Data Processing Agreement

This Data Processing Agreement ("DPA") is part of the Terms of Service between you, the owner of sites built with Lepka (the controller), and MDMA RACINGTEAM OU, Harju maakond, Tallinn, Kesklinna linnaosa, Narva mnt 7-634, 10117, Estonia (the processor, "we"). It applies whenever we process personal data on your behalf in connection with your sites and fulfils the requirements of Article 28 of the GDPR. You accept it by accepting the Terms. If this DPA and the Terms conflict on data protection matters, this DPA prevails.

1. Subject matter and duration

1. We process personal data on your behalf to provide the Service: to host your sites and apps, store and show you the data that your sites collect, send emails and notifications, run the AI assistant on your sites, count visits, and pass data to third-party services that you connect. The details are in Annex 1.
2. This DPA applies for as long as we process personal data on your behalf, including the period after the end of the contract until the data has been deleted (section 9).

2. Your instructions

1. We process the personal data only on your documented instructions, including with regard to transfers to third countries, unless EU or Member State law requires us to do otherwise; in that case we inform you of that legal requirement before processing, unless the law prohibits this.
2. Your instructions are these Terms and this DPA, the settings of your sites and projects, and the actions you perform in the Service (for example connecting a service, exporting or deleting data). Further instructions can be given in writing (email is sufficient).
3. If we believe that an instruction infringes data protection law, we will tell you immediately.
4. We do not use the personal data for our own purposes. We may create anonymous, aggregated statistics about the use of the Service (for example how many conversations AI assistants handle), which do not contain personal data.

3. Confidentiality

We ensure that everyone who is authorised to process the personal data has committed themselves to confidentiality or is under an appropriate statutory obligation of confidentiality. Our team accesses the contents of your projects only for support at your request, for investigating errors, and for enforcing the Terms; access through our administration tools is logged.

4. Security

We implement the technical and organisational measures described in Annex 2 to ensure a level of security appropriate to the risk (Article 32 GDPR). We may update these measures as technology develops, provided that the level of protection is not reduced.

5. Sub-processors

1. You give us a general authorisation to engage the sub-processors listed on the Sub-processors page.
2. We will inform you by email at least 30 days before we add or replace a sub-processor. You may object within this period for reasonable data protection reasons. If we cannot resolve your objection, you may terminate the affected service free of charge before the change takes effect, and we refund prepaid amounts for the time after termination.
3. We impose on each sub-processor, by contract, the same data protection obligations as in this DPA, in particular sufficient guarantees of appropriate technical and organisational measures. We remain liable to you for the performance of our sub-processors' obligations.

6. International transfers

Our servers are located in the EU. Some sub-processors process personal data outside the EU/EEA, in particular in the United States (see the Sub-processors page). We transfer personal data to them only on the basis of an adequacy decision of the European Commission or the European Commission's Standard Contractual Clauses (Article 46(2)(c) GDPR). You instruct us to make these transfers as far as they are necessary to provide the features you use.

7. Assistance

1. Data subject requests. Taking into account the nature of the processing, we help you to respond to requests from individuals exercising their rights (access, rectification, erasure, restriction, portability, objection). The Service lets you view, export and delete the data of your sites yourself. If an individual contacts us directly, we forward the request to you without undue delay and do not respond ourselves unless you instruct us to.
2. Other obligations. We help you, taking into account the nature of the processing and the information available to us, to comply with your obligations under Articles 32 to 36 GDPR (security, notification of personal data breaches, data protection impact assessments, prior consultation).

8. Personal data breaches

We notify you without undue delay, and no later than 48 hours after becoming aware of it, of any personal data breach affecting the personal data we process on your behalf. The notification is sent to the email address of your account and contains, as far as available, the information you need for your own notification under Article 33(3) GDPR: the nature of the breach, the categories and approximate number of individuals and records concerned, the likely consequences, the measures taken or proposed, and a contact point. We document every breach and take the necessary measures to contain it and to mitigate its consequences.

9. Deletion and return of data

1. While you use the Service, you can export and delete the data of your sites at any time.
2. After the end of the contract we keep the data for 30 days so that you can export it (section 16 of the Terms), and then delete it, unless EU or Member State law requires us to keep it. Backup copies are overwritten within 14 days on their regular schedule.

10. Information and audits

We make available to you all information necessary to demonstrate compliance with Article 28 GDPR. We allow for and contribute to audits, including inspections, by you or an auditor mandated by you. Audits must be announced at least 30 days in advance, take place during normal business hours, must not disrupt our operations or compromise the data of other customers, and are carried out at your own cost; before that, we will try to answer your questions in writing.

11. Liability

The liability provisions of the Terms apply to this DPA, without prejudice to Article 82 GDPR.

Annex 1 — Description of the processing

Categories of data subjects: visitors of your sites; people who submit forms, place orders or book appointments on your sites; users who sign in to apps built with Lepka; people who chat with the AI assistant on your sites; recipients of emails that your sites send; other people whose data you add to your projects.

Categories of personal data: contact details (such as name, email address, telephone number), the content of form submissions, orders, bookings and messages, conversations with the AI assistant, user accounts of your apps (email address, name, role), files uploaded by visitors, and any other data that your sites are configured to collect. Technical data (IP address, browser details) is used only for security and to create anonymous visit statistics; it is not stored.

Special categories of data: the Service is not designed for processing special categories of personal data (Article 9 GDPR) or data relating to criminal convictions. If your site collects such data, you are responsible for ensuring that this is lawful and for applying the necessary safeguards.

Nature and purpose of the processing: storage and hosting; displaying the data to you; sending emails and notifications on your behalf; generating the AI assistant's answers (by our AI sub-processor); passing data to third-party services that you connect; counting visits anonymously; backups; deletion.

Retention: as determined by you, until you delete the data or the project. Conversations with the AI assistant are deleted one year after the last message at the latest; anonymous visit statistics are kept for 13 months.

Annex 2 — Technical and organisational measures

• Encryption: all connections are encrypted with TLS (HTTPS); access keys for third-party services are stored encrypted.
• Location: production servers in a data centre in Germany (EU).
• Access control: access to production systems only for authorised team members; two-factor authentication for administrative access; access to the contents of customer projects through the administration tools is logged; the principle of least privilege.
• Separation: customer code is built and run in isolated environments; the data of each site is kept separate.
• Availability and backups: a database backup every hour (kept for 2 days) and a full backup every night (kept for 14 days); monitoring of the service.
• Data minimisation: visit statistics without cookies and without storing IP addresses; personal data is not written to analytics.
• Secure development: regular security updates, dependency checks, protection against abuse (rate limits, checks of published sites for phishing).
• Incident management: a documented procedure for handling and reporting personal data breaches.

Annex 3 — Sub-processors

The current list of sub-processors is on the Sub-processors page.