Data Processing Addendum

Version of 12 October 2026. The merchant terms are three documents read together: the General Terms and Conditions for Merchants, the Service Terms: Merchant of Record and the Data Processing Addendum. New accounts accept them during sign-up. If your account accepted an earlier version, its owner is asked to accept this one in the dashboard, and from 16 November 2026 it must be accepted to keep using Moonbase. The version your account accepted is under Account settings > Terms and conditions.

1. About this Addendum

This Data Processing Addendum (the "DPA") is part of the Agreement. It applies when we process Processor Data on your behalf, as described in section 13 of the General Terms, and sets out the terms required by Article 28 of the GDPR. Words defined in the General Terms and in the GDPR have the same meaning here. If the DPA and the rest of the Agreement conflict on the processing of Processor Data, the DPA prevails.

2. Roles and instructions

You are the controller of the Processor Data, and we are your processor. Annex 1 describes the processing.

We process Processor Data only on your documented instructions, unless the law requires otherwise, in which case we will tell you first unless the law forbids it. Your instructions are the Agreement and what you set up and do through the Service Dashboard and the Service API, such as importing or deleting customers, sending campaigns, setting up groups, and connecting integrations, webhooks and license generators. We will tell you if we believe an instruction breaks data protection law.

We do not sell Processor Data. We use it for purposes of our own only to keep the Service and our payments secure and working, to detect and prevent fraud and abuse, to work out usage fees, and to produce data that does not identify anyone. For those purposes we are a controller, as described in our Privacy Policy. Data that is both Processor Data and part of the record of a Transaction, such as the Buyer's name on an order, is also Controller Data.

3. Our people

We give access to Processor Data only to people who need it to provide or support the Service, and they are bound by confidentiality.

4. Security

We maintain the technical and organisational measures in Annex 2, and may improve them over time as long as the overall level of protection does not decrease.

5. Subprocessors

You authorise us to use the subprocessors listed in Annex 3. We will tell you at least 30 days before we add or replace a subprocessor, by email to the owner of your Account. You may object on reasonable data protection grounds within that time. If we cannot address your objection, you may close your Account before the change takes effect, and section 10 of the General Terms applies.

We bind each subprocessor to data protection obligations that are at least as protective as this DPA, and we remain responsible to you for them.

Services that you choose to connect, such as email marketing tools, iLok, your own license generators or the destinations of your webhooks, are not our subprocessors. When you connect them, you instruct us to send them the data they need, and your own arrangements with them govern what they do with it.

6. Transfers outside the EEA

We and our subprocessors may process Processor Data outside the European Economic Area only where the European Commission has found that the country gives adequate protection, including under the EU-US Data Privacy Framework, or under the European Commission's standard contractual clauses or another safeguard the GDPR allows.

7. Helping you

The Service Dashboard lets you view, correct, export and delete your customers' data, which helps you respond to requests from the people concerned. If we receive such a request about Processor Data, we will refer the person to you, or pass the request on to you, without undue delay, and will not answer it ourselves unless you ask us to.

We will give you reasonable help with data protection impact assessments and consultations with supervisory authorities that concern the Service, taking into account the information available to us.

8. Personal data breaches

We will tell you without undue delay, and at the latest within 48 hours, after we become aware of a personal data breach affecting Processor Data. We will give you the information we have that you need to meet your own obligations, and keep you updated as we learn more.

9. Deletion and return

While your Account is open, you can export and delete Processor Data through the Service Dashboard. When you delete a customer, we delete their Processor Data from our live systems within 30 days.

When your Account closes, you may ask us for an export of your Processor Data within 30 days after the Closure Date. After those 30 days, we delete the Processor Data from our live systems, except the identifiers of the licenses and device activations that were revoked, deleted or have expired, which we keep as Controller Data so that the licenses your Buyers have activated keep working, and no others. Copies in our backups, and in the history our data warehouse keeps, are deleted as they expire, within 12 months. We keep the data that we must keep by law, such as the records of Transactions, as Controller Data.

10. Audits

We will make available to you the information you need to show that we comply with this DPA and Article 28 of the GDPR, and we will allow for and contribute to audits, including inspections, carried out by you or by an auditor you mandate.

To keep audits proportionate:

• you will first rely on our documentation and our written answers to your questions, where they are enough to show compliance;
• you will give us at least 30 days' notice of an audit or inspection, unless a supervisory authority requires otherwise or a personal data breach has affected your Processor Data;
• audits take place no more than once a year, with the same exceptions;
• they take place during business hours, without unreasonably disrupting our operations or putting the security or confidentiality of other merchants' data at risk;
• your auditor must be bound by confidentiality and must not be a competitor of ours; and
• you bear the costs of the audit, unless it shows that we have materially breached this DPA.

11. Liability and duration

The limitations of liability in the General Terms apply to this DPA, to the extent the law allows. This DPA lasts for as long as we process Processor Data for you.

Annex 1: The processing

Whose data: your customers and prospective customers, such as Buyers, people who create an account in your customer portal or sign up for your newsletter, trial users, license holders, recipients of your emails and campaigns, and anyone else you add to the Service.

What data:

• identity and contact details: name, business name, email address, phone number, address, tax or VAT number;
• account data: password (stored as a hash), sign-in times, communication preferences and the consents you collect;
• licenses, device activations and trials: the products licensed, device names, device identifiers derived from the device, operating system and app versions, and the IP address and approximate location of the most recent validation;
• downloads and voucher redemptions;
• emails sent in your name: their content, delivery status, and when they were opened and which links were clicked;
• customer groups, segments and the rules that place customers in them;
• analytics events about your customers' activity in the Service; and
• custom properties you add, and data you send or receive through integrations, webhooks and license generators.

You must not use the Service to process special categories of personal data, such as health data, or data about children under 16.

What we do with it: store it, and use it to provide the features of the Service you use: customer accounts and the customer portal, license delivery, activation and validation, downloads, emails and campaigns, groups and segments, analytics, search in the Service Dashboard, imports and exports, and integrations.

For how long: for as long as the Agreement lasts and you keep the data, subject to section 9. Unless you delete it earlier, we keep the content of emails for 12 months, analytics events for 25 months, and logs of integrations and webhooks for 90 days.

Annex 2: Security measures

• The Service runs on Amazon Web Services in the EU (Ireland). Data is encrypted in transit with TLS, and encrypted at rest by our hosting providers.
• Access to production systems and data is limited to the staff who need it.
• Changes to the data in the Service are recorded in an audit log, with who made them and when, including changes our staff make while signed in to a merchant's Account.
• Customer passwords are stored only as salted hashes. Our credentials for the services we use are kept in a dedicated secrets store. The most sensitive identifiers, such as national tax numbers collected in Verification, are encrypted with keys that are themselves protected by a dedicated key in a key management service.
• Product files and Verification documents uploaded to the Service are scanned for malware.
• The Service is protected by a web application firewall and rate limits, and its systems are monitored for errors and abuse.
• Our main databases can be restored to any point in the last 35 days, and we keep further backups for up to 12 months.
• We assess our subprocessors before we use them, and bind them by contract.
• We have a process for detecting, handling and reporting personal data breaches.

Annex 3: Subprocessors

• Amazon Web Services: hosting, databases, file storage, email sending and security, in the EU (Ireland), with content delivery from locations worldwide.
• Google Cloud: data warehouse (BigQuery) in the EU (Belgium), and address autocomplete (Google Maps Platform).
• Cloudflare: delivery of product downloads.
• Tinybird: analytics, in the EU.
• Typesense: customer search in the Service Dashboard, in the EU (Germany).
• Sentry: error monitoring of the Service Dashboard, the customer portal and checkout, in the EU (Germany).
• PostHog: product analytics of the Service Dashboard, which can include customer details shown on screen, in the EU (Germany).
• Gravatar: profile pictures shown next to customers in the Service Dashboard, looked up from a hash of the customer's email address, in the United States.