Data Processing Agreement

Between:

Piotr Ciechowicz (trading as “Murmurd”), Schmohlstr. 2, 13086 Berlin, Germany (“Processor”)

And:

The entity agreeing to these terms (“Controller”)

Effective Date: The date the Controller accepts this DPA or begins using the Service.

1. Definitions

“GDPR” means the General Data Protection Regulation (EU) 2016/679.

“Personal Data” means any information relating to an identified or identifiable natural person processed by the Processor on behalf of the Controller.

“Processing” means any operation performed on Personal Data.

“Subprocessor” means any third party engaged by the Processor to process Personal Data.

“Data Subject” means the individual to whom Personal Data relates.

“Service” means the Murmurd platform and related services.

2. Scope and Purpose

2.1 Subject Matter

This DPA governs the processing of Personal Data by the Processor on behalf of the Controller in connection with the Service.

2.2 Nature and Purpose

The Processor processes Personal Data to provide the Service, including:

User account management
Check-in, priority, and escalation processing
AI-powered summary generation
Email notifications
Analytics and reporting

2.3 Categories of Data Subjects

Employees and contractors of the Controller
Users authorized by the Controller

2.4 Categories of Personal Data

Account data (name, email, profile picture)
Usage data (check-ins, priorities, escalations)
Technical data (IP addresses, device information)
Authentication data (OAuth tokens, SSO identifiers)

2.5 Duration

Processing continues for the duration of the Service agreement plus the data retention period specified in the Privacy Policy.

3. Processor Obligations

3.1 Processing Instructions

The Processor shall:

Process Personal Data only on documented instructions from the Controller
Inform the Controller if any instruction infringes applicable law
Process data only as necessary to provide the Service

3.2 Confidentiality

The Processor shall ensure that persons authorized to process Personal Data:

Are bound by confidentiality obligations
Process data only as instructed
Receive appropriate training on data protection

3.3 Security Measures

The Processor implements appropriate technical and organizational measures, including:

Technical Measures:

AES-256-GCM encryption at rest
TLS 1.3 encryption in transit
Access controls and authentication
Regular security testing
Rate limiting and abuse prevention
Account lockout mechanisms

Organizational Measures:

Security policies and procedures
Employee training
Incident response procedures
Regular security reviews

3.4 Subprocessors

The Processor may engage Subprocessors subject to:

Written agreements imposing equivalent data protection obligations
Prior notice to the Controller (see Section 6)
Remaining liable for Subprocessor compliance

Current Subprocessors are listed at: /legal/en/subprocessors

3.5 Data Subject Rights

The Processor shall assist the Controller in responding to Data Subject requests to exercise their rights under GDPR, including:

Right of access (Art. 15)
Right to rectification (Art. 16)
Right to erasure (Art. 17)
Right to restriction (Art. 18)
Right to data portability (Art. 20)
Right to object (Art. 21)

The Service includes self-service features for data export and account deletion.

3.6 Security Breach Notification

In case of a Personal Data breach, the Processor shall:

Notify the Controller without undue delay (and within 72 hours where feasible)
Provide details of the breach, affected data, and remedial measures
Assist the Controller in meeting its notification obligations

3.7 Data Protection Impact Assessments

The Processor shall provide reasonable assistance to the Controller for:

Data protection impact assessments
Prior consultations with supervisory authorities

3.8 Audits

The Processor shall:

Make available information necessary to demonstrate compliance
Allow for and contribute to audits conducted by the Controller or an auditor mandated by the Controller
Provide audit reports or certifications upon reasonable request

4. Controller Obligations

The Controller shall:

Provide lawful instructions for processing
Ensure a legal basis exists for processing
Comply with applicable data protection laws
Respond to Data Subject requests

5. International Transfers

5.1 Transfer Mechanisms

For transfers of Personal Data outside the EEA, the Processor ensures appropriate safeguards through:

EU Standard Contractual Clauses (SCCs)
Adequacy decisions where applicable
Supplementary measures as required

5.2 Subprocessor Locations

See the Subprocessor List for data locations. EU-based alternatives are available for AI processing (Mistral AI).

6. Subprocessor Changes

6.1 Notification

The Processor shall notify the Controller at least 30 days before adding or replacing a Subprocessor.

6.2 Objection

The Controller may object to a new Subprocessor by notifying the Processor within 30 days. The parties shall negotiate in good faith to resolve the objection. If no resolution is reached, the Controller may terminate the affected Service.

7. Data Deletion

7.1 Upon Termination

Upon termination of the Service agreement, the Processor shall:

Return or delete all Personal Data within 30 days
Provide certification of deletion upon request
Retain data only as required by law

7.2 Soft Deletion

Data is initially soft-deleted (marked as deleted) for 30 days to allow recovery, then permanently purged.

8. Liability

8.1 Allocation

Each party is liable for damages caused by its own breach of this DPA or applicable data protection laws.

8.2 Limitation

Liability is limited as set forth in the main Service agreement.

9. Term and Termination

This DPA:

Takes effect upon acceptance or use of the Service
Remains in effect for the duration of the Service agreement
Survives termination for data retained under legal obligations

10. Governing Law

This DPA is governed by the laws of Germany. Disputes shall be resolved in the courts of Berlin.

11. Execution

This DPA is incorporated into and forms part of the Terms of Use. By using the Service, the Controller agrees to this DPA.

For enterprise customers requiring a signed copy, contact: legal@murmurd.com

Annex A: Technical and Organizational Measures

Encryption

AES-256-GCM for data at rest
TLS 1.3 for data in transit
Encrypted secrets storage (API keys, tokens)

Access Control

Role-based access control (RBAC)
Multi-factor authentication support
Session management and timeout
Account lockout after failed attempts

Monitoring

Comprehensive audit logging
Security event monitoring
Anomaly detection

Infrastructure

EU-based primary hosting on netcup infrastructure, with Railway retained temporarily for migration rollback
DDoS protection (Cloudflare)
Automated backups
Disaster recovery procedures

Personnel

Background checks
Security training
Confidentiality agreements
Access on need-to-know basis

Annex B: Categories of Processing

Category	Data Elements	Purpose	Retention
Account Data	Name, email, avatar, timezone	User management	Duration + 30 days
Usage Data	Check-ins, priorities, escalations	Core service	2 years
AI Processing	Anonymized content	Summary generation	Ephemeral
Audit Logs	Actions, timestamps, IPs	Compliance	3 years
Billing	Organization, subscription	Payment	Legal requirement

Document version: 1.1 Last updated: August 11, 2026