Data Processing Agreement

Auftragsverarbeitungsvertrag (AVV) per GDPR Article 28 — Last updated: March 2026

1. Subject and Duration

Processing of customer data for the provision of MOJAQ services. Duration: term of the service agreement.

2. Nature and Purpose

Hosting and processing of analytics data, document rendering, uptime monitoring data, and error tracking events.

3. Categories of Data Subjects

End users of customer websites/applications, customer employees.

4. Types of Personal Data

IP addresses, user agents, page URLs, error stack traces, email addresses (for error notifications).

5. Sub-processors

6. Technical and Organizational Measures (TOMs)

• Encryption at rest and in transit (TLS 1.2+)
• Access controls and audit logging
• Regular backups
• Tenant isolation via org_id scoping

7. Data Subject Rights

Controller may request access, rectification, or deletion of personal data. Processor will assist within 10 business days.

8. Data Breach Notification

Processor will notify Controller within 48 hours of becoming aware of a personal data breach.

9. Deletion

Upon termination, Processor will delete all personal data within 30 days unless retention is required by law.