GDPR & compliance
WatchTower15 Incorporated processes personal data in accordance with the UK GDPR and the EU General Data Protection Regulation. We act as a data processor for the monitoring data your servers and domains generate, and as a data controller for account and contact information. Personal data of EU and UK data subjects is not transferred outside the EEA or the UK without an appropriate transfer mechanism in place, and we operate a data-residency-by-default model so your monitoring data stays in the region your account is provisioned in.
For monitored databases, the monitoring data is the database server’s metrics and configuration: its health, workload counters, storage sizes and row estimates, version, a set of its variables and the grants of the monitoring user. It also includes database identifiers, schema structure and normalised SQL statements. Identifiers are your schema and table names: they reach WatchTower15 in clear only when you choose the Clear names privacy mode, and in the default Hashed mode only as a keyed hash whose key stays with you. No table content, password or key is collected. Database account names come from two places: with the optional account grant, the database advisor reads the server’s account names and their authentication settings (authentication plugin, TLS requirement, password expiry and lock state), and a database’s slow-query log names the account that ran each slow statement. Account names reach WatchTower15 in clear only with Clear names, as keyed hashes otherwise, and password hashes are never read. Statement statistics for a monitored database (numbers keyed by hashes, never statement text) expire after 30 days and are not deleted earlier. Statement text, kept only when you choose Clear names, is deleted with the database or when you switch it to another privacy mode. Database log events, read from a monitored database’s slow-query and error logs, carry keys, numbers and error codes, never a value from a statement or a message; with Clear names the statement’s normalised text, the error message with its values removed and the account name are kept too. Database log events expire from the live store 30 days after they are recorded, and from its daily backups within a further 30 days.
In the event of a personal data breach we will notify affected customers without undue delay — and, where feasible, within 72 hours of becoming aware — so you can meet your own regulatory timelines. This page is a summary for quick reference; the authoritative statement, including your rights as a data subject and how to exercise them, lives on the WatchTower15 website.