Data Processing Agreement

Processor: moonlight global s. r. o., Nemocničná 615/45, 924 01 Galanta, Slovakia, company registration number / IČO 54090067.

Controller: the Company that holds the company account, acting through its Owner.

Company-side data (we are the Company's processor). We process the data the Company gives us to run its seats: the company name, the emails and roles of its Owner, Admins, and invited people, seat and invite status, membership events (joined, removed, left), and the billing state of its Plan.

Members' own accounts (we are a controller in our own right). Each Member has their own moonScan account. We process their scans, readings, and history as the controller, under the Privacy Policy, and for the Member's own purposes. The Company is not a controller or joint controller of that data, cannot give us instructions about it, and does not receive it.

Billing. Stripe handles card and payment data and acts under its own terms. We keep invoice and billing-state records as the controller of our own accounting and tax records.

What we do not receive from the Company. We do not need and the Company must not send us health information about its people, HR or performance records, location data, or anything beyond the details listed above.

What the Company does not receive. The Company receives no individual's readings, scans, or scan activity. It sees this and nothing more:

Your company can see that you hold a seat: your email, your role and whether you have joined.

It also sees anonymous team averages for completed weeks, and only once at least 5 people contribute to them.

It never sees your readings, your scans, or when you scan. You can leave at any time and keep your own scan history.

Anonymous team averages are calculated by moonScan from Members' readings, for completed weeks, and only for groups of at least 5 people. Past weeks do not change when someone joins or leaves, and no average comes with a name, an identifier, or a per-person count.

• Subject matter and purpose: providing moonScan for Business: managing seats and invites, syncing billing state, and showing anonymous team averages to the Owner and Admins.
• Nature: storing, organising, emailing invites, and displaying seat and billing information.
• Categories of data subjects: the Company's Owner, Admins, invited people, and Members.
• Types of personal data: email address, role, seat and invite status, join and removal dates and reasons, company name, and Plan billing state.
• Special category data: none is requested from or received from the Company.
• Duration: while the company account exists, then as set out in section 10.

We process company-side data only on the Company's documented instructions: the Business Terms, this DPA, and the Company's use of the company dashboard. If we believe an instruction breaks the law, we will tell the Company. We may also process data where the law requires it.

The Company is responsible for having a lawful basis to give us the emails and roles of its people, and for telling them what the Company can and cannot see.

Only team members who need access to run, support, and secure the service can reach company-side data. moonScan staff who support a Company see seats, emails, billing state, membership events, and the same anonymous team averages as the Company. Their views never return a reading, a scan, or an identifier, and support actions on a company account are logged.

We use reasonable technical and organisational measures, including:

• access controls and restricted, role-based admin access;
• encryption of data in transit;
• monitoring for misuse;
• invite links that contain a single-use token. We store only a one-way hash of the token, and the link carries it in the part of the address that browsers do not send to servers;
• a minimum group size and fixed past weeks for team averages, so they cannot be traced to one person.

moonScan does not claim any security certification, such as ISO 27001 or SOC 2. No system is perfectly secure.

The Company authorises the sub-processors below for company-side data. They process it only to provide their service to us.

• Stripe: payments, subscriptions, invoices, and the billing portal.
• Resend: sending invite emails (the invited person's email address, the company name, and the invite link).
• Replit: hosting and database infrastructure.
• Google: sign-in with Google, for people who choose it.

Our support chat provider and our website analytics (see the Privacy Policy) do not receive company-side data. We will update this list before a new sub-processor handles company-side data and, where required, tell the Owner by email. The Company may object by contacting viktor@moonlightokuliare.sk.

Some sub-processors may process data outside the European Economic Area. Where required, we use safeguards such as adequacy decisions or Standard Contractual Clauses, as described in section 11 of the Privacy Policy.

Members' requests about their own moonScan accounts are handled by us as the controller. If a person asks us about company-side data, we will pass the request to the Company and help it answer within reason.

If we become aware of a personal data breach affecting company-side data, we will tell the Owner without undue delay and share what we know, so the Company can meet its own duties.

• Company, seat, invite, and membership records are kept while the company account exists. A removed seat stays in the history (email, role, removal date, and reason), so billing and past team averages stay consistent.
• Invoice and billing records are kept as long as tax and accounting law requires.
• Anonymous team averages for past weeks stay as they are.

The Owner can ask us to delete the company account by writing to viktor@moonlightokuliare.sk. Please end the Plan first. We then delete or anonymise company-side data, except what we must keep for legal, tax, security, or dispute reasons. Copies in backups may remain until the backups expire. Deleting a company account does not delete any Member's own account, scans, or history.

On reasonable written request we will give the Company the information it needs to check that we follow this DPA. Any audit is agreed in advance, limited in scope, and must not expose other customers' data or any person's readings.

Section 12 of the Business Terms (Liability and governing law) applies to this DPA. Nothing here limits liability where it would be unlawful to do so.

Privacy, data protection, and security matters, including reports: viktor@moonlightokuliare.sk

Purchase, billing, and invoice help: erik@moonlightbrand.sk