Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between you (the "Controller") and Mood nook sp. z o.o. (the "Processor"). It applies whenever the Processor processes personal data contained in Customer Content on behalf of the Controller.

• Process personal data only on documented instructions from the Controller, including the instructions embodied in the configuration of the Service, unless required otherwise by law.
• Ensure that personnel authorised to process personal data are bound by confidentiality.
• Implement the technical and organisational measures set out in Section 6 and on the Security page.
• Assist the Controller with data subject requests, data protection impact assessments and prior consultations, taking into account the nature of the processing.
• Notify the Controller without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Content.
• At the Controller's choice, delete or return personal data at the end of the provision of services, save where storage is required by law.
• Make available the information necessary to demonstrate compliance and allow audits once per year, or after a breach, on reasonable notice and under confidentiality; documented evidence and third-party reports may satisfy an audit request.

• Ensure a lawful basis exists for the processing instructed, and that required notices and consents are in place.
• Configure roles, permission sets, field-level security and API token scopes so that access matches the intended purpose.
• Avoid placing special category data in fields not designed for it, and avoid placing production personal data in demo or preview environments.

The Controller gives general authorisation for the Processor to engage the subprocessors listed on the Subprocessors page. The Processor imposes data protection obligations equivalent to this DPA on each subprocessor and remains fully liable for their performance. Changes are announced at least 30 days in advance; the Controller may object on reasonable data protection grounds and, if no alternative can be found, terminate the affected part of the Service without penalty.

• Encryption of data in transit (TLS 1.2+) and at rest.
• Tenant isolation enforced at the database level with row-level security and account-scoped queries, verified by automated cross-tenant regression tests.
• Role-based, attribute-based and relationship-based access control, with field-level projections and scoped API tokens.
• Secrets, passwords and API tokens stored only as salted hashes.
• Append-only audit logging of administrative and content mutations, with immutable version snapshots.
• Least-privilege access for personnel, multi-factor authentication and periodic access review.
• Backups with tested restore procedures, and separation of production, staging and development environments.
• Dependency and vulnerability scanning as part of the release process.

Where processing takes place outside the European Economic Area, the parties rely on an adequacy decision or incorporate the Standard Contractual Clauses (Commission Implementing Decision 2021/914), Module Two (controller to processor), with the docking clause enabled, this DPA supplying the required annexes.

Liability under this DPA is subject to the limitations in the Terms of Service, to the extent permitted by law. In case of conflict between this DPA and the Terms in matters of personal data protection, this DPA prevails.