Data Processing Agreement

Last updated 27 September 2026

1. Parties and roles

This agreement is between the customer who accepted the Terms of Service ("you", the controller) and BusinessGenics d.o.o., Borongajska cesta 82, Zagreb, Croatia, which operates MNCL360 ("we", the processor). It is intended to meet the requirements of Article 28 of the EU General Data Protection Regulation (GDPR) and the UK GDPR, and the service provider and processor requirements of US state privacy laws described in section 13. Because we are established in the EU, the GDPR's processor obligations apply to our processing wherever you and the people in the data are located. Where you act as a processor for your own clients, you confirm that your client has authorised you to appoint us, and we act as your sub-processor on the same terms.

This agreement covers Customer Data: the personal data you or your users put into MNCL360 or connect to it. It does not cover data we process as a controller to run our own business, such as your account and billing details, your users' login and security data, and product usage information. That processing is described in our Privacy Policy.

2. What we process

3. Your obligations as controller

• You are responsible for having a lawful basis for the Customer Data you put into MNCL360 and for giving the people concerned any notices, and obtaining any consents, the law requires. This includes consents needed to record calls or store message content, and permissions needed to import leads or contact lists.
• Your instructions to us must comply with data protection law.
• You are responsible for the accuracy of the data you upload and for configuring user access in your workspace.

4. Special category and sensitive data

MNCL360 is not designed for health, biometric, genetic or other special category data, criminal offence data, or data about children. Do not upload it unless you have a lawful basis and have agreed with us in writing that the service is suitable. You are responsible for such data if you upload it without that agreement.

5. Our obligations

• We process Customer Data only on your documented instructions, including for international transfers, unless EU or Member State law requires otherwise. In that case we will tell you before processing, unless the law forbids it. The Terms, this agreement and your use of the product settings are your instructions. If we think an instruction breaks data protection law, we will tell you and may pause that processing.
• Everyone we authorise to access Customer Data is bound by confidentiality.
• We maintain the technical and organisational security measures in section 7.
• We help you respond to requests from the people in the data (access, correction, deletion, restriction, objection, portability), mostly through the product itself and otherwise on request. If a request reaches us directly, we will pass it to you and not respond ourselves unless you ask us to.
• We help you with security, breach notification, data protection impact assessments and prior consultations with regulators, taking into account the nature of processing and the information available to us.
• We do not sell Customer Data, use it for our own purposes, or use it or allow our subprocessors to use it to train AI models.
• If a public authority asks us for Customer Data, we will tell you unless the law forbids it, and we will challenge requests we reasonably consider unlawful.
• We keep a record of our processing activities as required by Article 30(2) GDPR.

6. Subprocessors

You give us general authorisation to use the subprocessors below. We impose on each of them, by written contract, data protection obligations that are the same in substance as those in this agreement. We remain fully responsible to you for how our subprocessors perform those obligations.

Stripe processes payment information as an independent controller under its own terms and is described in our Privacy Policy.

We will give you at least 30 days' notice by email before adding or replacing a subprocessor. You may object on reasonable data protection grounds within that period. If we cannot address your concern, you may terminate the affected service and receive a refund of any prepaid fees for the remaining period. In an emergency, for example to replace a subprocessor that has had a security failure, we may give shorter notice and will explain why.

7. Security

We maintain at least the following measures and may improve them over time, provided we do not reduce overall protection:

• Encryption in transit (TLS 1.2 or higher) and at rest
• Third-party credentials and advertising tokens stored encrypted, separately from other data
• Logical separation of each workspace's data, enforced in the application and tested
• Production access limited to named people who need it, with multi-factor authentication, reviewed regularly
• Encrypted backups on a rolling schedule with a maximum retention of 30 days, and tested restores
• Logging and monitoring to detect misuse, and a documented incident response process
• Vulnerability management, dependency patching and security review of code changes
• Due diligence on subprocessors before we appoint them

8. Personal data breaches

If we become aware of a personal data breach affecting Customer Data, we will notify you without undue delay and in any case within 48 hours of becoming aware. We will tell you what we know about its nature, the categories and approximate number of people and records affected, the likely consequences, the steps we are taking, and a contact for more information. Where we do not have all the information at once, we will provide it in phases. Our notification is not an admission of fault.

9. International transfers

BusinessGenics d.o.o. is established in the European Union. Where a subprocessor processes Customer Data outside the EEA or the UK, we ensure the transfer is protected by an adequacy decision (such as the EU-US Data Privacy Framework, for certified recipients) or by the European Commission's 2021 Standard Contractual Clauses (Module 3, processor to processor), together with the UK Addendum where relevant. Where you are located outside the EEA, our return of Customer Data to you and our onward transfers on your instructions are covered by Module 4 (processor to controller) and Module 3 of the Standard Contractual Clauses respectively, which are incorporated into this agreement by reference. We maintain transfer impact assessments and supplementary measures, including encryption, where needed. If a transfer mechanism is invalidated, we will move to another valid mechanism or stop the transfer.

10. Return and deletion

You can export your data at any time in a common machine-readable format. When your account ends, you have 30 days to export it. We then delete or anonymise Customer Data within 90 days of the account ending, unless EU or Member State law requires us to keep it. Backups are purged on their rolling schedule and are not restored to serve deleted accounts. We will confirm deletion in writing on request.

11. Audits

We will make available the information you reasonably need to show that we meet this agreement, including our security documentation and answers to one written security questionnaire a year. Where that is not enough to demonstrate compliance, you or an independent auditor you appoint (who is bound by confidentiality and is not our competitor) may carry out an audit, at your cost, with at least 30 days' notice, during business hours, and no more than once a year unless a regulator requires it or a breach has occurred.

12. Liability, law and precedence

Each party's liability under or in connection with this agreement is subject to the limits in the Terms of Service, except where the law does not allow liability to be limited. Nothing in this agreement limits the rights of the people in the data under Article 82 GDPR. This agreement is governed by the laws of the Republic of Croatia, except that section 13 is interpreted under the applicable US state law. If this agreement and the Terms conflict on the processing of personal data, this agreement wins. If the Standard Contractual Clauses apply and conflict with this agreement, the Standard Contractual Clauses win.

13. US privacy laws

Where US state privacy laws apply, including the California Consumer Privacy Act as amended (CCPA), we act as your service provider or processor. You disclose personal information to us only for the limited and specified business purpose of providing MNCL360 as described in section 2. We will:

• not sell or share the personal information, as those terms are defined in the CCPA;
• not retain, use or disclose it for any purpose, including any commercial purpose, other than that business purpose, or outside our direct business relationship with you;
• not combine it with personal information we receive from other sources, except as the law permits;
• comply with applicable obligations under those laws and give the same level of privacy protection they require;
• notify you if we can no longer meet our obligations under them;
• allow you to take reasonable and appropriate steps to ensure we use the personal information consistently with your obligations, and to stop and remediate unauthorised use; and
• flow these obligations down to our subprocessors by written contract.

We certify that we understand and will comply with these restrictions.

14. Changes

We may update this agreement to reflect changes in law or in our service. We will give you at least 30 days' notice by email of any change that materially reduces your protection. The current version is always at this address.

15. Contact

BusinessGenics d.o.o., Borongajska cesta 82, Zagreb, Croatia
privacy@mncl360.com