Data Processing Agreement (DPA)

This Data Processing Agreement (“DPA”) is entered into between the commercial customer using the Molvek Bot service (“Controller” or “Customer”) and Molvek OÜ (registry number: 17618773, registered address: Sepapaja tn 6, 15551 Tallinn, Harju Maakond, Estonia, email: info@molvek.com — “Processor” or “Molvek”) as an integral addendum to the Terms of Service.

1. Subject Matter, Duration, Nature and Purpose (GDPR Article 28(3))

• Subject Matter and Duration: This DPA governs Molvek’s processing of personal data on behalf of the Customer in connection with the Molvek Bot service. Processing continues for the duration of the Customer’s trial or subscription and until completion of the deletion and retention obligations set out in Section 9 below.
• Nature and Purpose of Processing: Receiving and storing end-user messages across messaging and calendar channels connected by the Customer, generating AI-assisted replies, suggestions and summaries based on the Customer’s knowledge base and instructions, executing appointment and human-handoff workflows, and making conversation records available to the Customer’s operators in the admin console.
• Categories of Data and Data Subjects: Detailed in Annex 1 below.

2. Documented Instructions of the Controller (GDPR Article 28(3)(a))

Molvek processes personal data solely on documented instructions from the Customer as set out in the Terms of Service, this DPA and the Customer’s configuration in the admin console, unless required to do so by European Union or Estonian law to which Molvek is subject. In such a case, Molvek shall inform the Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

3. Confidentiality (GDPR Article 28(3)(b))

Molvek ensures that personnel and contractors authorized to process personal data have access strictly on a need-to-know basis and have committed themselves to contractual confidentiality obligations.

4. Subprocessors (GDPR Articles 28(2) and 28(4))

• General Authorization and Subprocessor List: The Customer grants Molvek general written authorization to engage subprocessors to provide the service. The current list of authorized subprocessors is published on a separate versioned page at Subprocessor List and forms an integral part of this DPA.
• Subprocessor Changes and Right to Object: Before adding a new subprocessor or replacing an existing subprocessor, Molvek shall provide written notice to the Customer’s registered contact address at least 30 days in advance. Within this 30-day period, the Customer may object in writing on data protection grounds. If the objection cannot be resolved, the Customer may terminate the affected service without penalty.
• Subprocessor Obligations: Where Molvek engages a subprocessor, Molvek enters into a written contract imposing data protection obligations equivalent to those set out in this DPA in accordance with GDPR Article 28(4), and remains fully liable to the Customer for the performance of the subprocessor’s obligations.

5. Security Measures (GDPR Article 28(3)(c) and Article 32)

Molvek implements the following technical and organizational measures to ensure a level of security appropriate to the risk:

1. Encryption in Transit and at Rest: All client and API traffic is encrypted in transit via HTTPS/TLS. Third-party channel connection credentials and access tokens stored on behalf of the Customer are encrypted at rest.
2. Authentication Security: Operator passwords are never stored in plaintext and are stored solely as one-way cryptographic password hashes. Verification, password-reset and session tokens are stored server-side solely as cryptographic digests rather than plaintext tokens.
3. Logical Tenant Isolation and Least Privilege: Each business account’s data (contacts, conversations, messages, knowledge-base entries and search vectors) is logically isolated by business account identifier. Application, background-processing and database access follow least-privilege separation.
4. Abuse and Automated-Attack Protection: Public registration, email verification and password-reset endpoints are protected by Cloudflare Turnstile verification and rate limits keyed by a one-way abuse-prevention key derived from the client IP address.
5. Administrative Access Controls: Administrative access to production infrastructure is restricted by multi-factor authentication (MFA) and access controls.

6. International Data Transfers (GDPR Chapter V)

• EU Hosting Location: Molvek’s application and database infrastructure is hosted in EU (Netherlands / Germany) data centers.
• Safeguards for Transfers Outside the EEA: To the extent personal data is transferred outside the European Economic Area (EEA) for AI inference/embedding or network security and verification services, such transfers are governed by the European Commission’s Standard Contractual Clauses (SCCs — Commission Implementing Decision (EU) 2021/914) or applicable adequacy decisions and supplementary technical measures.

7. Data Subject Requests, Breach Notification and Assistance (GDPR Article 28(3)(e)–(f))

• Data Subject Rights: Taking into account the nature of the processing, Molvek assists the Customer by appropriate technical and organizational measures, insofar as possible, in fulfilling the Customer’s obligation to respond to requests for exercising data subject rights under GDPR Chapter III (access, rectification, erasure, restriction, portability and objection).
• Personal Data Breach Notification: Upon becoming aware of a personal data breach affecting personal data processed on behalf of the Customer, Molvek shall notify the Customer in writing at the registered contact address without undue delay and no later than within 48 hours, and shall provide reasonable cooperation to assist the Customer in meeting its obligations under GDPR Articles 33 and 34.
• Impact Assessments and Prior Consultation: Molvek assists the Customer in ensuring compliance with GDPR Articles 35 (data protection impact assessment) and 36 (prior consultation with a supervisory authority), taking into account the nature of processing and the information available to Molvek.

8. Audits and Demonstration of Compliance (GDPR Article 28(3)(h))

Molvek makes available to the Customer upon reasonable written request all information necessary to demonstrate compliance with the obligations laid down in this DPA. Subject to protection of security and the confidentiality of other customers’ data and conduct during normal business hours, the Customer may conduct an audit at most once per year by giving at least 30 days’ prior written notice. An audit requested by a competent authority or conducted following a personal data breach is exempt from this limit.

9. Deletion or Return of Data and Statutory Retention Exceptions (GDPR Article 28(3)(g))

1. Account Closure and Deletion: Upon termination of the service or upon the Customer’s written deletion request, Molvek shall, at the choice of the Customer, delete or return all personal data processed on behalf of the Customer (contacts, conversations, messages, knowledge-base texts, search vectors, channel credentials and operator authentication records) and delete existing copies unless EU or Estonian law requires storage of the data.
2. Operational Email Delivery Metadata: Operational email delivery and failure records for registration and account verification are retained for a limited period solely for security and abuse prevention and are automatically purged thereafter.
3. 3-Year Retention of Agreement Acceptance Records: When a business account is deleted, agreement acceptance records evidencing acceptance of legal documents are retained without name and without email address (limited to document kind, version, cryptographic digest and acceptance timestamp) for 3 years under Estonian General Part of the Civil Code Act (TsÜS) § 146 lg 1, and are permanently deleted at the end of that period.
4. Accounting Records: Invoicing and accounting records are retained for 7 years under the Estonian Accounting Act (Raamatupidamise seadus) § 12.

---

Annex 1 — Details of Personal Data Processing