Data processing agreement

Controller (“Client”): the customer as named in the main contract.
Processor (“Contractor”): Mike Möhler & Jamy Fritzler GbR (“MJF Partners”), Markgrafenstraße 147, 79211 Denzlingen, represented by Mike Möhler and Jamy Fritzler.

The Contractor processes personal data on behalf of the Client in order to provide the services agreed in the main contract, in particular customer service, returns and complaint management. The term corresponds to the term of the main contract.

• Purpose: answering customer enquiries, handling returns and complaints, preparing decisions, reporting to the Client.
• Types of data: names, contact details, order and shipping data, content of communications, details of returns and refunds.
• Data subjects: the Client’s customers and prospective customers.
• Special categories under Art. 9 GDPR are not deliberately processed. If data subjects share such data of their own accord, it is only used to deal with their request.

The Contractor only processes the data on documented instructions from the Client. The rulebook in the customer portal counts as a documented instruction. If the Contractor considers an instruction to be unlawful, it informs the Client without delay.

All persons with access to the data are bound to confidentiality and have been instructed in data protection.

The Contractor takes measures under Art. 32 GDPR, including: role-based access rights, separation of data from different clients, encrypted transmission, encrypted storage of access keys, logging of all actions, regular data backups. Details are set out in Annex 1. [Annex 1: prepare description of technical and organisational measures]

The Client consents to the use of the sub-processors named in Annex 2. The Contractor gives advance notice in text form of any new or replaced sub-processors; the Client may object for good cause within [14] days.

Annex 2 (as of November 2026):

• Supabase Inc. – database, sign-in; server location [region]
• Postmark (ActiveCampaign, LLC, USA) – sending and receiving email
• Anthropic, PBC (USA) – automated text processing
• Meta Platforms Ireland Ltd. – WhatsApp, Instagram, Facebook (only if used)
• [Hosting provider of the application]

Transfers to third countries only take place under the conditions of Art. 44 ff. GDPR.

The Contractor supports the Client with requests from data subjects (Art. 12–22 GDPR), data protection impact assessments and notification obligations. It reports personal data breaches without delay, where possible within 24 hours of becoming aware of them.

After the end of the main contract, the Contractor deletes the data or returns it at the Client’s choice, unless there is a statutory obligation to retain it. The log of actions is kept for [period].

The Contractor provides the information necessary to demonstrate compliance with its obligations and enables audits by the Client or an appointed auditor after reasonable prior notice.

In the event of conflict, this agreement takes precedence over the main contract as regards data protection. Changes must be in text form.