Data Processing Agreement under Article 28 GDPR

1 — Parties

The "Controller" is the individual natural person or legal entity that has opened a Workspace with HuntingtonMod and whose data is processed under the Terms of Service. The "Processor" is HuntingtonMod GmbH, HRB 285 741 (Amtsgericht München), Maximilianstraße 34, 80539 München, Germany. This DPA supplements — it does not replace — the Terms of Service and the Privacy Policy. HuntingtonMod is not affiliated with, endorsed by or connected to Huntington Bancshares Incorporated, Huntington National Bank, or Huntington Investment Company.

2 — Subject matter and duration

The subject matter of the processing is the hosting, backup, transmission and display of the Controller's Workspace content — journal entries, expense rows, habit checkmarks, mood dots, receipt images, subscription rows, reading log rows, gratitude cards and weekly-review PDFs — for the sole purpose of providing the App to the Controller. The duration of the processing is the duration of the Subscription plus the sixty-day grace period plus the sixty-day archive period.

3 — Nature and purpose

The nature of the processing is: storing, indexing, encrypting, backing up, replicating, transmitting and deleting personal data on the instruction of the Controller. The purpose of the processing is exclusively the provision of the Apps under the Terms of Service. No other purpose is pursued.

4 — Types of personal data

The following categories of personal data are processed: identity data (name, country of residence, e-mail), billing data (SEPA payer name, IBAN, BIC), free-text Workspace content (any text the Subscriber writes into the Apps), attached files (receipt images, weekly-review PDFs, gratitude cards), technical metadata (timestamp of Magic-Link issuance, source e-mail domain).

5 — Categories of data subjects

The data subjects are (a) the Subscriber themselves, and (b) any third party the Subscriber freely mentions inside their Workspace content — for example, the name of a friend to whom they wrote a gratitude card, or the name of a merchant on a scanned receipt. The Processor does not analyse, index for third-party lookup or otherwise use content mentioning third parties beyond storage and retrieval.

6 — Obligations of the Processor — instructions

The Processor processes personal data only on documented instructions from the Controller, including with regard to transfers of personal data to a third country. The Terms of Service, the Privacy Policy and this DPA together constitute the complete set of general instructions. The Controller may provide additional specific instructions by writing to dpo@huntingtonmod.org; if such an instruction violates GDPR, the Processor informs the Controller immediately.

7 — Confidentiality

The Processor ensures that any person authorised to process personal data has committed themselves to confidentiality in writing or is under an appropriate statutory obligation of confidentiality. Only three people at the Processor have privileged access to production infrastructure at any time: the managing director, the head of engineering and the on-duty incident-response engineer.

8 — Security of processing — Article 32 GDPR

Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, the Processor implements the technical and organisational measures set out in the Security Whitepaper, including in particular: AES-256 encryption at rest for all Workspace buckets; TLS 1.3 for all traffic; Magic-Link authentication with Ed25519 signatures and a thirty-minute time-to-live; two-person integrity control on any privileged database action; annual external penetration test.

9 — Sub-processors

The Controller gives general authorisation for the engagement of the following sub-processors, which are all EU-established. The Processor informs the Controller of any intended change concerning the addition or replacement of sub-processors by e-mail at least fifteen (15) days in advance, giving the Controller an opportunity to object. If the Controller objects on reasonable grounds, they may terminate the Subscription with immediate effect and receive a pro-rata refund of the current month.

10 — International transfers and Transfer Impact Assessment (TIA)

The Processor does not transfer personal data outside the European Union. All sub-processors listed above are EU-established, and where a sub-processor operates a global network, the tenant used by the Processor is contractually pinned to EU data centres. A Transfer Impact Assessment is on file for the two nominally global suppliers (Postmark and Fastmail): both operate a distinct EU shard with EU-only routing, keys held in Dublin and Amsterdam respectively, and neither is subject to US Section 702 FISA orders for EU-tenant data.

11 — Assistance to the Controller

The Processor assists the Controller in ensuring compliance with Articles 32 to 36 GDPR — security of processing, notification of a personal-data breach to the supervisory authority, communication of a personal-data breach to the data subject, and data-protection impact assessments. Assistance requests are answered within five (5) working days from dpo@huntingtonmod.org.

12 — Data subject rights

Taking into account the nature of the processing, the Processor assists the Controller by appropriate technical and organisational measures — including a Workspace-wide "Export everything" button and a Workspace-wide "Erase everything" button — in fulfilling the Controller's obligation to respond to requests for exercising the data subject's rights under Chapter III GDPR.

13 — Breach notification

The Processor notifies the Controller without undue delay after becoming aware of a personal-data breach affecting the Controller's Workspace, and in any event within twenty-four (24) hours. The notification describes the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed.

14 — Return or deletion of data at end of processing

On termination of the Subscription and expiry of the grace period plus the archive period, the Processor deletes all Workspace content and overwrites the storage bucket with zeros. Before deletion, the Controller may export the entire Workspace by clicking "Export everything" or by writing to support@huntingtonmod.org.

15 — Audits

The Processor makes available to the Controller all information necessary to demonstrate compliance with Article 28 GDPR obligations, and allows for and contributes to audits conducted by the Controller or another auditor mandated by the Controller. In practice, the Controller may (i) receive the annual independent SOC-2-style report on written request, and (ii) conduct an on-site audit at the Munich office once per year on thirty (30) days' notice, at their own cost, restricted to the areas relevant to the processing.

16 — Technical and organisational measures (Annex II)

The TOMs include: physical access control at all data centres (biometric + card, mantrap); logical access control with individual accounts and multi-factor authentication; role-based authorisation with least privilege; encryption at rest AES-256 for all buckets; encryption in transit TLS 1.3; pseudonymisation of analytics counters; separation of production and staging environments in distinct AWS accounts; regular full backup with thirty-day retention and monthly restore drill; documented incident-response playbook rehearsed twice per year; annual penetration test by an independent auditor.

17 — Duration, liability, jurisdiction

This DPA is in force for the duration of the Subscription. The Processor's liability under this DPA is capped in line with the Terms of Service. This DPA is governed by German law; the place of jurisdiction for merchants is Munich; consumer rights of habitual residence remain unaffected. HuntingtonMod is not affiliated with, endorsed by or connected to Huntington Bancshares Incorporated, Huntington National Bank, or Huntington Investment Company.

18 — Signatures

By ticking the acceptance box at checkout, the Controller accepts this DPA in the version dated at the top of this page. The Processor's signature is provided by the managing director Andrea Weiss and is on file at the Munich office. On written request, a countersigned PDF copy can be issued within five (5) working days.