MonkeyMachine — DATA PROCESSING ADDENDUM (DPA, EN)

We act as a processor for tenant content/end‑user data; we act as a controller for account/billing/security/telemetry.

We process data strictly under documented instructions of the Customer (tenant owner/admin) for the purpose of providing the Services.

Public register at /legal/subprocessors; 30‑day prior notice of changes; Customer's right to object/disable where feasible without impairing core functionality.

EU/EEA/UK — SCC/UK Addendum; RU — by consent/contract/law.

TOMs as per our Security Policy (encryption, access control, RLS, backups/DR, logging, testing).

Notify within 72 hours of becoming aware; provide rolling updates.

We assist Customer in fulfilling DSARs.

Questionnaire + reports (TOMs, pen‑test summary, scans). On‑site only for justified risk/incident, max once per year, at Customer's cost.

Upon request, export and deletion per Retention timelines; exception for mandatory copies/backups until rotation.

Subject to caps defined in the Terms of Use.