Data processing agreement.

Roles

This Data Processing Agreement ("DPA") is between you, the client, and Katulondi B.V., trading as Maua, KVK 84821035, Tappersweg 14 027, 2031 EV Haarlem, the Netherlands ("Maua", "we").

For personal data we process on your behalf, you are the controller and Maua is the processor. If you are yourself a processor for your own client, we act as your subprocessor, and you confirm you are allowed to engage us.

This DPA does not cover data we handle for our own purposes, such as billing. For that, our Privacy Notice applies.

If documents conflict, this order applies: mandatory law, then this DPA on anything about personal data, then your quote, then the Terms. Annexes 1 to 3 form part of this DPA.

Your instructions

We process personal data only on your documented instructions: the Terms, your quote, this DPA, and the tasks you send us. We tell you immediately if we think an instruction breaks data protection law, and we pause that part of the work until it is resolved.

Your responsibilities

You make sure you have a lawful basis for the processing, that the people concerned are properly informed, and that you are allowed to share the data and access you give us.

Sensitive data

Our standard service does not cover special categories of personal data (such as health data), data about criminal convictions, or data about children. If your work involves such data, ask us before sending it. If we receive it by accident, we restrict access to it, tell you, and delete or return it as you instruct.

Our team

Only people who need the data for your task can access it. Everyone with access is bound by confidentiality and uses a personal account with two-factor authentication. No shared logins. Their access to your systems and data ends on the day the contract ends.

Security

We protect personal data with the measures in Annex 2 and review them every year.

Subprocessors

You authorise the subprocessors in Annex 3. We tell you by email at least 30 days before we add or replace one. You can object on reasonable data protection grounds within 14 days. If we cannot resolve the objection, you can end the affected service without cost.

Each subprocessor is bound by data protection obligations at least as protective as this DPA. We remain fully responsible to you for their work.

Where your data is

Your data stays in Europe: we host it with Hetzner in the EU, in a separate project for each client. No data is stored in Indonesia.

Our own development team at PT Exp Inc Software in Solo, Indonesia, works on your systems remotely when a task requires it. Under the GDPR, that remote access counts as an international transfer. We cover it with the EU Standard Contractual Clauses (Module 3) between Katulondi B.V. and PT Exp Inc Software, a transfer impact assessment and supplementary measures. On request, we give you a copy of the clauses, with business-sensitive parts redacted.

No other use of your data

We do not sell your data, use it for our own purposes, or use it to train AI models.

Helping you

If someone asks us to exercise their data protection rights, we forward the request to you within 2 working days and do not respond ourselves unless you tell us to. We help you with such requests, with security, with data protection impact assessments and with questions from a supervisory authority, as far as our role allows.

Data leaks

If a data leak affects your data, we report it to you within 4 hours after we become aware of it. We share what we know at that point and follow up as we learn more: what happened, which data and people are affected, the likely consequences, and what we are doing about it.

You decide whether to notify the supervisory authority and the people affected.

When the agreement ends

Within 5 working days after the end, you get full access, a current backup and a handover document. No exit costs. Our team's access ends on the day the contract ends.

If you do not respond to our handover messages, we export your data on day 30 and delete all copies, including backups, on day 60. If a law requires us to keep some data longer, we tell you what and why, keep it protected, and delete it when that period ends. On request, we confirm deletion in writing.

Audits

We give you the information you need to check that we meet this DPA. You, or an independent auditor you appoint, may audit us once a year with 30 days' notice, and at any time after a data leak or at the request of a supervisory authority. Each party bears its own audit costs, unless the audit shows a material breach by us.

Liability and duration

The liability limits in the Terms apply to this DPA, except where the law does not allow a limit. Nothing in this DPA limits the rights of the people whose data we process or the powers of a supervisory authority.

This DPA applies as long as we process personal data for you, including the handover and deletion period. Questions: legal@maua.ai.

Annex 1: Processing details

Annex 2: Security measures

Annex 3: Subprocessors