Data Processing Agreement

Last updated: 21 October 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service between SiteSentry, a service operated by Adcam Advertising (Pty) Ltd (ADCAM AI), 223 George Rd, Wilderness, 6529, South Africa ("SiteSentry", "we", "us"), and the customer organisation that has subscribed to the Service ("Customer", "you"). It governs our processing of personal data contained in Customer Data on your behalf and applies where the GDPR, UK GDPR, POPIA or comparable data protection law applies to that processing.

1. Roles of the Parties

For personal data contained in Customer Data — for example monitor configurations, alert recipient email addresses, browser-check credentials, status page subscriber emails and domain registration contacts — the Customer is the controller and SiteSentry is the processor. For account, billing and product telemetry data about the Customer's own users, SiteSentry acts as a controller as described in the Privacy Policy.

2. Subject Matter, Duration and Purpose

Subject matter. Provision of uptime, SSL/TLS, DNS, security posture, synthetic browser-check monitoring, alerting, reporting, status pages, credential vaulting and domain services.
Duration. For the term of the subscription, plus the retention periods in Section 8.
Nature and purpose. Storage, retrieval, analysis, transmission of alerts, generation of reports and deletion of Customer Data solely to deliver and support the Service.
Categories of data subjects. Customer's personnel and organisation members, alert and report recipients, status page subscribers, and domain registration contacts.
Categories of personal data. Names, business email addresses, phone numbers where supplied, IP addresses, authentication identifiers, and any credentials or headers the Customer chooses to store in the encrypted vault.
Special categories. None. Customers must not submit special category data to the Service.

3. Customer Instructions

We process personal data only on documented instructions from the Customer, which are given by the Customer's configuration and use of the Service, this DPA, and the Terms. We will inform the Customer if, in our opinion, an instruction infringes applicable data protection law, and we do not sell Customer Data or use it to train general-purpose AI models.

4. Confidentiality

Personnel authorised to process personal data are bound by confidentiality obligations and receive access strictly on a need-to-know basis. Production access is limited to a small number of administrators and is logged.

5. Security Measures

Encryption in transit (TLS 1.2+) for all traffic, and encryption at rest for the production database, storage buckets and backups.
Row-level security on every tenant table so records are only reachable by members of the owning organisation.
AES-256-GCM envelope encryption for the credential vault, with WebAuthn or TOTP re-authentication required to unlock.
Role-based access control (owner, admin, viewer) plus a separate platform administration role.
Audit logging of sign-in, role changes, monitor changes and administrative actions.
Secrets held in a managed secret store, never in source control; API keys stored as SHA-256 hashes only.
Automated dependency and configuration scanning, with least-privilege service credentials for background functions.

6. Sub-processors

The Customer provides general authorisation for SiteSentry to engage sub-processors. The current list is published at Sub-processors. We impose data protection obligations on each sub-processor that are no less protective than this DPA and remain responsible for their performance. We will give reasonable notice before adding or replacing a sub-processor, and the Customer may object on reasonable data protection grounds by contacting info@adcamai.com.

7. International Transfers

Where personal data is transferred outside the EEA, UK or South Africa, the transfer relies on an adequacy decision or on the European Commission's Standard Contractual Clauses (with the UK Addendum where relevant), together with the technical measures described in Section 5.

8. Retention, Return and Deletion

Monitoring results and check history are retained on a rolling basis to support 7/30/90-day reporting. Customer Data can be exported at any time from the application. On termination, Customer Data is deleted within 30 days, and backups age out within 90 days, unless retention is required by law.

9. Data Subject Requests

The Service provides self-service tools to access, correct, export and delete Customer Data. Where a data subject contacts us directly about Customer Data, we refer them to the Customer and assist the Customer in responding within the statutory time limits.

10. Personal Data Breach

We will notify the Customer without undue delay, and in any event within 72 hours of becoming aware of a personal data breach affecting Customer Data, providing the nature of the breach, categories and approximate volume of records affected, likely consequences and remediation steps taken.

11. Audits and Assistance

On reasonable written request, and no more than once per year, we will provide the information necessary to demonstrate compliance with this DPA, including our security documentation, control mapping and the compliance reports available in the application. We also assist the Customer with data protection impact assessments relating to the Service.

12. Contact

To request a countersigned copy of this DPA, or to raise any data protection matter, email info@adcamai.com.