1. Parties and roles

This Data Processing Addendum (“Addendum”) applies between Molvek OÜ, incorporated in Estonia (“Molvek” or “Processor”), and the business using Molvek (“Customer” or “Controller”), to the extent Molvek processes Customer Personal Data on the Customer’s behalf. Contact: info@molvek.com.

Roles are assessed for each activity by reference to who actually determines its purposes and essential means, not solely by the labels in this document. Molvek acts as Processor for customer-service data handled on the Customer’s documented instructions. Molvek’s own account administration, security, billing linkage, and legal-obligation processing are assessed separately and make Molvek an independent Controller for those activities. For self-serve subscription checkout, Stripe/Link acts as the Merchant of Record under Stripe Managed Payments.

2. Subject matter, duration, and instructions

The subject matter, nature, purposes, data subjects, data types, and duration are set out in Annex 1. Molvek processes Personal Data only on the Customer’s documented instructions and to provide and secure the service, provide support, and perform purposes expressly described in this Addendum. Instructions comprise this Addendum, accepted service terms, and the Customer’s written in-product configuration choices. Instructions also cover transfers of Personal Data to a third country or an international organisation. As an exception to the documented-instructions requirement, where Union or Member State law to which Molvek is subject requires Molvek to process Personal Data, Molvek will process as required by that law. Before processing, Molvek will inform the Customer of the legal requirement unless that law prohibits the information on important grounds of public interest. If Molvek considers an instruction to infringe data protection law, it will inform the Customer without undue delay.

Molvek ensures that persons authorized to access Personal Data are bound by confidentiality and receive access only as necessary for their work. The Customer is responsible for the lawfulness of its instructions and its authority to provide data to Molvek.

3. Security and Personal Data Breaches

Molvek implements and maintains technical and organizational measures appropriate to the processing risk: HTTPS/TLS in transit, AES-256-GCM encryption for connection secrets and OAuth refresh tokens, multi-tenant data isolation, and least-privilege access. Multi-factor authentication is enforced on Molvek's administrative accounts for infrastructure, source code, payments and email. Molvek will notify the Customer of material changes to measures without reducing the level of protection.

If Molvek becomes aware of a Personal Data Breach affecting Customer Personal Data processed for this service, it will notify the Customer without undue delay. The initial notice will include information then available and be updated as further facts are established. The Customer may request further information needed to meet its own duties.

4. Rights, compliance assistance, and subprocessor list

Taking account of the nature of processing, Molvek provides reasonable and appropriate technical assistance with the Customer’s responses to data-subject rights requests. If a request is made directly to Molvek, it will promptly inform the Customer unless legally required to respond itself, and will await the Customer’s instructions.

Taking account of the nature of processing and information available to it, Molvek assists the Customer with security, breach, impact-assessment, and prior-consultation duties under Articles 32–36. It supports reasonable information requests and compliance audits. Audits will be on reasonable prior notice, during normal business hours, and subject to confidentiality and protection of other customers. Relevant independent reports may be supplied instead of an on-site audit where available.

Subprocessor list (written in this DPA text): Under the Customer’s general written authorization, Molvek uses only the following subprocessors to process Customer Personal Data (further detailed in the subprocessor register):

• Railway — europe-west4 (Amsterdam, EU): Application, worker, PostgreSQL database, Redis, and migrator hosting — live production region europe-west4 (Amsterdam, EU).
• Amazon Web Services (AWS) — Lightsail, eu-central-1 (Frankfurt, EU): Announced replacement subprocessor that will replace Railway for application, background worker, Redis, and managed PostgreSQL 16 database hosting. Notice of this replacement subprocessor is given at the time of signature (acceptance of this Addendum).
• Qdrant Cloud — eu-central-1 (EU): Knowledge-base text chunks and search vectors — eu-central-1 (EU).
• Anthropic (AI response generation): Customer messages, conversation context, and reply/summary generation (Anthropic Trust Center / DPA).
• OpenAI (Embeddings generation): Search vector (embedding) generation from knowledge-base text chunks and search queries (OpenAI DPA).

Molvek gives prior written notice of an intended new or replacement subprocessor and allows a reasonable objection period (notice of AWS as the announced replacement subprocessor that will replace Railway is given at the time of signature). The parties will seek a reasonable resolution; if none is reached, the Customer may terminate the affected service. Molvek imposes equivalent data-protection duties on the actual subprocessors listed above and remains liable to the Customer solely for those actual subprocessors’ obligations under GDPR Article 28(4).

Services connected by the Customer under its own account and terms — not Molvek subprocessors

The following third-party services are optionally connected by the Customer under its own account and its own agreements/terms with the relevant provider; they are not Molvek subprocessors and are not covered by GDPR Article 28(4) subprocessor liability:

• Meta / WhatsApp / Instagram (Meta Platforms): Messaging channels connected by the Customer with its own Meta Business / WhatsApp Business Cloud API or Instagram account.
• Telegram: Messaging channel connected by the Customer under its own Telegram bot and terms.
• Google Calendar (Google OAuth 2.0): Calendar integration authorized by the Customer with its own Google account (calendar.calendarlist.readonly, calendar.freebusy, calendar.events.owned).

5. Data-transfer basis, return, and deletion

Basis for transferring data (written in this DPA text): The hosting and transfer basis per provider is as follows (see the data-location statement and subprocessor register):

• Railway: In live production, application, worker, PostgreSQL, and Redis hosting run in the EU region (europe-west4, Amsterdam).
• Amazon Web Services (AWS) — Lightsail, eu-central-1 (Frankfurt, EU): Announced replacement subprocessor that will replace Railway; application, worker, Redis, and managed PostgreSQL 16 hosting will run in the EU region (eu-central-1, Frankfurt) and notice is given at the time of signature.
• Qdrant Cloud: Vector search runs in the EU region (eu-central-1).
• Anthropic: Transfers outside the EEA (including to the United States) for AI response generation rely on the European Commission Standard Contractual Clauses under GDPR Article 46(2)(c) (SCCs — Anthropic Commercial Terms and DPA) together with supplementary technical and organizational measures.
• OpenAI: Transfers outside the EEA (including to the United States) for search vector (embedding) generation rely on the European Commission Standard Contractual Clauses under GDPR Article 46(2)(c) (SCCs — OpenAI Data Processing Addendum / DPA) together with supplementary technical and organizational measures.

At the end of the service, the Customer may choose return or deletion of Customer Personal Data, except where retention is required by law. Molvek follows that instruction and explains mandatory-retention exceptions. Ending the service, disconnecting an integration, or the periods below do not mean immediate physical erasure from every backup or subprocessor copy.

Molvek’s own email operational records

This policy note concerns email diagnostic/support records and the audit record of governed email-block removal that Molvek processes as Controller for its own operational purposes; it does not replace the Customer-data schedule in Annex 1 for processing by Molvek as Processor. The retention period is 14 days from terminal disposition for the first record class, and 90 days from governed clearing for the second class’s audit record of actor, authority, time, and coded outcome. Neither class includes email content or authentication tokens. Coded identifiers and linkage may nevertheless be Personal Data. Active suppression records and necessary bounded replay and control evidence have separate lifecycles.

Annex 1 — Processing details

• Business / Controller: The Customer business accepting the Molvek service (as identified with its accepting operator in the acceptance record).
• Subject matter and duration: Provision of Molvek to the Customer business; subscription/service term plus the return/deletion and retention provisions in this Addendum.
• Nature and purposes: Processing conversations and appointments on Customer instructions; creating/responding to messages, knowledge-base search, customer support, authorized Google Calendar synchronization, and security.
• Data subjects: Customer’s customers and prospective customers; Customer staff and authorized operators; calendar or messaging participants if those integrations are enabled.
• Personal Data types: message content and conversation context; names, phone numbers, and business contact/transaction details supplied by the Customer; appointment dates/times, time zones, event identifiers and encrypted OAuth sync tokens; knowledge-base text, chunk identifiers, vectors and optional metadata; service, security and delivery logs. Special-category data is not intentionally requested.
• Subprocessors and transfer basis: The subprocessor list in Section 4, the GDPR Chapter V transfer basis in Section 5 (EU/EEA hosting in live production on Railway europe-west4 Amsterdam, announced replacement subprocessor AWS Lightsail eu-central-1 Frankfurt, and Qdrant Cloud eu-central-1; European Commission SCCs for Anthropic and OpenAI), the subprocessor register, and the data-location statement.
• Technical and organizational measures: HTTPS/TLS in transit, AES-256-GCM encryption for connection secrets and OAuth refresh tokens, tenant isolation; Multi-factor authentication is enforced on Molvek's administrative accounts for infrastructure, source code, payments and email; security-critical changes undergo independent review and adversarial testing before release (security disclosure).
• Rights, incidents, and contact: info@molvek.com and security@molvek.com for security reports.

6. Effectiveness and electronic acceptance record

This Addendum takes effect when accepted electronically or signed in writing by the Customer’s authorized operator together with the service terms. The electronic acceptance record stores five fields: document kind, document version, document hash (SHA-256), accepting operator, and acceptance timestamp. Because the list of subprocessors (Section 4) and the basis for transferring Personal Data (Section 5) are written directly in the text of this DPA, no separate field is stored for them in the acceptance record.

Processor

Molvek OÜ · Registrikood 17618773 · Sepapaja tn 6, 15551 Tallinn, Estonia

Customer / Controller

The business and accepting operator recorded in the electronic acceptance record (document kind, version, hash, accepting operator, and timestamp)