Data Processing Agreement (DPA)

⚠️ DRAFT — NOT YET IN EFFECT

This document is a draft framework and has not been reviewed by legal counsel. It must be reviewed and approved by a qualified attorney before publication or enforcement. Do not publish or reference this document as binding terms until legal review is complete.

Last updated: [DATE TBD on legal review] Governing law: [JURISDICTION TBD]

This Data Processing Agreement (“DPA”) forms part of, and is incorporated into, the master service agreement (“Service Agreement”) between the parties identified below. It sets out the terms on which MoonFactory Creative Lab processes Personal Data on behalf of the Client in connection with the MoonFactory client portal and related services.

In the event of any conflict between this DPA and the Service Agreement, this DPA prevails to the extent of the conflict, but only with respect to the processing of Personal Data.

---

1. Parties

Controller (“Client”): The organization identified as the customer in the Service Agreement. Address, signatory, and contact details: as recorded on the executed Service Agreement.

Processor (“MoonFactory”): MoonFactory Creative Lab — a creative studio providing the MoonFactory client portal, hosted website services, content production, and related services. Contact: hello@moonfactory.dev.

The Client is the data controller and MoonFactory is the data processor with respect to Personal Data processed under the Service Agreement, except where this DPA expressly provides otherwise.

2. Definitions

For the purposes of this DPA:

• “Applicable Data Protection Law” means all data protection and privacy laws applicable to the processing of Personal Data under the Service Agreement, including (where applicable) the EU General Data Protection Regulation (Regulation (EU) 2016/679) (“GDPR”), the UK GDPR, the California Consumer Privacy Act as amended by the CPRA, and any successor or equivalent legislation.
• “Personal Data” means any information relating to an identified or identifiable natural person that is processed by MoonFactory on behalf of the Client under the Service Agreement.
• “Processing” (and “process”, “processed”) means any operation performed on Personal Data, whether or not by automated means, including collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure by transmission, dissemination, alignment, restriction, erasure, or destruction.
• “Data Subject” means the identified or identifiable natural person to whom Personal Data relates.
• “Sub-processor” means any third party engaged by MoonFactory that processes Personal Data on its behalf in the performance of the Service Agreement.
• “Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data.
• “Standard Contractual Clauses” means the standard contractual clauses approved by the European Commission for the transfer of Personal Data to processors established in third countries, as in force from time to time.

Capitalized terms used but not defined in this DPA have the meanings given in the Service Agreement or in Applicable Data Protection Law.

3. Scope and Purpose of Processing

MoonFactory will process Personal Data only:

• For the purpose of providing the services described in the Service Agreement, including hosting, content production, analytics, billing, support, and related services delivered through the MoonFactory client portal;
• In accordance with the Client’s documented instructions, which are deemed to be issued through the Service Agreement, this DPA, and the Client’s authorized use of the portal’s features and configuration options; and
• As required to comply with Applicable Data Protection Law or other legal obligations to which MoonFactory is subject, in which case MoonFactory will inform the Client of that legal requirement before processing, unless prohibited from doing so by law.

MoonFactory will promptly notify the Client if, in its opinion, an instruction infringes Applicable Data Protection Law.

4. Duration of Processing

This DPA takes effect on the effective date of the Service Agreement and remains in force for as long as MoonFactory processes Personal Data on behalf of the Client. The duration of any specific processing activity is coterminous with the underlying service for which it is performed, subject to the retention provisions of Section 13.

5. Nature of Processing

MoonFactory will perform the following types of processing on Personal Data on behalf of the Client:

• Collection of data submitted by the Client and the Client’s authorized users through the portal;
• Storage of that data in a secure hosting environment;
• Organization and structuring of data within the portal’s databases and file storage;
• Retrieval, consultation, and use to deliver requested services;
• Transmission to authorized recipients (the Client, the Client’s invited users, and approved sub-processors);
• Erasure or return of data on termination or upon valid Data Subject or Client request.

The processing is automated where it forms part of standard portal functionality, and may involve manual intervention where the Client requests support, content production, or other professional services.

6. Categories of Data Subjects

The Personal Data processed under this DPA may relate to the following categories of Data Subjects:

• The Client’s employees, contractors, and authorized users invited to access the portal on the Client’s behalf;
• The Client’s own customers, prospects, members, or end users whose data the Client uploads to or generates within the portal;
• Visitors to the Client’s website(s) where MoonFactory provides hosting, analytics, or related services on the Client’s behalf, in each case only to the extent that such visitors have provided the consent required by Applicable Data Protection Law for the relevant processing.

7. Types of Personal Data

The Personal Data processed under this DPA may include the following categories:

• Identification and contact data — names, email addresses, telephone numbers, organization affiliations, and job titles of authorized users and the Client’s contacts;
• Authentication data — credentials, session identifiers, multi-factor authentication factors, and security tokens used to access the portal;
• Website and analytics data — internet protocol (IP) addresses, browser and device characteristics, page-view records, referrer information, and other consent-gated visitor interaction data collected through analytics provided on the Client’s behalf;
• Content data — files, documents, images, written copy, briefs, and other materials uploaded to or generated within the portal;
• Communications data — support ticket subjects, message bodies, attachments, and the contents of emails exchanged between the Client and MoonFactory;
• Billing data — billing names, addresses, invoice records, and a transaction history of payments made by the Client (payment card details are processed by MoonFactory’s online billing partner and are not stored by MoonFactory itself);
• Audit data — records of significant actions taken within the portal (sign-ins, file uploads, configuration changes) retained for security, compliance, and forensic purposes.

MoonFactory does not knowingly process special categories of Personal Data on behalf of the Client. The Client agrees not to upload or otherwise transmit special-category Personal Data through the portal without first agreeing additional safeguards with MoonFactory in writing.

8. Obligations of the Processor

MoonFactory undertakes to:

• Process on instructions only. Process Personal Data only on the documented instructions of the Client, including with regard to transfers of Personal Data to a third country or international organization, unless required to do otherwise by law.
• Confidentiality of personnel. Ensure that persons authorized to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and limit access to those personnel who need it to perform their duties.
• Security measures. Implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including (without limitation) industry-standard encryption of data in transit and of sensitive data at rest, role-based access controls, multi-factor authentication for staff accounts, audit logging of significant actions, regular security reviews, and routine system patching. The specific measures in force will be made available to the Client on reasonable request.
• Sub-processor controls. Engage Sub-processors only in accordance with Section 9, and impose on each Sub-processor data-protection obligations substantially equivalent to those set out in this DPA.
• Assistance with Data Subject requests. Taking into account the nature of the processing, assist the Client by appropriate technical and organizational measures, insofar as this is possible, in fulfilling the Client’s obligation to respond to requests from Data Subjects to exercise their rights of access, rectification, erasure, restriction, portability, and objection.
• Assistance with controller obligations. Assist the Client in ensuring compliance with the Client’s obligations relating to security of processing, breach notification, data protection impact assessments, and prior consultation with supervisory authorities, taking into account the nature of the processing and the information available to MoonFactory.
• Deletion or return on termination. At the choice of the Client, delete or return all Personal Data to the Client at the end of the provision of services relating to processing, and delete existing copies, except where storage is required by law (including the retention of invoice and billing records described in Section 13).
• Information for compliance. Make available to the Client all information necessary to demonstrate compliance with this DPA and Applicable Data Protection Law.
• Audit cooperation. Allow for and contribute to audits, including inspections, conducted by the Client or another auditor mandated by the Client, on reasonable advance notice, no more than once per calendar year (save where required to address a specific compliance concern), at the Client’s cost, and subject to reasonable confidentiality and security restrictions to protect MoonFactory’s other clients and its own systems.

9. Sub-processors

The Client provides general written authorization for MoonFactory to engage Sub-processors to assist in the provision of the services. The current Sub-processors engaged by MoonFactory, and the purposes for which they are engaged, are:

MoonFactory will:

• Inform the Client of any intended addition or replacement of a Sub-processor with reasonable advance notice (not less than 30 days save in the case of urgent security or service-continuity changes), giving the Client an opportunity to object on reasonable data-protection grounds;
• If the Client objects on reasonable data-protection grounds and the parties cannot agree a resolution, allow the Client to terminate the affected portion of the services without penalty;
• Remain fully liable to the Client for the acts and omissions of its Sub-processors with respect to their processing of Personal Data, as if those acts and omissions were its own.

A current list of Sub-processors, by category and identifying detail sufficient to enable the Client to assess the engagement, will be made available to the Client on request.

10. International Transfers

MoonFactory primarily stores and processes Personal Data on hosting infrastructure located in Germany (in the Falkenstein region), within the European Economic Area.

Where the provision of services involves the transfer of Personal Data to a country outside the European Economic Area or the United Kingdom, MoonFactory will ensure that an appropriate transfer mechanism recognized under Applicable Data Protection Law is in place, including (as relevant) the Standard Contractual Clauses, an adequacy decision, or any successor mechanism designated by the European Commission, the UK Information Commissioner’s Office, or another competent authority.

Where the Standard Contractual Clauses apply, the parties are deemed to have entered into the relevant module of those clauses with MoonFactory acting as data importer (as processor) and the Client acting as data exporter (as controller), and the descriptions in Sections 3 to 7 of this DPA are deemed to populate the corresponding annexes.

11. Personal Data Breach Notification

MoonFactory will notify the Client without undue delay, and in any event within 72 hours of becoming aware of a Personal Data Breach affecting Personal Data processed on behalf of the Client. The notification will, to the extent then known and as it becomes known:

• Describe the nature of the Personal Data Breach, including the categories and approximate number of Data Subjects and Personal Data records concerned;
• Communicate the name and contact details of the MoonFactory point of contact for further information;
• Describe the likely consequences of the Personal Data Breach;
• Describe the measures taken or proposed to address the Personal Data Breach, including, where appropriate, measures to mitigate its possible adverse effects.

Where the information cannot be provided in full at the same time, it may be provided in phases without undue further delay.

MoonFactory will also document any Personal Data Breach, comprising the facts relating to the breach, its effects, and the remedial action taken, and make that documentation available to the Client on request.

12. Liability and Indemnification

The liability of each party under or in connection with this DPA is governed by, and subject to, the limitations and exclusions of liability set out in the Service Agreement. Nothing in this DPA limits or excludes any liability that cannot lawfully be limited or excluded under Applicable Data Protection Law, including liability for breaches of the GDPR for which a processor is directly liable to a Data Subject or to a supervisory authority.

Each party will indemnify the other against losses, damages, fines, and reasonable expenses (including reasonable legal fees) suffered by the indemnified party arising out of the indemnifying party’s breach of its obligations under this DPA, subject always to the liability cap and exclusions in the Service Agreement.

13. Term and Termination

This DPA continues in force for as long as MoonFactory processes Personal Data on behalf of the Client under the Service Agreement.

On termination or expiry of the Service Agreement, MoonFactory will, at the Client’s choice and on reasonable written instruction:

• Return all Personal Data to the Client in a commonly used, machine-readable format; or
• Delete all Personal Data from its active systems.

In either case, MoonFactory will:

• Retain Personal Data in active systems for a transition window of up to 30 days following termination, to allow the Client to retrieve, migrate, or confirm deletion of its data;
• Retain invoice and billing records, and any other records required to be retained under applicable law, for the period required by such law (currently up to 7 years for invoices and billing records under typical accounting and tax obligations);
• Honour valid Data Subject erasure requests received during the retention period in accordance with Applicable Data Protection Law and the Client’s documented instructions;
• Permit Personal Data to persist briefly in encrypted backups in accordance with normal backup-rotation cycles, after which it is overwritten in the ordinary course.

On final completion of the deletion or return process, MoonFactory will provide written confirmation to the Client on request.

---

⚠️ DRAFT — NOT YET IN EFFECT

This document is a draft framework and has not been reviewed by legal counsel. It must be reviewed and approved by a qualified attorney before publication or enforcement. Do not publish or reference this document as binding terms until legal review is complete.