Last updated:
Data Processing Addendum (summary)
This Addendum forms part of the Terms of Service between Sigmon ("Processor") and the customer ("Controller") and applies to personal data contained in telemetry the customer sends to its Sigmon Cloud instance ("Customer Personal Data"). For a countersigned copy, email [email protected].
1. Subject matter and duration
Hosting and processing of Customer Personal Data to provide Sigmon Cloud, for the duration of the subscription plus the deletion period in section 8.
2. Nature and purpose
Collection via the customer's SDKs, storage, indexing, querying, alerting, backup and restoration of telemetry. Processing is carried out only on the customer's documented instructions, which are the Terms, the product configuration chosen by the customer, and support requests.
3. Categories of data and data subjects
Data subjects are the customer's end users and staff. Categories depend on what the customer instruments: typically pseudonymous user and session identifiers, IP addresses, device and browser information, event properties, error context and feedback text. The customer is responsible for masking sensitive data in its SDK configuration and must not send special categories of data without a written agreement.
4. Processor obligations
The Processor will: process data only on documented instructions; ensure personnel are bound by confidentiality; implement appropriate technical and organisational measures (section 6); assist the Controller with data subject requests and security obligations; and make available information needed to demonstrate compliance.
5. Sub-processors
The Controller authorises the sub-processors listed in the Privacy Policy: Stripe (billing), Resend (email), Cloudflare (DNS and backup storage) and the hosting provider. The Processor imposes equivalent data protection obligations on them, remains liable for their performance, and will notify the Controller by email before adding or replacing a sub-processor that processes Customer Personal Data. The Controller may object on reasonable grounds within 30 days.
6. Security measures
Dedicated instance and database per customer; encryption in transit and for backups; access restricted to authorised staff and logged; managed backups with point-in-time recovery; regular patching.
7. Personal data breaches
The Processor will notify the Controller without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, with the information reasonably available to help the Controller meet its obligations.
8. Return and deletion
The Controller can export its data at any time using the product's APIs. The Processor deletes the instance and Customer Personal Data, including backups, 30 days after cancellation takes effect, unless law requires retention.
9. Audits
The Processor will respond to reasonable written questionnaires and, no more than once a year and on reasonable notice, allow an audit by the Controller or its auditor, at the Controller's cost and subject to confidentiality.
10. International transfers
Transfers to sub-processors outside the Controller's jurisdiction are made under appropriate safeguards, such as standard contractual clauses, where required.
11. Contact
Sigmon, [email protected].