Service Level Description

Effective: August 2026 · Last reviewed: August 2026

This page describes the operational expectations for the suPlay Poll service operated by suPlay B.V., Ruwerstraat 9, 7545 SM Enschede, The Netherlands. It supplements our Terms of Service.

This is a transparency statement, not a contractually binding Service Level Agreement. It describes what we aim for and how we operate the service; it does not create availability guarantees, service credits, or financial remedies. Customers who require a binding SLA with committed uptime, named support contacts and priority response can request one — email info@suplay.nl. A signed SLA, once agreed, overrides this page for that customer.

Rights that customers have under mandatory law — including EU consumer-protection law and the GDPR — are unaffected by this page and are not limited by anything stated here.

1. Service Definition

“Service” means the suPlay Poll web application available at poll.suplay.nl, including its presenter admin, participant join flow, live-feed, presenter embeds, and REST/Socket.io APIs. The expectations described here do not extend to:

Failures of the customer’s own networks, browsers, devices, firewalls, VPN/proxy, or access credentials.
Failures attributable to a third-party subprocessor listed on our Subprocessors page, or to any other third party outside suPlay B.V.’s reasonable control.
Distributed denial-of-service attacks, volumetric attacks, and any mitigation traffic-shaping applied in response.
DNS propagation, routing-protocol (BGP), certificate-authority, or public-internet transit issues not originating from our infrastructure.
Force-majeure events, including but not limited to natural disasters, labour disputes, governmental or regulatory actions, war, terrorism, and pandemics.
Beta features, experimental endpoints, or features explicitly flagged as “preview” or “best-effort”.
Abuse of rate limits or any breach of the Acceptable Use policy.
Maintenance performed under §3.

2. Availability Target

We aim for 99.5 % monthly availability, excluding maintenance. This is a target we design and operate towards, not a guarantee.

suPlay Poll runs on a single Netherlands-based VPS. 99.5 % is the honest ceiling for that topology; we do not advertise four or five nines. Customers requiring committed availability can request a commercial upgrade to a hot-standby or multi-region setup — email info@suplay.nl.

A public uptime history is available at stats.uptimerobot.com/kBORLEuUct as a transparency reference.

3. Maintenance

We may perform maintenance on any day between 02:00 and 04:00 CET. Maintenance within this window requires no separate advance notice — this published window is the notice.
In practice we group planned work into Sunday nights and use the weekday window primarily for security patching, so that critical updates do not have to wait for the weekend.
We may also perform maintenance outside this window where required for security or stability, with best-effort notice where practicable.
We aim to avoid disruptive maintenance during European academic teaching hours (weekdays 08:00–18:00 CET) where reasonably possible.
Maintenance periods are excluded from the availability target in §2.

4. Support

Support is available by email to info@suplay.nl. We aim to respond on a best-effort basis within one Dutch business day, and to acknowledge reports that the platform is unreachable more quickly than that during Dutch business hours (Mon–Fri, 09:00–18:00 CET).

Instructors running a scheduled session can email us in advance with the event code and start time — we will be on stand-by where we can. Committed response times are available under a signed SLA.

5. Backups, Recovery, Data Portability

Backup frequency: a full PostgreSQL dump is taken nightly at 02:00 CET. Backups are encrypted at rest and stored off-site in an EU region (Scaleway, Amsterdam).
Retention: 30 rolling daily backups, 12 rolling monthly backups.
Recovery targets: we aim to lose no more than 24 hours of data (RPO) and to restore service within 8 hours of a confirmed disaster (RTO). These are operational targets, not guarantees.
Restore verification: we periodically verify that off-site backups can be decrypted and restored.
Data export: customers may export their own data at any time via GET /api/account/export or by emailing privacy@suplay.nl.

6. Security

See our Security Summary for the full list of technical and organisational measures. In summary:

TLS 1.2 or higher for all external traffic; HSTS enforced.
bcrypt password hashing and SHA-256 token hashing at rest.
Rate limiting on all authentication and rate-sensitive endpoints.
Application runs as an unprivileged system user, not root.
Dependencies are monitored for known vulnerabilities and updated regularly.
Admin access is audit-logged; optional two-factor authentication available on every account.

7. Breach Notification

If we become aware of a personal-data breach affecting customer data, we will notify the customer’s primary contact in writing without undue delay and in any event within 72 hours of confirmation, in accordance with Art. 33 GDPR. The notice will include the nature of the breach, data categories affected, likely consequences, and remediation steps.

8. Subprocessor Changes

We will inform customers with a signed Data Processing Agreement in advance of adding or replacing a subprocessor, and give them a reasonable opportunity to object. If an objection cannot be resolved, either party may terminate the affected subscription pro-rata.

9. Termination and Data Return

On termination, the customer may export their data via the self-service endpoint or an email request for 30 days.
After that window, customer data is permanently deleted within a reasonable period — normally 90 days — including from backups on their next rotation.

10. Customer Cooperation

To help us investigate and resolve incidents quickly, we ask customers to keep a current contact on file, provide reasonable cooperation in diagnosing and reproducing issues (browser console output, HAR captures, affected user IDs where lawful), and apply recommended mitigations such as browser upgrades and credential rotations within a reasonable period once notified.

11. Changes to this page

suPlay B.V. may update this Service Level Description from time to time; changes take effect on publication. Customers operating under a signed SLA are governed by that agreement’s own change process.

12. Contact

Operational, support, or legal questions: info@suplay.nl
Privacy / data-subject requests: privacy@suplay.nl