Subject, nature and purpose
We filter DNS queries from the customer’s networks and devices: we receive the queries, check them against block lists and the customer’s rules, and answer or block them. We also prepare reports, keep a query log if the customer turns it on, and provide support.
Duration
This agreement runs for as long as we provide Seawall to the customer, and ends when the data has been deleted or returned.
Types of data and data subjects
Data
- IP addresses of networks and devices
- Device identifiers, such as the Seawall address of each device
- DNS queries with the time and the result
- Query log entries, if the customer turns the log on, kept for 7 to 90 days
- Names and emails of the customer’s administrators
- Support messages
Data subjects
- The customer’s staff
- Guests and other people using the customer’s networks and devices
- The customer’s administrators
Our obligations
We commit to
- Process the data only on the customer’s documented instructions, including about transfers outside the EU. These terms and the settings in the account are instructions; we tell the customer if we think an instruction breaks the law
- Bind everyone who processes the data for us to confidentiality
- Take the security measures required by Article 32 GDPR (Annex 1)
- Use only the subprocessors in Annex 2, tell the customer about new ones at least 30 days in advance and let the customer object
- Help the customer answer requests from people who exercise their rights
- Help with security, breach notifications, impact assessments and consultations with authorities, and report a personal data breach without undue delay, at the latest within 48 hours
- Delete the data within 30 days after the service ends, or return it if the customer asks, unless the law requires us to keep it
- Give the customer the information needed to show compliance and allow audits, with reasonable notice and at most once a year
The customer’s obligations
The customer makes sure it may have this data processed, tells its staff and guests about the filtering, and decides whether to keep a query log and for how long.
Transfers outside the EU
Customer data is stored in the EU, in Germany. We transfer personal data outside the EU or the European Economic Area only with the safeguards required by Chapter V GDPR, such as an adequacy decision or the EU Standard Contractual Clauses.
Liability and order of documents
Liability follows the main agreement. For data protection matters, this agreement takes precedence over the Terms of service.
Annex 1: security measures
Technical and organisational measures
- Encryption in transit: DNS over HTTPS, DNS over TLS and DNS over QUIC; HTTPS for the account and the website
- Data minimisation: the query log is off by default; IP addresses are not stored with queries
- Access control: only staff who need it, with two-factor authentication
- Storage in the EU, in Germany, in data centres of hosting provider
- Backups, logging of administrative access and an incident response plan
Annex 2: subprocessors
| Subprocessor | What it does | Where |
|---|---|---|
| Hosting provider | Servers and storage for accounts, statistics and query logs | EU, Germany |
| DNS server provider | DNS filtering servers | Server locations |
| Email provider | Account and report emails | Location |
| AI provider | Seawall assistant, if administrators use it | Location |
Last updated: date