Privacy Policy

Zaskoku & Haupt GbR (Uptimeify) Version 1.0 · As of 3 August 2026

This policy tells you what data we process, why we process it and what rights you have. It covers our website uptimeify.io, our documentation at docs.uptimeify.io and your use of the monitoring application.

This is a translation. The German version of this policy is the authoritative one and prevails in the event of any discrepancy. References to German statutes keep their original citation because German law applies. TDDDG is the German Digital Services Data Protection Act, BDSG the German Federal Data Protection Act.

1. Controller

Zaskoku & Haupt GbR Lange Str. 54 - 56 48683 Ahaus Germany

Represented by Florian Zaskoku and Pascal Haupt Phone: +49 2568 900 9000 Email: hello@uptimeify.io

The controller is the natural or legal person who alone or jointly with others determines the purposes and means of processing personal data.

We will appoint a data protection officer as soon as we are legally required to do so. Until then, address data protection enquiries to hello@uptimeify.io.

2. Two roles, one note up front

We process data in two distinct roles, and understanding the difference matters for reading this policy.

As controller we process data for our own purposes: operating the website, pre-contractual steps, your account, billing, support and security. That is what this policy is about.

As processor we handle the data our customers bring into Uptimeify, such as monitored addresses, check results and notification recipients. In that case the customer determines the purposes and means, not us. The basis for this is our data processing agreement. If you encounter Uptimeify through an account set up by your service provider, or through a status page, that provider is your point of contact for the data concerned. Section 9 explains this in more detail.

3. Your rights

You have the right at any time to:

• Access the data we hold about you, its origin, recipients and purpose of processing (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability in a commonly used, machine readable format (Art. 20 GDPR)
• Withdraw consent with effect for the future, without affecting the lawfulness of processing carried out up to that point (Art. 7 (3) GDPR)
• Lodge a complaint with a supervisory authority, in particular in the member state of your residence, your place of work or the place of the alleged infringement (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia.

Right to object under Art. 21 GDPR

Where we process data on the basis of a legitimate interest under Art. 6 (1) lit. f GDPR, you may object to that processing on grounds relating to your particular situation. This also applies to profiling based on those provisions. If you object, we will no longer process the data concerned unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or unless the processing serves to establish, exercise or defend legal claims.

Where your data is processed for direct marketing purposes, you may object at any time and without giving reasons. After your objection we will no longer use it for direct marketing. This applies in particular to the processing described in section 5.6.

Send objections informally to hello@uptimeify.io.

4. Legal bases at a glance

We process personal data on one of the following bases:

• Consent (Art. 6 (1) lit. a GDPR, and additionally Sec. 25 (1) TDDDG where information on your device is accessed)
• Contract or pre-contractual steps (Art. 6 (1) lit. b GDPR)
• Legal obligation (Art. 6 (1) lit. c GDPR), for example tax retention and verification duties
• Legitimate interest (Art. 6 (1) lit. f GDPR)

The applicable basis is stated for each processing activity below.

5. Website

5.1 Hosting and delivery

We operate our website and the monitoring application with Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Further infrastructure is provided by OVH SAS, 2 rue Kellermann, 59100 Roubaix, France, netcup GmbH, UpCloud Ltd and IONOS SE. All locations are within the European Union.

Static content such as images, fonts and scripts is delivered through the content delivery network of BunnyWay d.o.o. (bunny.net), Cesta Komandanta Staneta 4a, 1215 Medvode, Slovenia. In doing so, bunny.net processes technical connection data such as IP address, time, resource requested and browser information. We have restricted delivery to European locations.

The legal basis is Art. 6 (1) lit. f GDPR. We have a legitimate interest in reliable and fast delivery. We have concluded data processing agreements with all of the providers named.

A complete overview of the service providers we use is available at https://uptimeify.io/subprocessors.

5.2 Server log files

When you access our pages, the server automatically records information transmitted by your browser:

• browser type and version
• operating system used
• referrer URL
• hostname of the accessing device
• time of the server request
• IP address

We do not combine this data with other sources. The legal basis is Art. 6 (1) lit. f GDPR; we have a legitimate interest in technically correct delivery, in optimising our website and in defending against attacks. We delete log files after 30 days at the latest, unless a specific security incident makes longer retention necessary for investigation.

5.3 Cookies and consent management

Cookies are small data files stored on your device. They do no harm there. Some are deleted at the end of your visit (session cookies), others remain until you delete them or your browser removes them.

Necessary cookies are set without consent because the website does not work without them, for example for login, session management and security. The legal basis is Sec. 25 (2) TDDDG in conjunction with Art. 6 (1) lit. f GDPR.

All other cookies and comparable technologies are set only after you have consented. The legal basis is Art. 6 (1) lit. a GDPR and Sec. 25 (1) TDDDG. You can change or withdraw your choice at any time through the cookie settings on our website.

To obtain and document your consent we use a consent management solution. It stores your choice, the time and technical details about your browser so that we can demonstrate the consent. The legal basis for this is Art. 6 (1) lit. c GDPR.

5.4 Google Tag Manager, Google Analytics and Google Ads

On our public website we use services provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We do not use these services within the monitoring application.

Google Tag Manager manages the loading of the other services. The Tag Manager itself does not build user profiles, but it loads the scripts that do and processes your IP address in the process.

Google Analytics analyses how our website is used: pages viewed, time spent, origin, device and interactions. Recognition technologies such as cookies are used for this. Google partly supplements the collected data through modelling.

Google Ads allows us to display advertisements and measure their success.

The legal basis for all three services is your consent under Art. 6 (1) lit. a GDPR and Sec. 25 (1) TDDDG. Without your consent they are not loaded. Consent can be withdrawn at any time.

Data may be transferred to the USA in this context. Google LLC is certified under the EU-US Data Privacy Framework; in addition we base the transfer on standard contractual clauses. We have concluded a data processing agreement with Google for Google Analytics.

Further information: https://policies.google.com/privacy

5.5 fastmon (real user monitoring)

We use real user monitoring provided by fastmon labs UG (haftungsbeschränkt), Germany. It lets us measure how quickly our interfaces load for real visitors so that we can improve performance. Technical telemetry is collected, such as load times, page views, browser, device type and approximate origin.

The legal basis is your consent under Art. 6 (1) lit. a GDPR and Sec. 25 (1) TDDDG, because information on your device is accessed for this purpose. Consent can be withdrawn at any time. Processing takes place in Germany. We have concluded a data processing agreement.

5.6 Dealfront (Leadfeeder), identifying visiting companies

On our public website we use Leadfeeder provided by Dealfront Group GmbH, Germany, to identify which companies visit our website. The aim is to identify and approach potential business customers.

We use the cookieless variant only. No cookies are set and no information on your device is accessed, so Sec. 25 TDDDG does not apply. We process your IP address and details of the page visit. The IP address is matched against a database in order to determine the company behind it, and is then truncated or discarded. Identifying individual people is not a purpose of this processing.

The legal basis is Art. 6 (1) lit. f GDPR. Our legitimate interest lies in approaching business prospects and in assessing how effective our website is. You may object to this processing at any time under Art. 21 GDPR (section 3). Processing takes place in Germany and we have concluded a data processing agreement.

Further information: https://www.dealfront.com/privacy/

6. Contact and support

6.1 Contact form, email and support enquiries

When you write to us through the contact form or by email, we process your details in order to handle your request and in case of follow up questions. Our mailboxes run on Google Workspace (Google Ireland Limited, Ireland).

The legal basis is Art. 6 (1) lit. b GDPR where your enquiry relates to a contract or its preparation, otherwise Art. 6 (1) lit. f GDPR based on our legitimate interest in handling enquiries.

We delete this data once your request has been dealt with and no retention obligations apply, and at the latest three years after the end of the year in which the contact ended.

6.2 Telephone

For our business telephony we use easybell GmbH, Germany. Connection data such as phone numbers, time and duration is generated in the process. If you call us, we process your request as described in section 6.1. We do not record calls.

The legal basis is Art. 6 (1) lit. b or lit. f GDPR.

7. Registration, customer account and billing

Uptimeify is offered exclusively to business customers (Section 1.2 of our Terms).

7.1 Account data

On registration we process company name, address, legal form, name and contact details of the person acting, email address, credentials in encrypted form and the VAT identification number. The legal basis is Art. 6 (1) lit. b GDPR.

7.2 Verification of the VAT identification number

We verify the VAT identification number you provide through the European Commission's VIES system. The number is transmitted to the Commission's system and forwarded from there to the tax administration of the relevant member state. We store the result of the query with a timestamp as evidence.

The legal basis is Art. 6 (1) lit. c GDPR. The check is necessary so that we can invoice correctly for VAT purposes, in particular under the reverse charge procedure. For sole traders and freelancers the VAT identification number can be personal data; for corporations it generally is not.

7.3 Trial and prevention of abuse

After a trial account has expired and been deleted, we retain a minimal technical marker showing that a trial has already been used for your organisation. Its sole purpose is to prevent repeated use of the free trial (Section 3.4.4 of our Terms). It does not allow any conclusions about individual people or about the content of the deleted account.

The legal basis is Art. 6 (1) lit. f GDPR. Our legitimate interest lies in preventing abuse.

7.4 Payment processing

We process payments through Mollie B.V., Netherlands. Your payment data is processed by Mollie; we do not store complete card details. Invoicing and accounting data is processed using Lexware (Haufe-Lexware GmbH & Co. KG, Germany).

The legal basis is Art. 6 (1) lit. b GDPR for processing the payment and Art. 6 (1) lit. c GDPR for retention under tax and commercial law.

7.5 Notifications to you

Account, system and billing emails are sent through Lettermint B.V., Netherlands. The legal basis is Art. 6 (1) lit. b GDPR.

8. Security and logging within your account

We log security relevant events in your account, such as sign ins, changes to access and administrative actions. The purpose is to detect and investigate unauthorised access. The legal basis is Art. 6 (1) lit. f GDPR together with Art. 32 GDPR.

The connection to our website and to the application is encrypted with TLS throughout. Details of our technical and organisational measures are set out in Annex 1 of our data processing agreement.

9. Use of the monitoring application

9.1 Our customers' data

Whatever a customer brings into Uptimeify is processed solely on that customer's behalf and on their instructions: monitored addresses, check results, incident histories, notification recipients, configurations and the diagnostic data generated in the process. The controller is the customer concerned, not us.

The basis for this is our data processing agreement, which forms part of the contract for the use of Uptimeify. It also sets out which sub-processors are involved, where processing takes place and when data is deleted.

To deliver alerts we use Lettermint (email), seven.io and LOX24 (SMS and voice calls). If a customer connects optional services such as Slack, Microsoft Teams, PagerDuty or their own webhooks, we transmit alert data to the provider they have chosen; the customer is responsible for that.

9.2 If you are a user of one of our customers

If you use Uptimeify through an account set up by your service provider or your employer, that organisation is the controller for the data processed there. Please exercise your rights of access, rectification and erasure with them. If such a request reaches us directly, we forward it to the controller and do not answer it ourselves.

9.3 Public status pages

If you visit a status page operated with Uptimeify, the same principle applies to the content shown there: the operator of the status page is the controller. Server log data as described in section 5.2 is generated on our side for technical delivery.

10. Job applications

If you apply to us, we process your application documents, contact details and interview notes to the extent necessary to decide on an employment relationship. The legal bases are Sec. 26 (1) BDSG, Art. 6 (1) lit. b GDPR and, where you have consented, Art. 6 (1) lit. a GDPR.

If no appointment is made, we retain the documents for up to six months after the end of the process in order to defend against possible claims (Art. 6 (1) lit. f GDPR), and delete them afterwards. Inclusion in a talent pool takes place only with your express consent; data held there is deleted no later than two years after consent was given.

11. Retention periods

Where no specific period is stated above, we store data until the purpose no longer applies. We then delete it unless a statutory retention obligation applies.

12. Recipients and transfers to third countries

We pass on personal data only where this is necessary to perform a contract, where we are legally required to do so, where a legitimate interest exists or where you have consented. Where processors are used, a contract under Art. 28 GDPR is in place in each case.

The complete and continuously updated overview of the service providers we use, including role and location, is available at https://uptimeify.io/subprocessors.

All service providers that process monitoring data are established and process within the European Union or the EEA. We operate our databases exclusively at German locations.

Transfers to the USA take place only for individual services supporting general business operations and for the consent based analytics services described in section 5.4. We base these transfers on the EU-US Data Privacy Framework, on standard contractual clauses of the European Commission and on supplementary measures. Despite these safeguards, a level of protection fully comparable to that in the EU cannot be guaranteed in third countries; in particular, access by public authorities cannot be ruled out in every case.

13. Advertising emails

We hereby object to the use of the contact details published in our legal notice for sending advertising that has not been expressly requested. We reserve the right to take legal action.

14. Changes to this policy

We update this policy when the law, our services or our processing activities change. The current version is always available on this page. For your use of Uptimeify, the change procedure in Section 20 of our Terms applies in addition.

Version 1.0 · As of 3 August 2026