Unexecuted draft for GDPR Article 28 review — Last updated: July 2026
Processing of customer data for the provision of MOJAQ services. Duration: term of the service agreement.
Hosting and processing of analytics data, document rendering, uptime monitoring data, and error tracking events.
End users of customer websites/applications, customer employees.
IP addresses, user agents, page URLs, error stack traces, email addresses (for error notifications).
| Name | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Infrastructure hosting and core service storage | Germany / Finland (EU) |
| Cloudflare, Inc. | TLS termination, CDN, DDoS and bot protection | Global edge / US entity; safeguards to be completed in executed DPA |
| Resend | Transactional and account email delivery | US entity; safeguards to be completed in executed DPA |
| Stripe, Inc. | Payment processing when paid billing is enabled | US entity; safeguards to be completed in executed DPA |
| Customer-selected AI provider | Optional inference through the AI gateway | Selected and instructed by Controller |
Controller may request access, rectification, or deletion of personal data. Processor will assist within 10 business days.
Processor will notify Controller within 48 hours of becoming aware of a personal data breach.
Following a confirmed deletion request, Processor will remove active service data through its cross-service deletion process unless retention is required by law. Encrypted off-site backup copies are not edited in place: copies older than 30 days are scheduled for pruning after a successful backup upload, and a failed or missed maintenance run can delay pruning. An executed DPA must state the agreed deletion timetable; this working template does not promise a hard 30-day expiry.