Data processing agreement

This agreement applies between the customer as controller and Moellenbeck-Digital UG (haftungsbeschränkt) as processor, insofar as we process personal data on the customer's behalf as part of “Run by us” (terms § 5). It becomes part of the contract when booking on this website and lasts for the contract's term, including the deletion periods in § 9. The German version prevails.

The subject matter is operating the control server and relays for the customer's waves: signing in users and devices, assigning addresses and names, distributing signed network maps and brokering encrypted connections.

The sole purpose is providing the customer's wave. We do not process the data for our own purposes.

Types of data: user accounts (email address, name, profile picture where the sign-in provider supplies one, password hash, second-factor secret), memberships and invitations, devices (name, operating system, public keys, assigned addresses, public IP addresses and ports as connection candidates, online status and time of last connection), names of services in the wave, access rules and a log of changes to the wave.

We do not process connection contents: traffic between devices is end-to-end encrypted with WireGuard, and a relay only sees ciphertext.

Data subjects are the users the customer admits to its wave, typically its employees and contractors.

We process the data only on the customer's documented instructions. These are set out in this agreement and in the settings the customer makes in its wave; further instructions are given in text form. This includes transfers to third countries, unless Union or Member State law requires us to process the data; we then inform the customer beforehand unless that law prohibits it. If we consider an instruction unlawful, we say so without delay.

Only persons responsible for operations and bound to confidentiality have access to the data.

We take measures under Art. 32 GDPR, in particular:

Encryption: all connections to the control server over TLS, traffic between devices end-to-end over WireGuard; private keys never leave the devices.

Access protection: passwords only as Argon2id hashes, an optional second factor (TOTP); invitations, setup links and device keys only as SHA-256 hashes; credentials for DNS providers sealed with AES-256-GCM.

Operations: containers in a Kubernetes cluster in the data centre of Hetzner Online GmbH in Nuremberg; access to cluster and database only for the processor's administrators.

Availability: daily database backups and continuous backup of changes in Hetzner Object Storage in Nuremberg, kept for 30 days.

Accountability: changes to a wave's members, devices, rules and settings are logged and visible to the customer.

We may develop these measures further as long as the level of protection does not fall.

The customer approves Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, for data centre, servers and storage in Germany.

We announce additional or replacement sub-processors at least four weeks in advance in text form. The customer may object for an important data protection reason; either party may then terminate the contract as of the change. We bind sub-processors contractually as in this agreement.

No processing takes place outside the EU or EEA.

Our communication with the customer about the contract, including the email with the link to set up its account, is not covered by this agreement; we process it as a controller in our own right under our privacy policy.

We assist the customer, through the service's features and on request, in responding to data subject requests (Art. 12 to 23 GDPR) and with its obligations under Art. 32 to 36 GDPR. The customer can remove members and devices itself, which deletes their data in the wave.

If we become aware of a breach affecting the customer's personal data, we inform the customer without undue delay, where possible within 24 hours, with the information it needs for a notification under Art. 33 GDPR.

After the contract ends we suspend the wave and delete its data 30 days later. Until then the customer may request its data. The data leaves the backups at most another 30 days later. Statutory retention duties remain unaffected; they concern our invoices, not the data in the wave.

We provide the customer with the information it needs to demonstrate compliance with Art. 28 GDPR and allow audits, including inspections, by the customer or an auditor it mandates who is bound to confidentiality, after timely notice, during normal business hours and without disrupting operations. We may charge reasonably for the effort unless the audit reveals a breach.

Liability follows Art. 82 GDPR and otherwise § 9 of the terms. Where this agreement and the terms conflict on the protection of personal data, this agreement prevails.