Data Processing Agreement

1. Scope and Roles

The Controller determines the purposes and means of processing personal data submitted to or generated through the Service. Makeen processes that data only on documented instructions from the Controller, including configuration of forms, workflows, retention, exports, and integrations.

2. Processing Details

• Subject matter: provision of the Mauqe platform.
• Duration: for the term of the subscription and any retention period described in the Privacy Policy or account settings.
• Nature and purpose: hosting, storage, transmission, display, workflow execution, notifications, analytics configured by the Controller, backups, and support.
• Categories of data subjects: Controller's employees, customers, vendors, and other end users as determined by the Controller.
• Types of personal data: contact details, identifiers, employment or business data, form responses, attachments, and other data the Controller chooses to collect.

3. Processor Obligations

• Process personal data only on Controller instructions unless required by law.
• Ensure personnel are bound by confidentiality obligations.
• Implement appropriate technical and organizational security measures.
• Assist the Controller with data subject requests where feasible.
• Notify the Controller without undue delay after becoming aware of a personal data breach affecting Controller data.
• Delete or return personal data upon termination, subject to legal retention requirements and backup cycles.
• Make available information reasonably necessary to demonstrate compliance and allow audits upon reasonable notice, no more than once annually unless required by a regulator.

4. Subprocessors

The Controller authorizes Makeen to engage subprocessors for hosting, infrastructure, email, payments, monitoring, and AI services. A current list is available on request at privacy@mauqe.com. We impose data protection obligations on subprocessors substantially similar to this DPA.

5. International Transfers

Where required, Makeen will implement appropriate safeguards for cross-border transfers, such as standard contractual clauses or equivalent mechanisms permitted by applicable law.

6. Controller Obligations

The Controller is responsible for lawful collection, notices, consents, accuracy, retention limits, and rights of data subjects. The Controller will not submit special categories of data or regulated health/financial data through the Service unless legally permitted and appropriately secured.

7. Liability

Each party's liability under this DPA is subject to the limitations and exclusions in the Terms of Use, except where prohibited by applicable data protection law.