Data processing agreement

1. Parties and roles

The customer (the business with a Modudek account) is the controller. Creative Communication, Koerselsesteenweg 192, 3582 Koersel, company number BE 0683.857.720, is the processor. This agreement applies as long as the customer uses Modudek, and afterwards until all data has been deleted or returned.

If the client gives a partner (agency or accountant) access, that partner acts on behalf and for the account of the client. The client decides on that access and can always withdraw it in Settings. Modudek only gives the partner the access the client allowed (full, or invoices and expenses only) and keeps what the partner changes in the client's log.

2. Subject and purpose

We process personal data only to provide Modudek as the customer uses it: displaying their website and web shop, keeping contacts and appointments, sending and receiving emails and newsletters, running the chat and AI features, creating quotes, invoices and work orders (including online acceptance and signing of quotes), creating delivery notes, packing slips and return notes and having them signed on receipt, selling and redeeming gift cards and class passes/subscriptions, offering a customer portal where the customer's client views their documents and showing statistics. We never use the data for our own purposes and never sell it.

3. Types of data and data subjects

Types of data: identity and contact details (name, email, phone, address), communications (messages, chat conversations, emails), appointments, orders and invoices, notes, newsletter preferences and technical data (such as an IP address made unidentifiable for security). For rentals also bookings (period, number of guests, payments) and, if the customer turns on the guest register, the name, date of birth, nationality and address of the main guest; these forms are deleted automatically after the retention period the customer chooses. For quotes, also when the quote was opened, the chosen options, the name and signature with which the customer's client accepts, the time and an anonymised (hashed) IP address as proof, questions and reasons for declining, and deposit payments. For gift cards, the name and email of the buyer and possibly of the recipient, a personal message, the amount, the balance and the redemptions. For class passes and subscriptions, the holder's name and email, the number of sessions, the validity, the deductions (with the appointment) and the subscription's payment status. For the customer portal, the email address the customer's client signs in with, the times of sign-in links and sessions (stored only as an encrypted code; links deleted after a day, sessions after 30 days), and the questions and changed details they enter themselves. For deliveries, also the delivery address, the name and signature of whoever receives the delivery, the time, an anonymised (hashed) IP address and the device as proof of receipt (or the reason it was delivered without a signature), and photos of the delivery. These belong to the accounting records and are kept just as long.

Data subjects: customers, prospects, website visitors, newsletter subscribers and the customer's staff. For rentals also the customer's guests. For stock management also suppliers and their contact persons (business contact details and purchase orders). For deliveries, also whoever receives a delivery.

The customer does not keep special categories of data in Modudek (such as health or criminal data), unless legally permitted and necessary for their activity, and then at their own responsibility.

4. Instructions from the customer

We process the data only on the customer's instructions. Those instructions are the settings and actions in Modudek and this agreement. If we believe an instruction breaks the law, we say so immediately. If a law or authority asks us to hand over data, we notify the customer in advance, unless that is prohibited.

5. Confidentiality

Everyone at our side who has access to the data is bound by confidentiality and only gets access as far as needed for their task.

6. Security

We take appropriate technical and organisational measures, including:

• encrypted connections (https/TLS) and encrypted storage at our database provider;
• strict separation per customer in the database (each customer only sees their own data);
• mandatory two-step verification for all users and passwords that are never stored in readable form;
• a firewall and limits against misuse and attacks;
• backups at our database provider and a backup button for the customer;
• access by our team only when necessary.

7. Sub-processors

The customer gives general authorisation to engage these sub-processors:

• Supabase (database, login, files) – Frankfurt, EU;
• Vercel (hosting and firewall) – global network, US company;
• Resend (sending and receiving email) – US company, sending from the EU;
• Stripe (payments) – Ireland and US;
• Anthropic (AI features; does not use the data to train models) – US;
• Hostinger (domain names and DNS) – EU.
• Hostinger Mail (mailboxes the customer takes through Modudek).
• CM.com (sending SMS and WhatsApp messages, if the client uses reminders) – the Netherlands, EU; WhatsApp messages via Meta Platforms Ireland (WhatsApp Business), with transfers under the EU-US Data Privacy Framework.
• OpenStreetMap Foundation (looking up the coordinates of the business address on the customer's website; no end-customer data) – United Kingdom, adequacy decision of the European Commission.

We impose the same obligations on sub-processors as in this agreement. We announce a new sub-processor at least 30 days in advance. The customer may object for a valid reason; if we cannot find a solution, they may end the subscription free of charge.

8. Transfers outside the EU

Data only leaves the European Economic Area if there is a valid safeguard, such as an adequacy decision (e.g. the EU-US Data Privacy Framework) or the European Commission's standard contractual clauses.

9. Rights of data subjects

If someone asks the customer for access to, correction, deletion or a copy of their data, Modudek helps: the customer can search, edit, export and delete contacts in the app. If such a request reaches us, we forward it to the customer.

The customer can answer a request for access or portability itself: on the contact's record, an admin uses the “Export data (GDPR)” button to download a file (JSON) with the data stored in the workspace about that contact. To erase data, the customer deletes the contact; issued invoices are kept, as accounting law requires. Delivery notes and return notes are also kept, with the name and address as shown on the note.

10. Data breaches

If we discover a security breach affecting the customer's data, we report it without undue delay and at the latest within 48 hours after establishing it. We provide the information the customer needs to meet their own notification duty (what happened, which data, the consequences and the measures taken) and help resolve it.

11. Assistance and audits

We help the customer, as far as reasonable, with a data protection impact assessment or consultation with the Data Protection Authority.

On request, we give the customer the information needed to show that we comply with this agreement. An audit can take place once a year, with reasonable notice of at least 30 days, at the customer's expense and without access to other customers' data.

12. End of the agreement

After the subscription ends, the customer can still export their data for 3 months. After that we delete it, also from backups within their normal retention period, except what we are legally required to keep.

13. Liability and order of precedence

Liability is governed by our terms and conditions. In case of conflict regarding the protection of personal data, this data processing agreement prevails over the terms and conditions. This agreement is governed by Belgian law.