Data processing agreement (Art. 28 GDPR)
Last updated: 7 November 2026
Draft. Have this agreement reviewed by a lawyer before public launch.
This agreement applies between the customer (“controller”) and Digital Zombies Kft., [registered office, Hungary] (“processor”) whenever we process personal data on the customer's behalf while providing mumus. It forms part of the ÁSZF (terms of service) and is accepted with them. Need a signed copy? Write to [privacy@mumus.app].
1. Subject and duration
Subject: hosting and operating mumus for collecting website feedback and managing tasks. Duration: as long as the main contract runs, plus the deletion period in section 9.
2. Nature and purpose of processing
Storing, organizing, displaying, transmitting (notifications, AI assistants connected by the customer), backing up and deleting the data the customer and its users put into mumus, solely to provide the service.
3. Types of data and data subjects
| Data subjects | Data categories |
|---|---|
| Members and clients of the customer's workspace | Name, e-mail address, optional mobile number, profile picture, role, login and activity timestamps, notification settings |
| Members, clients and anyone shown on the reported websites | Reports, comments, screenshots, screen recordings, attachments, page addresses, browser and device details, console and network metadata captured by the extension or the website widget (secrets redacted), reports received by e-mail |
Special categories of personal data (Art. 9 GDPR) are not intended to be processed. The customer makes sure that screenshots and recordings don't contain them unnecessarily.
4. Instructions
We process the data only on documented instructions from the customer. The contract, the product settings and the customer's actions in the app count as instructions. If we believe an instruction breaches data protection law, we will inform the customer.
5. Confidentiality
Everyone authorized to process the data is bound to confidentiality. Our staff access customer content only where support or security requires it, and only to the extent necessary.
6. Technical and organizational measures (Art. 32 GDPR)
- Encryption in transit: TLS for all connections, HSTS.
- Access control: passwords hashed with Argon2id, login throttling, two-factor authentication (organizations can require it), session timeouts, scoped and revocable API and MCP tokens.
- Encryption of secrets: two-factor secrets are encrypted at rest (XChaCha20-Poly1305) with a key stored separately from the database.
- Authorization: deny-by-default, role-based access per organization and per project, “own tasks only” for clients, automated tests for the authorization matrix.
- Private storage: files are stored outside the web root under random names and are delivered only after an authorization check. Uploads are checked by content, and images are re-encoded and stripped of metadata.
- Availability: daily backups, encrypted [restic] off-site copies within the EU, restore tests [quarterly].
- Location: servers and backups in data centers in [Germany].
- Infrastructure: firewall, key-only SSH, automatic security updates, containers without root privileges, dependency vulnerability checks.
- Logging: security events are logged without content and kept for [90] days.
More details: Security. We may adapt the measures to the state of the art, provided the level of protection doesn't decrease.
7. Subprocessors
The customer agrees to the subprocessors listed here. We will announce new subprocessors at least [30] days in advance. The customer may object for good cause.
| Subprocessor | Service | Location |
|---|---|---|
| [IONOS SE] | Hosting, mailbox for reports sent by e-mail | Germany |
| [Hetzner Online GmbH] | Encrypted off-site backups | Germany |
| [Brevo (Sendinblue SAS)] | Transactional e-mail, SMS alerts | France / EU |
| [Twilio Ireland Ltd.] (optional) | SMS alerts, if used instead of Brevo | Ireland; transfers to the USA under the EU-US Data Privacy Framework and standard contractual clauses |
Stripe (payments) and Számlázz.hu (invoicing, NAV reporting) process billing data for our own accounting, not workspace content; they are therefore not subprocessors for customer data. Stripe acts as an independent controller, not as a subprocessor for workspace content. AI assistants the customer connects are the customer's own recipients.
8. Assistance and notifications
We support the customer with requests from data subjects (Art. 15–22 GDPR), with security, data protection impact assessments and consultations (Art. 32–36 GDPR). We report personal data breaches to the customer without undue delay, at the latest within [48] hours of becoming aware of them.
9. Deletion and return
The customer can export its data at any time. After the contract ends, the customer can retrieve its data for at least 30 days (section 12 of the terms). We then delete all customer data at the latest when the workspace is deleted under section 12.4 of the terms or on the customer's instruction, and backups within a further [30] days, unless the law requires us to keep it.
10. Audits
On request, we provide the information needed to demonstrate compliance. The customer may carry out audits, or have them carried out by a bound auditor, after reasonable notice, during business hours and without disrupting operations. Costs beyond a reasonable effort are borne by the customer.
11. Governing law, liability and precedence
This agreement is governed by Hungarian law. Liability is governed by Art. 82 GDPR and the terms of service. If this agreement conflicts with the terms, this agreement takes precedence in matters of data protection.