Data processing agreement

This data processing agreement ("DPA") is part of the MISE terms of service between:

• the customer that accepted the terms, as controller ("you"); and
• ZESTOLOGY BV, trading as MODUS, enterprise number BE 1013.413.339, Veeartsenstraat 45, bus 116, 1070 Anderlecht (Brussels), Belgium, as processor ("we").

It applies to all personal data we process for you when we provide MISE. It follows article 28(3) GDPR and the structure of the European Commission's standard contractual clauses for controllers and processors (Decision (EU) 2021/915). If this DPA and the terms disagree on data protection, this DPA wins.

1. Subject and duration

1. We process personal data only to provide MISE to you as described in the terms and in Annex 1.
2. This DPA runs as long as we process personal data for you, including the export and deletion period after the end of the agreement.

2. Your instructions

1. We process personal data only on your documented instructions. The terms, this DPA, your settings in MISE and the actions you take in it (for example approving and publishing a post, or connecting an account) are your instructions.
2. If we think an instruction breaks data protection law, we tell you without delay and may pause that instruction until you confirm or change it.
3. If EU or Belgian law requires us to process data in another way, we tell you first unless that law forbids it.

3. Your responsibilities

1. You are responsible for having a legal basis for the personal data you put into MISE, and for informing the people concerned. This includes people in photos and videos, people named in texts, your reviewers and the people whose public posts you ask us to research.
2. You do not put special categories of personal data (article 9 GDPR) or data about criminal convictions into MISE, unless we agreed this in writing.
3. You do not upload personal data of children for marketing use without the consent required by law.

4. Confidentiality

Everyone at our side who can access personal data is bound by confidentiality, by contract or by law, and only gets the access needed for their work.

5. Security

1. We take the technical and organisational measures in Annex 2 to protect personal data, taking into account the state of the art, the cost, and the nature and risks of the processing.
2. We may update these measures, as long as the overall level of protection does not go down.

6. Sub-processors

1. You give us general written authorisation to use sub-processors. The current list is in Annex 3 and in the app for logged-in customers. The list is confidential information under section 16 of the terms: you may share it with your advisers, auditors and authorities, but not publish it.
2. We tell you at least 30 days before we add or replace a sub-processor that will process your personal data, by email and in the app.
3. You may object on reasonable data protection grounds within those 30 days. We then try to find a solution together. If we cannot, you may end the affected part of the agreement before the change takes effect and we refund any prepaid amount for the period after the end.
4. In an emergency, for example when a provider stops without notice, we may replace a sub-processor faster and tell you as soon as possible. Your right to object still applies.
5. We impose the same data protection obligations as in this DPA on each sub-processor by written contract. We remain responsible to you for our sub-processors.

7. Transfers outside the EEA

1. We only transfer personal data outside the European Economic Area if one of the safeguards of Chapter V GDPR applies, such as an adequacy decision (for example for the United Kingdom, or for US providers certified under the EU-US Data Privacy Framework) or standard contractual clauses (Decision (EU) 2021/914, module 3 between us and the sub-processor), with extra measures where a transfer impact assessment shows they are needed.
2. You authorise the transfers listed in Annex 3.

8. Help with the rights of individuals

1. MISE lets you find, correct, export and delete content yourself.
2. If we receive a request from a person about your data, we pass it to you without delay and do not answer it ourselves unless you ask us to.
3. We help you with reasonable measures to answer requests under articles 15 to 22 GDPR, as far as you cannot do it yourself in MISE.

9. Help with security, impact assessments and authorities

We help you, taking into account the nature of the processing and the information we have, to comply with articles 32 to 36 GDPR, including data protection impact assessments and prior consultation with the authority. Help beyond normal use of MISE and the information in this DPA may be charged at our usual rate, agreed in advance.

10. Personal data breaches

1. If we become aware of a personal data breach affecting your data, we tell you without undue delay and in any case within 72 hours after we became aware of it.
2. We give you the information you need, as far as we have it: what happened, the categories and approximate number of people and records concerned, the likely consequences, and what we did or propose to limit the harm. If we do not have all the information at once, we give it in stages.
3. We take the reasonable measures needed to stop the breach and limit its effects.
4. You decide whether to notify the authority and the people concerned. We do not notify them for you unless you ask us to or the law requires it.

11. End of the processing

1. When the agreement ends, you can export your content for 30 days as set out in the terms.
2. After that period we delete the personal data we process for you, including in our sub-processors' live systems. Backups are overwritten within 35 more days. We keep data only where EU or Belgian law requires it, and then only for that purpose.
3. On request we confirm the deletion in writing.

12. Information and audits

1. We make available the information you reasonably need to show compliance with article 28 GDPR, such as this DPA, Annex 2, our sub-processor list and relevant certificates or reports of our main sub-processors.
2. If that information is not enough, you may have an audit carried out at your own cost, by yourself or an independent auditor bound by confidentiality, at most once every 12 months, with at least 30 days' notice, during office hours and without disturbing our operations or the data of other customers. Audits required by an authority or after a breach are not limited to once a year.
3. Audits of our sub-processors are carried out through their own certificates and audit reports where possible.

13. Liability

Each party's liability under this DPA is subject to the limits in the terms of service, except where the GDPR does not allow such a limit.

14. Applicable law

This DPA is governed by Belgian law. The courts named in the terms of service have jurisdiction.

Annex 1. Description of the processing

Annex 2. Technical and organisational measures

Access and isolation

• Row-level security in the database: each workspace can only read its own rows. Server-only service keys are never sent to the browser.
• Private file storage; files are shown through short-lived signed links.
• Staff access to customer workspaces is limited to named staff accounts, for support and quality checks.
• Multi-factor authentication on all admin accounts (hosting, database, code, email).

Encryption

• TLS for all traffic.
• Encryption at rest by our database and hosting providers.
• Access tokens for connected social and shop accounts encrypted with AES-256-GCM; the key is only held in the server environment.
• Approval links stored only as a hash of the link token; IP addresses only as a salted, shortened hash for abuse limits.

Integrity and availability

• Regular database backups by our database provider.
• Hosting in London on providers with SOC 2 reports.
• Rate limits, daily spend caps and a kill switch for AI use.
• Human approval required before any publication.

Organisation

• Least-privilege access, reviewed periodically.
• Secrets kept in the hosting providers' secret stores, not in code.
• Business API terms with AI providers, with training on customer data off.
• An incident procedure with breach notice as in section 10.
• Confidentiality duties for everyone with access.

Annex 3. Approved sub-processors

The sub-processors listed in parts A and B of the sub-processor list dated 4 November 2026 (shown in the app after login), with the purposes, locations and safeguards stated there. Services in part C are chosen and connected by you and are not our sub-processors.