Last updated: November 13 2025
This Data Processing Addendum (hereinafter “DPA”) is entered into between you (hereinafter the “Customer”, “you”, “your”) and INB MONITORING - FZCO (hereinafter the “Company”, “I&B monitoring”, “we”, “us” or “our”), hereinafter referred to individually as a “Party” or together as the “Parties”. This DPA supplements the Terms of Use (hereinafter the “Agreement”), concluded between the Parties.
This DPA governs the processing of personal data that the Customer provides to the Company in connection with the use of the Company’s services (together the “Services”), as well as any personal data that the Company obtains in the course of performing the Services for the Customer.
Unless otherwise defined in this DPA, all capitalised terms used in this DPA will have the meanings set forth in the Agreement. This DPA shall remain in force until the termination of the Agreement between you and us governing your use of the Services. In the event of any conflict between this DPA and the Agreement, the provisions of this DPA shall prevail with respect to the processing of personal data.
For the purposes of this DPA, the following terms shall have the meanings set out below:
“Data Protection Laws” means all applicable laws and regulations relating to the processing of Customer Data, including those of the European Union, the European Economic Area and its member states.
“Data Transfer Mechanism” means any legally recognised mechanism, instrument or framework that permits the transfer of Customer Data from one jurisdiction to another in compliance with applicable Data Protection Laws.
“General Data Protection Regulation (GDPR)” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC.
“EU Standard Contractual Clauses (EU SCCs)” means the standard contractual clauses adopted by the European Commission for the transfer of personal data to third countries pursuant to GDPR, as amended from time to time.
“Controller”, “Processor”, “Data Subject”, “Personal Data”, and “Processing” shall have the meanings given in the applicable Data Protection Laws.
“Customer Data” means any personal data that the Customer uploads, submits, or otherwise provides to I&B monitoring in connection with the Services, or which I&B monitoring otherwise processes on behalf of the Customer in performing the Services.
“Public Authority” means a government agency or law enforcement authority, including judicial authorities.
“Sub-processor” means any third party engaged by I&B monitoring that processes Customer Data in connection with the provision of the Services.
“Supervisory Authority” means an independent public authority established under Data Protection Laws and responsible for monitoring the application of data protection legislation.
Where I&B monitoring processes Customer Data on your behalf in connection with the Services, you acknowledge and agree that with regard to such processing of Customer Data, you are the controller or processor, and the Company is a processor or sub-processor (as defined by the Data Protection Laws) acting on your behalf. A description of such processing is set out in Schedule 1 of this DPA. This DPA shall apply accordingly to established roles and not apply to situations where we act as a controller in accordance with the Company’s Privacy Policy.
If the Customer is a processor, the Customer warrants to I&B monitoring that Customer’s instructions and actions in respect to personal data, including appointing I&B monitoring as sub-processor and, where applicable, concluding the EU SCCs or any other Addenda under Section 9 of this DPA (including as they may be amended in Section 9 below), have been (and will, for the duration of this DPA, continue to be) authorised by the relevant third-party controller.
The Parties agree that this DPA and the applicable Agreement constitute the Customer’s complete and final documented instructions regarding the processing of the Customer Data (hereinafter the “Instructions”) where the Customer acts as a controller or processor and I&B monitoring acts as a processor or sub-processor under Data Protection Laws.
Any additional or alternative instructions must be agreed in writing by the Parties and shall be consistent with this DPA and the Agreement.
The processing of the Customer Data on the Customer’s behalf in connection with Services is described in Schedule 1 of this DPA. We reserve the right to update the description of processing from time to time to reflect new functionality that is part of the Services.
Within the scope of the DPA, when the Customer acts as a controller, the Customer shall be responsible for complying with all requirements that apply to the Customer as a controller under the Data Protection Laws.
When acting as a controller, you must:
(a) maintain the accuracy, quality, confidentiality and security of the Customer Data;
(b) comply with and perform your obligations under Data Protection Laws, including with regard to data subject rights, data security and confidentiality, and ensure you have an appropriate legal basis for the processing of personal data;
(c) provide I&B monitoring only with Customer Data that has been lawfully obtained and ensure such data is adequate, relevant and proportionate to the intended purposes;
(d) ensure that your Instructions to I&B monitoring regarding the processing of Customer Data comply with the Data Protection Laws, including the principles of data minimisation, purpose limitation and storage limitation.
Within the scope of the DPA, when the Customer acts as a processor, the Customer shall be responsible for complying with all requirements that apply to the Customer as a processor under the Data Protection Laws.
When acting as a Processor, you must:
(a) provide I&B monitoring only with processing instructions that accurately reflect the documented instructions of the respective controller;
(b) provide I&B monitoring only with Customer Data that has been lawfully obtained from the respective controller and that is adequate, relevant, and limited to what is necessary for the permitted purposes;
(c) maintain transparency with the respective controller regarding the engagement of I&B monitoring and any sub-processors;
(d) comply with all obligations under applicable Data Protection Laws in your capacity as a processor;
(e) ensure that your personnel or any third party accessing Customer Data comply with this DPA and the Agreement.
When I&B monitoring acts as a processor/sub-processor, the Company must:
(a) process Customer Data according to your Instructions and exclusively for the specified purposes;
(b) inform you if, in I&B monitoring’s reasonable opinion:
(i) your Instructions violate or may violate applicable Data Protection Laws; or
(ii) I&B monitoring is unable to comply with your Instructions;
(c) implement and maintain appropriate technical and organizational measures to ensure the confidentiality of Customer Data;
(d) comply with all applicable Data Protection Laws, including obligations relating to data subject rights, data security, and confidentiality;
(e) ensure, through written contracts or other legally binding means, that any sub-processor engaged to process Customer Data on behalf of I&B monitoring is subject to equivalent data protection obligations as set out in this DPA and the Agreement;
(f) maintain accurate records of all processing activities carried out on your behalf under this DPA and provide such records to you upon request;
(g) without undue delay notify you if I&B monitoring becomes aware that any Customer Data provided by you is inaccurate, incomplete, or outdated;
(h) provide you with all information reasonably necessary to demonstrate I&B monitoring’s compliance with its obligations under applicable Data Protection Laws.
Upon becoming aware, we shall inform you of any legally binding request for disclosure of the Customer Data by a Public Authority, unless we are otherwise forbidden by law to inform the Customer, for instance, to preserve the confidentiality of investigation by a Public Authority. We will inform you if I&B monitoring becomes aware of any notice, inquiry or investigation by a Supervisory Authority with respect to the processing of Customer Data under this DPA conducted between you and us.
We will not access or use or disclose to any third party any Customer Data, except, in each case, as necessary to maintain or provide the Services or as necessary to comply with contractual and legal obligations or binding order of a public body (such as a subpoena or court order).
We shall ensure that any employee/contractor whom we authorise to access the Customer Data on our behalf is subject to appropriate confidentiality contractual or statutory duty obligations with respect to Customer Data.
We shall implement and maintain appropriate technical and organisational measures to protect the Customer Data from any data breaches such as actual or suspected accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access to the Customer Data transmitted, stored or otherwise processed (hereinafter the “Security Incidents”) in accordance with our security standards set out in Schedule 2 of this DPA.
You acknowledge that security measures are subject to technical progress so that we may modify or update Schedule 2 of this DPA at our sole discretion, provided that such modification or update does not result in a material degradation in the security measures offered by Schedule 2 of this DPA.
Upon becoming aware of a Security Incident, we shall:
—
notify you without undue delay after we become aware of the Security Incident;
—
provide timely information relating to the Security Incident (the type of personal data, the categories and potential number of individuals or records affected) as it becomes known or as is reasonably requested by you; and
—
promptly take reasonable steps to contain and investigate any Security Incident so that you can notify competent authorities and/or affected Data Subjects of the Security Incident.
Our notification of or response to a Security Incident shall not be construed as an acknowledgment by us of any fault or liability regarding the Security Incident.
Upon termination or expiration of the Agreement concluded between you and us, we shall delete or return all Customer Data in our possession or control. This requirement shall not apply to the extent we are required by applicable law or respective contractual obligations to retain some or all of the Customer Data.
We agree to provide reasonable assistance to the Customer regarding:
(a) any request from a data subject in respect of access to or the rectification, erasure, restriction, portability, blocking or deletion of Customer Data that we process on behalf of Customer. In the event that a data subject sends such a request directly to us, Section 7 of this DPA shall apply;
(b) the investigation of the Security Incident and communication of necessary notifications regarding such Security Incidents subject to Section 6.5. of this DPA;
(c) preparation of data protection impact assessments (the “DPIAs”) and, where necessary, consultation of the Customer with the Supervisory Authority under Articles 35 and 36 of the GDPR.
If a Supervisory Authority requires an audit of our data processing facilities we use to process the Customer Data to ascertain or monitor Customer's compliance with the Data Protection Laws, we will cooperate with the audit. The Customer is responsible for all costs and fees related to such audit, including all reasonable costs and fees for any and all time we expend for any such audit, in addition to the rates for services performed by us.
The Customer may, prior to the commencement of processing and at regular intervals, thereafter, audit the technical and organisational measures taken by us. If the Customer is the controller with respect to the personal data processed by us on its behalf, upon reasonable and timely advance agreement, during regular business hours and without interruption to our business operations, we may provide the Customer with all information necessary to demonstrate compliance with its obligations laid down in Article 28 of the GDPR and allow for and contribute to audits, including inspections, conducted by the Customer or another auditor mandated by the Customer with respect to such processing.
We shall, upon the Customer’s written request and within a reasonable period, provide the Customer with all information necessary for such audit, to the extent that such information is within our control and we are not precluded from disclosing it by applicable law, a duty of confidentiality, or any other obligation owed to a third party.
In the event that a data subject contacts us with regard to the exercise of their rights under the Data Protection Laws (in particular, requests for access to, rectification or deletion of the Customer Data), we will use all reasonable efforts to forward such requests to you. If we are legally required to respond to such a request, we shall immediately notify you and provide you with a copy of the request unless we are legally prohibited from doing so.
I&B monitoring has the general written authorisation from the Customer, for the engagement of sub-processors from an agreed list. I&B monitoring agrees to inform the Customer of any intended changes to that list concerning the addition or replacement of sub-processors at least 10 days prior to the engagement of the sub-processor in question, thereby giving the Customer the opportunity to object to such changes. I&B monitoring shall provide the Customer with the information necessary to enable the Customer to exercise the right to object.
If Section 9 of this DPA applies, the procedure for engaging sub-processors shall be governed by the relevant provisions of Section 9 of this DPA. In such a case, the provisions of Section 9 shall prevail. The agreed list of Sub-processors is set out in Schedule 3 of this DPA.
You acknowledge and agree that using I&B monitoring Services may involve transferring the Customer Data to other jurisdictions, in compliance with applicable Data Protection Laws.
In the event of any conflict between the provisions of this DPA and the applicable Data Transfer Mechanisms, the provisions of the relevant Data Transfer Mechanism shall prevail solely to the extent of such conflict.
When the processing of Customer Data on your behalf in connection with Services constitutes a “transfer” under the GDPR, Standard Contractual Clauses shall apply.
When you are a controller, and we are a processor, Module Two of the EU SCCs shall apply, and when you are a processor and we are a sub-processor, Module Three of the EU SCCs shall apply.
For the purpose of the EU SCCs, I&B monitoring is a “Data Importer”, and you are a “Data Exporter”.
The relevant provisions contained in the EU SCCs are incorporated by reference and are an integral part of this DPA. Clauses and annexes of the EU SCCs are deemed to be completed as follows:
(i) in Clause 7, the optional docking clause shall not apply;
(ii) in Clause 9, Option 2 (General written authorisation) shall apply. For the purpose of Clause 9(a), the time period for informing of the Data Exporter shall be 10 days;
(iii) in Clause 11, the optional provision shall not apply;
(iv) in Clause 13, a particular option shall apply depending on the specific case;
(v) in Clause 17, Option 1 shall apply. The EU SCCs shall be governed by the law of Ireland;
(vi) in Clause 18(b), disputes shall be resolved by the courts of Ireland;
(vii) Annex I of the EU SCCs is deemed completed with the information set out in Schedule 1 of this DPA;
(viii) Annex II of the EU SCCs is deemed completed with the information set out in Schedule 2 of this DPA.
Name: You, “Customer”
Address: the relevant information is contained in the Customer’s account.
Contact person’s name, position, and contact details: the relevant information is contained in the Customer’s account.
Activities relevant to the data transferred under these Clauses: provision of the Services.
Signature and date: the Parties agree that execution of the Agreement by the Data Exporter shall constitute execution of this DPA by both the Data Importer and Data Exporter. The date of the registration of the account on the Platform shall be considered the date of execution of this DPA.
Role: controller or processor
Name: INB MONITORING - FZCO
Address: Office B132-W, Techno Hub 2, Dubai, The United Arab Emirates
INB MONITORING FZCO can be contacted at dpo@inbmonitoring.net
Activities relevant to the data transferred under these Clauses: provision of the Services.
Signature and date: the Parties agree that execution of the Agreement by the Data Exporter shall constitute execution of this DPA by both the Data Importer and Data Exporter. The date of the registration of the account on the Platform shall be considered the date of execution of this DPA.
Role: processor or sub-processor
1. Categories of data subjects whose personal data is transferred:
•
Customer’s clients or other third parties;
•
other data subjects whose personal data is uploaded to the I&B monitoring platform by the Customer.
2. Categories of personal data transferred:
•
Monitoring Information (information that the Company collects from the Customer’s connected infrastructure and generates as a result of processing, including metrics, alerts, and outage events).
•
Configuration Information (information that the Customer enters to configure monitoring in the I&B Configurator, such as monitored resources or services, thresholds, and dashboard settings).
•
Other Customer-Managed Information (other data provided by our Customer for the performance of services to our Customer by us).
3. Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved:
I&B monitoring does not require or intend to process special categories of personal data.
4. The frequency of the transfer:
The personal data is transferred on a continuous basis.
5. Nature of the processing:
Personal data processing consists of the following: collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, alignment or combination, restriction, erasure or destruction.
6. Purpose(s) of the data transfer and further processing:
The purpose of the data processing under these Clauses is the performance of the services for the Data Exporter by the Data Importer under the Agreement concluded between the Data Importer and the Data Exporter.
7. The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period:
The personal data shall be stored for the duration of this DPA concluded between the Data Importer and the Data Exporter unless otherwise agreed in writing or the Data Importer is required by applicable law to retain some or all of the transferred personal data.
8. For transfers to (sub-) processors, also specify the subject matter, nature, and duration of the processing:
subject matter: the performance of services
nature: collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, alignment or combination, restriction, erasure or destruction.
duration: the performance of the services for the Data Importer by the (sub-) processor under the service agreement concluded between the Data Importer and (sub-) processor.
In accordance with Clause 13, competent supervisory authority under these Clauses is determined depending on what version of Clause 13(a) applies to the Data Exporter.
Description of the technical and organisational measures implemented by the Data Importer(s) to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing and the risks for the rights and freedoms of natural persons:
•
Data Importer is committed to preserving the confidentiality, integrity, availability, and resilience of all personal data in question throughout its processing activities and ensuring that personal data are protected against loss and destruction by implementing appropriate internal information security policies, procedures, and other appropriate measures.
•
Data Importer grants access to personal data strictly on a need-to-know basis, and such data is accessible only to authorised personnel.
•
Data Importer has implemented role-based access control and access control lists to enforce strict separation of user access rights.
•
Data Importer's information security procedures are subject to regular reviews.
•
Data Importer uses reliable service providers and monitors what technical and organisational measures they have in place to ensure that personal data is protected at all times.
•
Data Importer uses reliable service providers and monitors what technical and organisational measures they have in place to ensure that personal data is protected at all times.
•
Data Importer has implemented measures designed to protect the confidentiality and integrity of personal data during data transfers.
Information about sub-processors can be requested by Customer by email to dpo@inbmonitoring.net