruction of yours breaks data protection law, we will say so and may pause that part of the processing until we have sorted it out together.

You are responsible for having a lawful basis for what you send us, for telling your own data subjects about it, and for making sure you are allowed to pass it to a processor.

5. Our People

Only people who need access to run or support the Service get it, and only to the extent they need. Everyone with access is bound by a confidentiality obligation that lasts beyond their engagement with us, and we keep them trained on handling customer data.

We access your workspace content for support reasons only, which in practice means when you ask us to look at something, or when we are investigating a fault or a security problem that affects you.

6. Security Measures

We keep technical and organisational measures appropriate to the risk, as Article 32 of the GDPR requires. The main ones:

Everything in transit is encrypted. Devices connect over MQTTS, HTTPS, or TCP over TLS. There is no plaintext device socket exposed to the internet. Browsers and API clients use HTTPS, and real-time updates use secure WebSockets.
Separation between customers. Each workspace gets its own database schema, so one customer's device data is not mixed into another's tables.
Access control. Role-based permissions inside each workspace, hashed passwords, optional two-factor authentication and passkeys, and scoped API and MCP keys you can revoke at any time.
Audit trail. Operator actions in a workspace are logged with who did what, when, and with what outcome.
EU infrastructure. The application, the device ingest path, and the telemetry and crash storage run on servers we control in the European Union.
Backups. Regular backups of the databases, restricted to the same controlled environment, ageing out on a fixed cycle.
Secrets management. Credentials and keys are stored encrypted, not in plain text in code or configuration.
Patching and monitoring. We keep the platform and its dependencies updated and watch for unusual activity.

We may change individual measures as technology moves on, but not in a way that lowers the overall level of protection. If you need the current detail for a vendor assessment, ask us at info@heapwatch.com.

Part C. Sub-Processors And Transfers

Who else touches the data, how you hear about changes, and where in the world it goes.

7. Sub-Processors

You give us general authorisation to use sub-processors. We stay responsible to you for what they do, we impose data protection obligations on them that are no weaker than the ones in this DPA, and we keep the list below current.

Device telemetry and crash data stay on our own EU infrastructure. They are not routed through a third-party IoT platform or analytics product. The only sub-processor that touches them is the provider of the EU servers and network we run on.

Our EU hosting and infrastructure provider - the servers, storage, and network that run Heapwatch, inside the European Union. Named on request.
Stripe - payment processing and invoicing. Account and billing data only, never device content.
Mailgun (EU region) - transactional email: account, security, and billing messages.
MailerLite (EU-based) - onboarding and lifecycle email sequences.
PostHog Cloud (EU region) - product analytics in the app, tied to account identities, not to device content.
Chatwoot (EU-hosted) - live chat and support conversations.

If we want to add or replace a sub-processor that would touch your content, we tell you by email at least 30 days beforehand. If you reasonably object on data protection grounds within those 30 days, tell us and we will try to find a workaround. If we cannot, you may terminate the affected subscription and we refund the unused part of what you prepaid.

8. International Transfers

Your device content is stored and processed in the European Union. We do not transfer it outside the EEA in the ordinary course of running the Service.

Where a sub-processor listed in clause 7 involves a transfer outside the EEA for account-level data, that transfer relies on a valid Article 46 safeguard: an adequacy decision for the destination country, or the European Commission's Standard Contractual Clauses together with the extra measures the situation needs. We will give you the specifics for any given supplier on request.

If a safeguard we rely on is struck down or stops being valid, we will tell you and either move the processing or put a replacement safeguard in place.

Part D. Help We Owe You

Data subject requests, breach notification, impact assessments, audits, and evidence.

9. Personal Data Breaches

If we become aware of a personal data breach affecting your content, we will tell you without undue delay, and in any case within 48 hours of becoming aware of it. We notify you, not your data subjects or your regulator, because as controller that call is yours.

Our notice will tell you what we know: what happened, when, which categories and roughly how much data are involved, the likely consequences, what we have done to contain it, and who to talk to at our end. If we do not have the full picture yet, we send what we have and follow up rather than waiting.

We will help you meet your own Article 33 and Article 34 duties, and we will keep a record of the incident and our response.

10. Data Subject Requests

Most of the time you can handle a request yourself: the product lets you search, export, and delete device data, and deleting a workspace removes its content. That is the fastest route for access, rectification, erasure, and portability requests.

If a request needs us, we will help you within a reasonable time and at no charge for ordinary volumes. If a data subject contacts us directly about your content, we will not answer them on the substance. We will tell them to contact you, and let you know.

11. Impact Assessments And Regulators

If you need to carry out a data protection impact assessment or a prior consultation with a supervisory authority for something that involves Heapwatch, we will give you the information about our processing and our security that you reasonably need. We cannot write your assessment for you, but we will not make you guess about our side of it.

12. Audits And Evidence

You may satisfy yourself that we are meeting this DPA. The normal route is to ask us questions in writing, including a security questionnaire, and we will answer with documentation about our measures.

If that is genuinely not enough, you may audit us, or appoint an independent auditor who is not a competitor of ours and who signs a confidentiality agreement. Give us 30 days' notice, keep it to once in any 12-month period unless a regulator or a breach makes another one necessary, do it during business hours, and do not disrupt our other customers or touch their data. You cover your own costs, and we cover ours unless the audit turns up a material failure on our side, in which case we pay for the remediation.

Part E. The End Of Processing

Deletion, return of data, precedence, and how this agreement changes.

13. Deleting Or Returning Data At The End

Through the life of the agreement, your data is already being deleted continuously: telemetry and crash history are purged automatically once they fall outside your plan's retention window, and you can delete devices, applications, or a whole workspace yourself at any time.

When the agreement ends, we keep your workspace content for 30 days so you can export it, as described in the Terms. Tell us during that window if you want it gone sooner, or returned in a machine-readable export, and we will do it.

After those 30 days we delete or irreversibly anonymise your content. Two exceptions, both narrow: records we are legally required to keep, such as invoicing data under Slovak tax law, which are no longer used for processing on your behalf, and copies inside routine backups, which are not individually extracted but expire on their normal cycle.

14. Liability, Precedence, And Changes

The liability provisions in the Terms of Service apply to this DPA as well, and apply to both of us together across the Terms and this DPA rather than twice over. Nothing here changes the liability that the GDPR itself places directly on a processor, or a data subject's right to compensation under Article 82.

If anything in the Terms of Service or the Privacy Policy conflicts with this DPA on a data protection matter, this DPA wins.

A new version of this DPA gets its own permanent URL and /dpa always shows the one in force. We give at least 30 days' notice by email before a change that materially affects your rights under it, and clause 5 of the Terms applies to how that works.

15. Getting In Touch About Data Protection

Anything about this DPA, a signed copy, a security questionnaire, a sub-processor name, or a data subject request goes to info@heapwatch.com. We would rather answer a detailed question than have you assume the worst.

Viktor Jamrich Enterprises s.r.o., Dolná Poruba 10, 914 43 Dolná Poruba, Slovakia, EU