Data processing agreement

The short version

• You decide what happens to personal data in your workspace. We act only on your instructions.
• We protect it with the measures in Annex 2 and bind our providers to the same duties.
• We tell you 30 days before adding a subprocessor, and you can object.
• If something goes wrong, we tell you without delay. When you leave, your data is deleted.
• Need a countersigned copy? Write to beratung@mynd.com.

1. Parties and subject

This agreement applies between you as controller (“customer”) and Mynd GmbH, Leipziger Straße 8, 60487 Frankfurt am Main as processor (“we”), for the personal data we process for you when providing Wunderblick. It applies in electronic form (Art. 28(9) GDPR) and runs as long as the terms of service, including the retrieval period. Annex 1 sets out the details.

2. Instructions

We process the data only on your documented instructions, including for transfers to third countries, unless EU or German law requires otherwise, in which case we tell you first unless the law forbids it. These terms and your settings and actions in the app are your instructions. If we think an instruction breaks data protection law, we tell you.

3. Confidentiality

Everyone who has access to the data on our side is bound to confidentiality.

4. Security

We maintain the measures in Annex 2 (Art. 32 GDPR). We may improve or replace them as long as the level of protection does not fall.

5. Subprocessors

You authorise the subprocessors on our subprocessor list. We tell workspace owners by email at least 30 days before adding or replacing one. You can object for good reason within that time. If we find no solution, you can terminate the affected service. We bind each subprocessor to equivalent data protection duties and remain responsible for its work.

6. Transfers outside the EU

We transfer personal data outside the EU or EEA only where Chapter V GDPR allows it, based on an adequacy decision (including the EU-US Data Privacy Framework for certified recipients) or the EU standard contractual clauses (Decision (EU) 2021/914). The subprocessor list shows the basis for each provider.

7. Helping you

We help you, as far as we reasonably can, to answer data subject requests and to meet your duties under Art. 32 to 36 GDPR. If someone contacts us directly about data in your workspace, we pass it on to you and do not answer on our own.

8. Personal data breaches

We inform you without undue delay, where possible within 48 hours of becoming aware of a breach, with the information we have and what you need to report it. We also take steps to limit the damage.

9. Evidence and audits

We give you the information you need to show compliance with Art. 28 GDPR. You or an auditor bound to confidentiality may audit us after 30 days’ notice, during office hours, without disturbing operations, normally once a year or if there is a concrete reason.

10. Deletion and return

When the contract ends you can retrieve your data as described in section 9 of the terms. We then delete it unless the law requires us to keep it. Backups age out within 30 days. We confirm deletion on request.

11. Final provisions

On data protection matters this agreement takes priority over the terms of service. Liability follows Art. 82 GDPR and the terms of service. German law applies.

Our data protection officer: Dominik Fünkner, PROLIANCE GmbH, dsb@datenschutzexperte.de.

Annex 1: Details of the processing

Annex 2: Technical and organisational measures

Premises

• Data sits in the data centres of Hetzner (ISO/IEC 27001) and Cloudflare (ISO/IEC 27001, SOC 2 Type II). We keep no customer data on our own premises.

Access to systems

• Passwords are stored only as salted scrypt hashes. Email addresses are confirmed by code.
• Sessions are held on the server, can be revoked, and use HttpOnly, Secure and SameSite cookies.
• Rate limits and capped attempts protect sign-in and one-time codes.
• The database is reachable only from inside the server. The app runs in a container as a non-root user.

Access to data

• Roles (owner, admin, manager, editor), checked on the server for every request and limited to the workspace.
• Review links use random tokens, with optional password, expiry and revocation, and separate layers of access.
• Files are delivered through short-lived signed URLs.
• Mynd staff access customer data only where needed for operation or support.

Separation

• Customer data is separated by workspace.
• Uploaded HTML runs on a separate address, and reviewed websites on separate addresses per session, in sandboxed frames.

Encryption

• All connections use TLS, enforced with HSTS.
• Files on Cloudflare R2 are encrypted at rest with AES-256 by the provider.
• Sensitive fields such as external file links are also encrypted by the app with AES-256-GCM.
• The database and Germany-only object storage are protected by the access controls above and are not encrypted at rest.

Availability

• Database backups every night and before every software update. Integrity is checked, and backups are stored in the EU for 30 days.
• Earlier software versions are kept so we can roll back quickly.

Organisation

• External data protection officer and staff bound to confidentiality.
• Security reviews of the full code base, most recently in July 2026.
• Data processing contracts with all subprocessors.

Annex 3: Subprocessors

See the subprocessor list, which forms part of this agreement.