Data Processing Agreement

Last updated: 25-10-2026.

This Data Processing Agreement consists of three parts:

• Part 1. Agreement: the terms that surround the Standard Contractual Clauses
• Part 2. Standard Contractual Clauses: the clauses adopted by Commission Implementing Decision (EU) 2021/915, incorporated by reference
• Part 3. Annexes: Annex I (parties), Annex II (processing), Annex III (technical and organisational measures), Annex IV (sub-processors)

Part 1. Agreement

1.1 Scope

This Data Processing Agreement ("Agreement") forms part of the Mozello Terms of Service and is concluded between Mozello SIA ("processor") and the customer under whose account the Terms of Service have been accepted ("controller"). It is the contract required by Article 28(3) of Regulation (EU) 2016/679 for the personal data the processor processes on the controller's behalf in providing the Mozello service, as described in Annex II.

The standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/915 (the "Clauses") form part of this Agreement as set out in Part 2, together with Annexes I to IV in Part 3. The following options in the Clauses have been selected: in Clause 1(a), Option 1; Clause 5 (docking clause) is not used; in Clause 7.7(a), Option 2 with a period of 30 (thirty) days; in Clause 8(c)(4), Clause 9.1(b), Clause 9.1(c) and the final paragraph of Clause 9.2, Option 1, so that the references are to Regulation (EU) 2016/679.

In the event of a contradiction between this Part 1 and the Clauses, the Clauses prevail (Clause 4).

1.2 Conclusion

The Agreement is concluded by acceptance of the Terms of Service, electronically, and takes effect on the date of that acceptance as recorded by the processor, or on the effective date of this version of the Agreement, whichever is later.

1.3 Sensitive data

The service is not intended for the processing of special categories of personal data within the meaning of Article 9 of Regulation (EU) 2016/679, or of personal data relating to criminal convictions and offences. The controller undertakes not to use the service for the processing of such data, and acknowledges that the processor's technical and organisational measures are not designed for it.

1.4 Documented instructions

The controller's documented instructions under Clause 7.1 consist of the Clauses, the service agreement, and the settings and choices the controller makes in the service. Further instructions are given in writing through the channel identified in Annex I.

For the purposes of Clause 7.8(a), the controller instructs the processor to transfer personal data to the locations stated for each sub-processor in the list referred to in Annex IV, on the bases set out in that Annex.

1.5 Assistance through the functions of the service

The functions of the service by which the controller can itself locate, correct, export and delete personal data are the technical measures by which the processor assists the controller under Clause 8. Where those functions do not suffice, the controller requests assistance through the channel identified in Annex I.

1.6 Changes to the sub-processor list

The processor gives the information required under Clause 7.7(a) by publishing each intended addition or replacement of a sub-processor, with its effective date, on the page identified in Annex IV, which also offers it as an RSS feed. The controller agrees that this publication constitutes informing it in writing under Clause 7.7(a).

The controller may object to the intended change within the period stated in Clause 7.7(a), on reasonable grounds relating to the protection of personal data, by notifying the processor through the channel identified in Annex I. Where the objection has not been resolved by the end of that period, the controller may terminate the service agreement in respect of the service affected by the change, and that termination is the controller's remedy in respect of the objection.

1.7 Deletion at the end of the services

Unless the controller instructs otherwise through the channel identified in Annex I before the end of the provision of the services, the controller's choice under Clause 10(d) is deletion. The controller may export its data through the export functions of the service at any time before then.

1.8 Amendments to the Annexes and to this Agreement

The processor may amend the Annexes and this Part 1 to comply with applicable law or as its service develops, provided that amendments remain consistent with the Clauses and applicable data protection law. Technical and organisational measures may be updated or replaced, provided that they remain appropriate to the risks of the processing in accordance with Article 32 of Regulation (EU) 2016/679. The Clauses themselves are not amended.

Any expansion of the scope of processing must be covered by the controller's documented instructions and reflected in Annex II.

The processor publishes the current version of this Agreement, including its effective date, on its website. Amendments that materially reduce the controller's contractual protections or materially increase its obligations are notified by email or through the service at least 30 (thirty) days before taking effect. Other amendments may take effect upon publication.

Amendments necessary to comply with applicable law or address an urgent security risk may take effect earlier, but only to the extent necessary. The processor informs the controller of any materially adverse amendment as soon as reasonably practicable.

The controller may object to a materially adverse amendment through the channel identified in Annex I before its effective date or, where it takes effect earlier, within 30 (thirty) days after notification. If the objection cannot be resolved, the controller may terminate the affected service.

This section does not override the requirements for documented instructions or the notification and authorisation requirements for changes to sub-processors.

1.9 Liability

The limitation of liability in the service agreement applies to claims under the Clauses and this Agreement, except to the extent that applicable law does not permit liability to be limited.

Part 2. Standard Contractual Clauses

The standard contractual clauses between controllers and processors set out in the Annex to Commission Implementing Decision (EU) 2021/915 of 4 June 2021, as published in the Official Journal of the European Union (EUR-Lex), are incorporated into this Agreement by reference without modification, with the options stated in section 1.1 and with Annexes I to IV as set out in Part 3. The Clauses are available in all official languages of the European Union at that address.

Part 3. Annexes

ANNEX I - List of parties

Controller: the customer, being the natural or legal person identified in the Mozello account under which the Terms of Service have been accepted.

Name, address, and contact person's name, position and contact details: as recorded in that account.
Signature and accession date: acceptance of the Terms of Service incorporating this Agreement; the date of acceptance recorded by the processor applies.

Processor:

Name: Mozello SIA
Address: Mežsargu 33, Jūrmala, LV-2008, Latvia
Company registration number: 40203002519
Contact person's name, position and contact details: data protection contact, support
Signature and accession date: accepted electronically; the date of acceptance recorded by the processor applies.

ANNEX II - Description of the processing

Categories of data subjects whose personal data is processed

Visitors to the controller's website; persons who place orders or bookings in the controller's online shop; registered shop customers; recipients of newsletters sent by the controller; persons who submit contact, enquiry or booking forms on the controller's website; and any other individuals whose personal data the controller chooses to store in or transmit through the service.

Categories of personal data processed

Name; e-mail address; telephone number; delivery and billing address; contents and history of orders and bookings; messages and enquiries submitted through the website; shop customer account credentials; IP address; cookie and device identifiers; approximate location derived from the IP address; and identity attributes processed during optional age verification, including date of birth, authentication method and verification status.

Sensitive data processed (if applicable) and applied restrictions or safeguards

None authorised. The controller has undertaken in section 1.3 not to process such data in the service. Because the service provides free-text and configurable form fields, that undertaking is the applied restriction rather than a technical control.

Nature of the processing

Hosting, storage, transmission and display of the controller's website and online shop; creation and retention of backup copies and restoration from them; sending electronic mail on the controller's behalf; supporting the handling of orders and bookings; optional website proxy and security features; optional age verification; and optional artificial intelligence features. The optional features process personal data only when they are enabled or used.

Purpose(s) for which the personal data is processed on behalf of the controller

Providing the website and online shop service ordered by the controller, in accordance with the controller's instructions and the service agreement between the parties.

Duration of the processing

For the term of the service agreement between the parties.

After deletion of the controller's account or termination of the agreement, personal data is removed from production systems, including the disaster-recovery copy, without undue delay. Encrypted backup copies, kept to recover from data loss or security incidents, are not organised by controller and individual data cannot be removed from them; personal data in a backup copy is deleted when that copy expires, no later than 12 months after its creation. Until then backup copies are used only for recovery as described in Annex III.

For processing by (sub-)processors, also specify subject matter, nature and duration

As set out for each sub-processor in Annex IV, for the duration stated above.

ANNEX III - Technical and organisational measures

Measures of pseudonymisation and encryption of personal data

The production database is encrypted at rest using industry-standard encryption with managed keys. Backup copies of the database, including those held off-site, are encrypted.

Measures for the protection of data during transmission

The service uses TLS encryption to protect data in transit; customers using domains registered outside Mozello, and resellers using their own domains, are responsible for correctly configuring those domains to enable HTTPS. Transfers between the processor’s own systems and to off-site backup locations are encrypted.

Measures for the protection of data during storage

Data at rest is encrypted as described above, and access to storage is restricted to named service roles under least-privilege permissions.

Measures for ensuring ongoing confidentiality, integrity, availability and resilience of processing systems and services

Managed, patched infrastructure with network and firewall controls; continuous automated threat detection and monitoring at infrastructure level; redundant hosting; and a disaster-recovery copy of the production database maintained in a separate geographic location.

Measures for ensuring the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident

Backup copies are created regularly and held with more than one provider, including off-site. Restoration is performed regularly in ordinary operations, and full restoration has been tested.

Controller-requested recovery is performed in a separate, non-public environment, with only the required data transferred to the live service. Disaster recovery may involve restoration of production systems from backups. Recovery procedures include controls to prevent previously deleted personal data from being returned to active use.

Processes for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures in order to ensure the security of the processing

Backup restoration is exercised in ordinary operations, as described above. Relevant security advisories and threat detection findings are assessed, and remediation is prioritised according to severity, exposure and operational risk. Security incidents are reviewed and measures adjusted where needed.

Measures for user identification and authorisation

Multi-factor authentication is enforced on administrative access to the production infrastructure. Access rights follow least-privilege principles and are limited to personnel who require them.

Measures for ensuring physical security of locations at which personal data are processed

Production hosting and backup storage use infrastructure providers identified in Annex IV and are subject to those providers’ physical security controls.

Measures for ensuring events logging

Administrative and system events are logged, including infrastructure-level audit logging, and application events relevant to security and diagnostics are recorded.

Measures for ensuring system configuration, including default configuration

Infrastructure configuration is managed centrally; platform defaults are set so that new websites and shops are served over TLS and new stored objects are encrypted at rest.

Measures for internal IT and IT security governance and management

Security responsibility sits with the engineering team, and access is granted and removed according to role. Platform and dependency updates are applied as part of managed operations.

Measures for certification/assurance of processes and products

The infrastructure providers listed in Annex IV hold recognised information security certifications for their services and data centres, such as ISO/IEC 27001.

Measures for ensuring data minimisation

The service collects only the data required to operate a website and online shop. The controller determines which additional fields, if any, are collected from data subjects.

Measures for ensuring data quality

Data subjects' details originate from the data subjects themselves or from the controller, and the controller can correct them through available service functions or by requesting assistance.

Measures for ensuring limited data retention

As stated in Annex II. Conversations in the artificial intelligence features are deleted 30 days after their last activity, and deletion of the corresponding data held by the sub-processor is requested at the same time.

Measures for ensuring accountability

Processing is documented in these Annexes, and the sub-processor list is kept up to date in accordance with Clause 7.7(a).

Measures for allowing data portability and ensuring erasure

The controller can export its catalogue and order data in machine-readable form through the service's export functions. Erasure is carried out on the controller's request, with the effects and timing stated in Annex II.

Measures to be taken by the processor to be able to provide assistance to the controller

Personal data breaches are handled under an internal procedure, with notification to the controller as set out in Clause 9.2. Requests from data subjects received by the processor are passed to the controller, and on the controller's instruction the processor assists in locating, exporting, correcting or deleting the personal data concerned. For data protection impact assessments and consultations with a supervisory authority, the processor provides the information in Annexes II to IV and further information reasonably available to it.

ANNEX IV - List of sub-processors

The agreed list of sub-processors referred to in Clause 7.7(a) is maintained by the processor at www.mozello.com/sub-processors/ and that published list is the current list for the purposes of these Clauses. For each sub-processor the list states its name, the processing it carries out and the locations of processing.

Transfers outside the European Economic Area

Where the list states a location outside the European Economic Area, any transfer of personal data to that location, whether made by the processor or by the sub-processor to its affiliates or its own sub-processors, takes place in compliance with Chapter V of Regulation (EU) 2016/679 on one of the following bases:

1. an adequacy decision under Article 45 of Regulation (EU) 2016/679 covering the recipient, including, for a recipient in the United States certified under it, Commission Implementing Decision (EU) 2023/1795 (EU-U.S. Data Privacy Framework); or
2. where no such decision applies, the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914, in the module appropriate to the transfer, as incorporated in the data processing terms of the sub-processor concerned, together with any supplementary measures identified as necessary in the assessment of the transfer.

Where the basis relied on ceases to be available, the transfer continues only on the other basis or is ceased. On request, the processor informs the controller of the basis relied on for a particular sub-processor.