Skip to main content

Data Processing Agreement

This Data Processing Agreement (“DPA”) is an extra agreement that forms part of the Terms of Service between Apogee Information Systems (“we”, “us”, “Processor”) and the customer that uses Apogee Watcher (“you”, “Customer”, “Controller”). Related: Privacy policy.

Last updated: 2026-10-12

Apogee Information Systems is an EU company. Production hosting for Apogee Watcher is located in data centres in the European Union. Processing and storing data in a secure, fair, and transparent way is important to us.

If you are accepting this DPA on behalf of a company or organisation, you confirm that: (a) you have authority to bind that entity to this DPA; (b) you have read and understand this DPA; and (c) you agree to this DPA on behalf of that entity.

This DPA applies to Customer Content that we process on your behalf in connection with the Apogee Watcher service (the “Service”). It does not replace our role as an independent controller for account registration, billing, website analytics, and support communications, which are described in our privacy policy.

Definitions

  • “You” or “Customer” means the company or organisation that signs up to use Apogee Watcher.
  • “Customer Content” means data you submit to or generate in the Service for your own monitoring and reporting purposes — for example monitored URLs and domains, site and workspace names, team invitations and membership in your organisation account, performance test history and reports you configure, and similar settings or export content under your account.
  • “Data Protection Legislation” means the General Data Protection Regulation (Regulation (EU) 2016/679) and other applicable laws relating to the processing of personal data that may apply in a relevant jurisdiction.
  • “data controller”, “data processor”, “data subject”, “personal data”, and “processing” have the meanings given in applicable Data Protection Legislation.
  • The parties agree that, for Customer Content that includes personal data, the Customer is the data controller and Apogee Information Systems is the data processor in the course of providing the Service.

Scope of processing

What we process: hosting, storage, retrieval, and other processing of Customer Content as needed for PageSpeed and Core Web Vitals monitoring, discovery, alerts, reporting, and related product features you enable.

How long: for the life of your subscription or account, plus any retention needed for backups, security, or legal compliance as described below and in the privacy policy.

Purpose: run the Service according to your instructions through the product (and any written instructions we agree).

Personal data (when present in Customer Content): typically business contact details of your users (for example name and email for team seats), and any personal data that may appear in URLs, labels, or notes you choose to store. People concerned: your authorised users and, where applicable, individuals whose details appear in content you submit.

Privacy and security of Customer Content

You retain ownership and control of Customer Content. We obtain no rights to use Customer Content except as needed to provide, secure, and improve the Service for you, or as required by law. We do not sell Customer Content.

We use appropriate security and organisational measures, including encryption while data is sent over the network, access controls, and hosting in EU data centres for production. More detail appears in the privacy policy (hosting, analytics, and third-party tools).

When you run performance tests, third-party test providers (for example Google PageSpeed Insights) may process the URLs and related technical data you request. Those providers process under their own terms; you instruct us to submit those requests as part of providing the Service.

Processor obligations

  • We process Customer Content only on your instructions (including through normal use of the Service), unless required by law.
  • We will tell you promptly if, in our opinion, an instruction breaks Data Protection Legislation (where we are legally allowed to say so).
  • People we authorise to process Customer Content must keep it confidential.
  • We use appropriate security and organisational measures to protect Customer Content.
  • We may use other companies (subprocessors) where needed to run the Service. They must follow data-protection duties at least as protective as this DPA for the work they do for us. Important changes may be announced in the Service, by email, or in the privacy policy; you may object and, if necessary, end the Service as described in the Terms.
  • We will notify you promptly after becoming aware of a personal data breach affecting Customer Content, and take reasonable steps to limit the harm.
  • Where Customer Content is involved, we will help with reasonable requests about people’s privacy rights, data protection impact assessments (DPIAs), and questions from data protection authorities.
  • When the Service ends, we will delete or return Customer Content according to product features and our retention practices, except where the law or security backups require keeping it for a limited time.
  • On reasonable written request, and under confidentiality, we will share information needed to show we comply with this DPA, and allow audits as we both agree (usually starting with a remote questionnaire or documents).

International transfers

Primary production processing of Service data is in the European Union. Where a subprocessor processes personal data outside the European Economic Area or the UK and the law requires a transfer arrangement, we use approved safeguards such as the EU Standard Contractual Clauses (or an equivalent).

Customer undertakings

  • You confirm that you have the necessary rights and legal grounds to provide Customer Content for processing.
  • You are responsible for making sure your use is lawful, giving people privacy notices where required, configuring the Service appropriately, and responding to privacy requests about your Customer Content.
  • You will not instruct us to process Customer Content in a way that breaks Data Protection Legislation.

Liability

Liability under this DPA is subject to the limitations and exclusions in the Terms of Service, except where Data Protection Legislation requires otherwise.

Duration and acceptance

This DPA applies from the date you first accept the Terms or create an Apogee Watcher account (whichever is earlier), replaces any earlier data processing terms between you and us for the Service, and may be updated from time to time. Important updates will show in the “Last updated” date above; continued use after an update means you accept it where the law allows.

Using the Service means you accept this DPA. No separate signature is required, unless we agree otherwise in writing (for example an enterprise order form).

Duties to keep information confidential continue after this DPA ends.

Contact

Apogee Information Systems — Contact us