If you are a business storing other people's personal data on our infrastructure, you are the controller and we are your processor. This is the agreement that covers that, under Article 28 of the GDPR. It applies automatically to every customer who needs it, with no signature required.
You are the controller: you decide what personal data goes onto our services and why. Moula World LLC is the processor: we run the infrastructure that holds it and act on your instructions.
For the limited data we hold about you as our customer, your email address, your billing records, we are the controller and the Privacy Policy governs it. That data is out of scope here.
Subject matter: the provision of infrastructure services, currently virtual and dedicated servers, web hosting, and S3-compatible object storage.
Nature and purpose: storage, hosting, transmission and backup of data you place on the services. We perform no other operation on it.
Duration: for as long as you hold an active service, and until the data is deleted with it.
Categories of data and data subjects: determined entirely by you. We do not inspect what you store and therefore do not know what categories it contains. If you place special-category data on the services, that decision and its consequences are yours, and you must be satisfied that our security measures are appropriate to it.
We process personal data only on your documented instructions. Your use of the services is that instruction: we store what you upload, serve it back when you ask, and delete it when you delete it.
We will not process it for any other purpose, and we will not use it for our own. If we are required by law to process it otherwise, we will tell you before we do, unless the law forbids us from telling you. If we consider an instruction to breach data protection law we will say so.
Personnel authorised to access customer data are bound by confidentiality obligations that survive the end of their engagement. Access is limited to those who need it to run or support the platform, and is logged.
We maintain appropriate technical and organisational measures, including:
Backups are your responsibility. We keep no backups of terminated services, by design, and our redundancy protects against hardware failure, not against you deleting something.
We will assist you, so far as is reasonable and given the nature of the processing, with: responding to requests from data subjects; carrying out data protection impact assessments; and consulting your supervisory authority.
We will notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting data you have entrusted to us. The notice will describe what we know, the likely consequences, and what we are doing about it, and we will keep you informed as more becomes clear.
Notifying your supervisory authority and your data subjects is your responsibility as controller. We will give you what you need to do it.
Moula World LLC is established in the United States. Infrastructure is operated in the European Union and elsewhere. Where personal data is transferred out of the European Economic Area, the transfer is made under the European Commission's Standard Contractual Clauses or another lawful mechanism, which are incorporated into this agreement by reference.
You may keep data within a specific region by choosing services located there. Which regions are available is stated on each product's site.
The limitations of liability in the Terms of Service apply to this agreement, except where data protection law does not permit them to.
Questions, or a signed copy for your records: support@moula.world.
