Data Processing Agreement

Effective date: 12 November 2026

This Data Processing Agreement ("DPA") is part of the AlwaysUp Terms of Service (https://alwaysupwp.com/terms/) between you, the customer ("you"), and WP Tech Group LLC, 30 N Gould St, STE 4000, Sheridan, Wyoming 82801, USA ("AlwaysUp", "we", "us"). It applies when we process personal data on your behalf in providing the service, and you accept it by accepting the terms. Words such as "personal data", "processing", "controller", "processor" and "personal data breach" have the meanings given in the EU General Data Protection Regulation ("GDPR") and the UK GDPR. Where US state privacy laws apply, "processor" also means "service provider" or "processor" under those laws.

1. Roles and scope

You are the controller (or a processor acting for your own controller) of the personal data in and about the WordPress sites you connect. We are your processor. Annex 1 describes the processing. Data about you as our customer (your account, billing and support) is covered by our Privacy Policy, where we are controller.

2. Your instructions

We process the personal data only on your documented instructions: these terms, this DPA, your settings and the actions you take in the plugin and dashboard. We will tell you if we believe an instruction breaks the GDPR or other data protection law. We may also process it where the law requires us to; if so, we will tell you first unless the law forbids it.

You are responsible for having a lawful basis for the processing and for telling the people concerned (your site's users, customers and visitors) that you use a service provider for hosting, backup and continuity.

3. Our people

Only people who need access to run the service have it, and they are bound by confidentiality.

4. Security

We take the technical and organisational measures in Annex 2. We may improve them over time, but will not reduce the overall level of protection.

5. Subprocessors

You give us general authorisation to use the subprocessors in Annex 3. Before we add or replace a subprocessor that processes your site's personal data, we will email you at least 30 days in advance. If you object on reasonable data protection grounds, we will discuss it with you in good faith; if we cannot resolve it, you may end the service for the affected sites before the change takes effect, without penalty, and we will refund any fees paid in advance for the period after the end. We impose data protection terms on each subprocessor that protect the personal data at least as much as this DPA, and we remain responsible to you for their performance.

6. International transfers

Where personal data subject to the GDPR, UK GDPR or Swiss data protection law is transferred to us or our subprocessors in a country without an adequacy decision, the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914) apply and are incorporated into this DPA by reference: Module 2 (controller to processor) where you are a controller, and Module 3 (processor to processor) where you are a processor. For those clauses: clause 7 (docking) does not apply; under clause 9 option 2 (general authorisation) applies, with the notice period in section 5; the option in clause 11 does not apply; clauses 17 and 18 are governed by and refer to the law and courts of Ireland; and Annexes I to III are completed by Annexes 1 to 3 of this DPA. For the UK, the UK International Data Transfer Addendum applies; for Switzerland, the clauses apply with the amendments the Swiss data protection authority requires. We put equivalent transfer terms in place with our subprocessors.

7. Helping you

Taking into account what we can see and do, we will help you:

• answer requests from people exercising their rights. Requests that reach us are passed to you; you can also restore, export and ask us to delete data as the service allows;
• meet your obligations on security, breach notification, data protection impact assessments and consultation with authorities, by giving you the information we reasonably have.

8. Personal data breaches

We will notify you of a personal data breach affecting your site's personal data without undue delay, and no later than 72 hours after we become aware of it. We will tell you what we know (what happened, the kinds and approximate amount of data and people affected, likely consequences, and what we are doing about it) and add details as we learn them. We will take reasonable steps to contain it. Notifying you is not an admission of fault.

9. Deletion and return

You can restore your backups from the plugin at any time while your account is active, cancelled or offline for non-payment, until deletion. When the service ends, we delete the personal data on the schedule in our Privacy Policy (stored backups, backup site data and copied changes are deleted 21 days after a cancellation takes effect, or 90 days after protection went offline for non-payment, after a final notice). You can ask us to delete it sooner. We keep only what the law requires us to keep, and records described in our Privacy Policy that contain no row or file contents, for the periods stated there.

10. Audits

We will make available the information reasonably needed to show that we meet this DPA. You may audit our compliance once a year, or after a personal data breach, by sending us written questions first. If the answers and any third-party reports of our subprocessors are not enough, you may carry out an audit on 30 days' written notice, during business hours, at your own cost, by an auditor bound by confidentiality, in a way that does not harm the security of other customers' data. Audits required by a supervisory authority are not limited by this section.

11. Liability and order of precedence

Liability under this DPA is subject to the limits in the terms, except where the law or the Standard Contractual Clauses do not allow that. If this DPA conflicts with the terms, this DPA wins for the processing of personal data; if it conflicts with the Standard Contractual Clauses, the clauses win.

12. Contact

Data protection questions and notices: team@alwaysupwp.com. Where Article 27 of the GDPR or the UK GDPR requires it, we will appoint a representative in the EU and in the UK and name them in our Privacy Policy; until then, use this address.

Annex 1: Description of the processing

• Subject matter and purpose. Providing the AlwaysUp service: monitoring your site, keeping a saved copy of its public pages, encrypted offsite backups and restores, running a working backup site during an outage (including payments and email for it where enabled), returning changes to your server, and the AI features you use.
• Duration. For as long as you use the service, then until deletion under section 9.
• Nature of the processing. Collection, storage, encryption, copying, hosting and serving, transmission, comparison and deletion.
• Data subjects. Your site's users, customers, subscribers, commenters, form senders and visitors, and people whose data you publish on or store in your site.
• Categories of personal data. Whatever your WordPress database and files hold, for example names, email and postal addresses, phone numbers, user accounts and password hashes, orders and payment records your shop keeps, form entries and comments; visitors' IP addresses and request details passing through the edge; email sent by a backup site (recipients, headers and content).
• Special categories. We do not ask for them. If your site stores them, they are processed as part of your backup and backup site, under the same measures.
• Frequency. Continuous while the service is active.
• Retention. As set out in our Privacy Policy.

Annex 2: Security measures

• Backups are encrypted on your server with AES-256-GCM, with a key unique to your site, before upload, and go directly to storage through temporary upload links that verify the storage server's certificate. Stored object names do not reveal file names.
• The per-site key is stored encrypted. We hold it so you never manage keys, which means our service and its operators can technically decrypt backups; every hand-out of the key is recorded in an append-only audit log.
• Each backup site runs isolated from other sites, with limits on resources and outgoing connections (internal addresses and mail port 25 are always refused). Changes copied off it are encrypted with a separate key. Its disk is not currently encrypted at rest by us.
• Card details entered in a payment provider's hosted fields do not pass through our service. Payment telemetry is limited to short codes and counts, checked against an allow-list twice, and never contains card data, secrets, tokens or shoppers' details.
• Email sent by a backup site is stored encrypted until delivered and deleted after delivery or final failure, at the latest after 30 days; per-site sending limits, suppression of bounced and complaining addresses, and abuse holds apply.
• Personal data and secrets are removed from AI inputs wherever the feature allows; inputs that still contain personal data go only to AI providers that offer a data processing agreement.
• Access tokens are scoped per function; access to production systems is limited to the people who run the service.
• Health checks, incidents and operator actions on backup sites, payments and emergency releases are recorded.
• Retention and deletion follow the schedule in our Privacy Policy, and nothing is deleted while a legal hold or open incident applies.

Annex 3: Subprocessors

The current list of AI providers in use is available on request at team@alwaysupwp.com.

Stripe processes billing for your AlwaysUp subscription as part of our relationship with you, not your site's data. A payment provider your shop uses (for example Stripe) is your own provider under your own terms, not our subprocessor.