Menelier Data Processing Addendum (DPA)

Effective date: 1 September 2026
Version: 2026-09-01-professional-legal-review

This Data Processing Addendum ("DPA") forms part of the Menelier Terms of Service or another agreement (the "Agreement") between the customer identified in the Agreement ("Customer") and Martin Mayer, operator of Menelier ("Menelier").

1. Scope and roles

This DPA applies when Menelier processes personal data on behalf of Customer in providing the Menelier service.

Customer is the controller and Menelier is the processor where Customer uploads, creates, imports, publishes or otherwise submits personal data concerning its staff, contractors, suppliers, guests or other individuals ("Customer Personal Data").

Menelier remains an independent controller for data it processes for its own purposes, including account administration, direct billing, tax records, security, fraud prevention, service communications and its own legal compliance. Those activities are covered by the Menelier Privacy Policy and are outside this DPA.

2. Customer instructions

Menelier will process Customer Personal Data only:

• to provide, secure, maintain and support the service under the Agreement;
• according to Customer's documented use and configuration of the service;
• on additional documented instructions agreed by the parties; or
• where processing is required by applicable law, in which case Menelier will inform Customer before processing unless the law prohibits notice.

The Agreement, this DPA, Customer's use of the service and support requests constitute documented instructions.

Customer is responsible for ensuring that its instructions and Customer Personal Data comply with applicable law, that it has a lawful basis for the processing, and that it gives required information to data subjects.

3. Details of processing

The subject matter, nature, purpose and duration of processing, together with the data categories and data subjects, are described in Annex 1.

4. Confidentiality

Menelier will ensure that people authorised to process Customer Personal Data are bound by confidentiality obligations and receive access only to the extent necessary for their work.

5. Security

Taking account of the state of the art, implementation costs, processing context and risks, Menelier will maintain appropriate technical and organisational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

The current measures are described in Annex 2. Menelier may update them provided the overall level of protection is not materially reduced.

6. Subprocessors

The Customer grants Menelier general written authorisation to engage subprocessors necessary to provide the Service. The subprocessors authorised as of the Effective Date are listed in Annex 3. Menelier will notify the Customer in writing at least 30 days before adding or replacing a subprocessor, giving the Customer an opportunity to object on reasonable data protection grounds.

Menelier will:

• require each subprocessor by written agreement to assume the same data-protection obligations imposed on Menelier by this DPA, to the extent applicable to the subprocessor’s processing, including the requirements of Article 28(4) GDPR;
• remain responsible for the subprocessor's performance of its data-protection obligations to the extent required by applicable law; and
• give reasonable advance notice of a new subprocessor through the published list, email or the service.

Customer may object to a new subprocessor on reasonable data-protection grounds within 15 days after notice. The parties will work in good faith on a reasonable solution. If no solution is available, either party may terminate the affected service; any refund is governed by the Agreement and applicable law.

7. Assistance to Customer

Considering the nature of processing and information available to Menelier, Menelier will reasonably assist Customer with:

• responding to requests from data subjects;
• security and personal-data-breach obligations;
• data protection impact assessments; and
• prior consultation with a supervisory authority where required.

If Menelier receives a request directly from a data subject concerning Customer Personal Data, Menelier will redirect the requester to Customer where reasonably possible and will not independently fulfil the request unless Customer instructs it or law requires it.

Customer will reimburse reasonable costs for unusually extensive assistance not caused by Menelier's breach, if agreed in advance.

8. Personal data breaches

Menelier will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. The notice will include available information reasonably needed for Customer's legal obligations, which may be provided in phases as the investigation develops.

Menelier's notification is not an admission of fault or liability.

Security contact: info@menelier.com

9. Deletion and return

During the service term, Customer may use available export and deletion functions.

After termination or expiry, Menelier will, at Customer's choice, delete or return Customer Personal Data, unless Union or Member State law requires storage. Data in protected backups is deleted through the normal backup cycle and remains subject to this DPA while retained.

Operational deletion period: Self-service user deletion has a 14-day cancellation period. Verified account-level deletion instructions are handled without undue delay and normally within 30 days, subject to account ownership, legal retention and technical dependencies.
Backup retention period: 35 days

Menelier may retain controller data, such as invoices, account security records and proof of legal acceptance, under the Privacy Policy and applicable law.

10. Audits and information

Menelier will make available information reasonably necessary to demonstrate compliance with Article 28 GDPR. Customer may request relevant security documentation or independent reports where available.

If that information is insufficient, Customer may conduct an audit no more than once per year, except after a material incident or where a supervisory authority requires otherwise. Audits must:

• be arranged with reasonable advance notice;
• occur during normal business hours;
• avoid disruption and access to other customers' data;
• be performed by Customer or by a qualified independent auditor mandated by Customer, in each case subject to appropriate confidentiality obligations; and
• respect Menelier's reasonable security requirements.

Customer bears its audit costs unless the audit identifies a material breach by Menelier.

11. International transfers

Menelier will not transfer Customer Personal Data outside the European Economic Area or another originating region in violation of applicable transfer rules.

Where required, the parties will rely on an adequacy decision, the European Commission Standard Contractual Clauses, the EU-U.S. Data Privacy Framework for an eligible recipient, or another valid safeguard. Applicable transfer modules and supplementary measures will be incorporated by reference or made available on request.

Primary hosting region: Czech Republic
Transfer mechanism details: Primary hosting and encrypted backup storage are within the European Union. Optional AI processing may involve transfers through OpenAI and its subprocessors. Where a transfer outside the EEA requires a safeguard, Menelier relies on the transfer mechanisms made available under the applicable OpenAI data-processing terms, including Standard Contractual Clauses or an applicable adequacy mechanism, as relevant.

12. Compliance concerns

Menelier will promptly inform Customer if, in its reasonable opinion, an instruction infringes applicable data-protection law. Menelier may suspend the affected processing until the parties resolve the issue.

13. Liability and order of precedence

Liability under this DPA is subject to the liability provisions of the Agreement, except where applicable law requires otherwise.

If this DPA conflicts with the Agreement on processing Customer Personal Data, this DPA controls. If applicable Standard Contractual Clauses conflict with this DPA, those clauses control for the relevant transfer.

14. Term

This DPA remains effective while Menelier processes Customer Personal Data on behalf of Customer.

Annex 1 - Processing description

Annex 2 - Technical and organisational measures

• transport encryption using HTTPS/TLS;
• password hashing using current PHP password hashing;
• role-based access and customer workspace separation;
• restricted superadmin and production access;
• CSRF protection, secure session handling and email verification;
• signed Stripe webhooks and payment event validation;
• rate limiting, abuse prevention and audit/security logging;
• private storage for non-public uploads and controlled public publication;
• database, file and backup access restrictions;
• vulnerability and dependency maintenance process: Publicly reported vulnerabilities affecting components used by Menelier are assessed based on their severity and relevance. Security patches and dependency updates are applied as part of ongoing maintenance, with material security issues prioritised for remediation.;
• backup frequency and restore testing: Menelier creates a daily encrypted application backup covering the database and private uploads, keeps a remote encrypted copy on WEDOS Disk, monitors backup freshness and retains application backups for 35 days. The restore-validation procedure has successfully decrypted and inspected a production backup archive; a recurring full disaster-recovery exercise is not currently guaranteed.;
• incident response and escalation: Security incidents are handled by the Operator on a case-by-case basis, including containment, impact assessment, remediation and documentation. Affected Customers and competent authorities are notified where required by applicable law or contract.;
• staff/contractor access review and offboarding: Administrative access is restricted to the Operator and any specifically authorised contractors on a need-to-know basis. Access rights are reviewed when roles or engagements change and are revoked without undue delay when no longer required.;
• data deletion and retention controls: Customer Personal Data is deleted or anonymised following a valid deletion request or termination of the Service, except where continued retention is required by applicable law or is necessary for the establishment, exercise or defence of legal claims. Self-service user deletion includes a 14-day cancellation period. Deleted data may remain in encrypted backups for up to 35 days.;
• business continuity and recovery objectives: Service recovery uses WEDOS hosting, daily encrypted application backups and a separate encrypted WEDOS Disk copy. Menelier does not currently guarantee a specific recovery time objective (RTO) or recovery point objective (RPO), and recovery is performed on a reasonable-efforts basis.

Annex 3 - Initial subprocessors

Annex 4 - Parties

Customer / controller

The customer identified in the Agreement or Menelier account.

Menelier / processor

• Legal name: Martin Mayer
• Address: Holubice 366, 68351 Holubice
• Company ID: 73507351
• Tax ID (DIČ): CZ8003301680
• Contact: info@menelier.com
• Telephone: +420 724 548 554