Data Processing Agreement

1. Parties and purpose

1.1. This Data Processing Agreement ("DPA") is between you, the developer who subscribes to Almudio Licensing, and Almog Harari, an Israeli exempt dealer (Osek Patur) trading as Almudio ("Almudio"). If the business moves to an Israeli company, this DPA may be transferred to it under section 23.3 of the Terms.

1.2. This DPA forms part of the Almudio Licensing Developer Terms ("Terms"). Words defined in the Terms have the same meaning here.

1.3. "Data Protection Law" means every data protection law that applies to the processing under this DPA, including the EU General Data Protection Regulation (GDPR), the UK GDPR and the UK Data Protection Act 2018, the Swiss Federal Act on Data Protection, and the Israeli Protection of Privacy Law 5741-1981 and the regulations made under it (including the Privacy Protection (Data Security) Regulations 5777-2017). For your buyers' personal data, you are the controller and Almudio is your processor (in Israeli terms, Almudio holds the data on your behalf). This DPA sets out the terms required by Article 28 of the GDPR and the UK GDPR, and by regulation 15 of the Israeli data security regulations. Israeli data protection law also applies to Almudio itself as the Israeli holder of the data, including the 2023 regulations on data transferred to Israel from the EEA.

1.4. This DPA does not cover your own account data (owner email, password hash and sessions). Almudio handles that data as a controller, as described in the Almudio Privacy Policy (almudio.com/privacy).

1.5. If this DPA and the Terms conflict on the processing of personal data, this DPA wins.

2. Subject matter and duration

2.1. Subject matter: Almudio processes your buyers' personal data to run the Service for you.

2.2. Duration: this DPA lasts as long as Almudio processes your buyers' personal data under the Terms. That includes the period after your account ends, until the data is deleted or returned under section 10.

3. Nature and purpose of processing

3.1. Almudio processes your buyers' personal data only to:

• create licence keys when your payment service reports a sale;
• revoke licences when your payment service reports a refund or chargeback;
• activate and deactivate licences per computer, and enforce your seat limits;
• run free trials;
• run your hosted buy page, installer downloads and lost-key lookup page;
• send licence emails to your buyers;
• show your data in the owner console, the read-only API and exports;
• protect the Service, for example by rate limiting;
• provide support to you.

3.2. The processing involves receiving, storing, organising, retrieving, sending, exporting and deleting data.

4. Types of personal data

4.1. Almudio processes these types of personal data about your buyers:

• email address;
• name (optional);
• licence id;
• order id from your payment service;
• product, issue date and expiry date of each licence;
• revoke flags;
• machine identifiers of activated computers (a hashed identifier created by your plugin), with activation and last-check times;
• IP addresses, stored only as salted hashes and only for rate limiting;
• raw webhook messages from your payment service, which may contain any buyer details your payment service chooses to include;
• licence emails waiting to be sent;
• download links (tokens);
• refund and chargeback flags on orders;
• a history of actions taken on each licence, such as when it was revoked or restored and by whom;
• free trial records: the hashed machine identifier, the trial licence id and the time the trial started.

You should configure your payment service so that its webhook messages contain only what the Service needs. Almudio does not use any other buyer details in those messages, and deletes them on the schedule in section 10.

4.2. Almudio does not ask for special category data (such as health data). You must not send it to the Service.

5. Categories of data subjects

5.1. Your buyers, meaning people who buy, activate or trial your products, or who use your buy page, download pages or lost-key lookup page.

6. Your instructions

6.1. Almudio processes your buyers' personal data only on your documented instructions, including with regard to transfers of personal data to a country outside the EU, EEA or UK. The Terms, this DPA (including the transfers described in section 13 and the sub-processors in Annex 2) and your settings in the owner console are your instructions.

6.2. If the law requires Almudio to process the data in another way, Almudio will tell you first, unless the law forbids that.

6.3. If Almudio believes an instruction breaks data protection law, Almudio will tell you immediately.

7. Almudio's obligations

7.1. Confidentiality. Almudio makes sure that anyone it authorises to process the data is bound by confidentiality. At the date of this DPA, the only person at Almudio with access is Almog Harari.

7.2. Security. Almudio uses the technical and organisational measures in Annex 1 to protect the data.

7.3. Records. Almudio keeps a written record of the processing it carries out for you, as GDPR Article 30(2) requires, and the database documents required by Israeli data security regulations.

7.4. Assistance with compliance. Taking into account the nature of the processing and the information available to it, Almudio will give you reasonable help with your duties on security, breach notification, data protection impact assessments and prior consultation with a supervisory authority. Help that you can do yourself in the owner console, and help with a personal data breach caused by Almudio, is free. For other help that takes significant time, Almudio may charge a reasonable fee based on time spent, and will tell you the estimate before starting.

7.5. Israeli data security. If Israeli data protection law applies to you, Almudio will, once a year when you ask, give you a short written report on how it meets this DPA and the Israeli data security regulations. Anyone Almudio authorises to access your buyers' data signs a written confidentiality undertaking, and will use the data only under this DPA.

8. Sub-processors

8.1. You give Almudio general authorisation to use sub-processors. The current sub-processors are listed in Annex 2.

8.2. Almudio will email you at least 14 days before adding or replacing a sub-processor. The email will name the sub-processor, what it does and where it processes data.

8.3. You can object to a new sub-processor on reasonable data protection grounds before the change takes effect. If Almudio cannot address your objection, you can cancel your subscription before the change takes effect, and Almudio will refund the fees you paid in advance for the time after your cancellation.

8.4. Almudio puts a written contract in place with each sub-processor that imposes data protection obligations no less protective than those in this DPA, in particular sufficient guarantees of appropriate security measures. Almudio remains fully responsible to you for its sub-processors' performance of those obligations.

8.5. Your payment service is not Almudio's sub-processor. You chose it, and it is your own processor. Paddle sells your Almudio Licensing subscription to you as Merchant of Record. It receives no data about your buyers and is not a sub-processor under this DPA.

9. Help with data subject requests

9.1. If a buyer contacts Almudio directly to exercise a data protection right, Almudio will pass the request to you and will not answer it unless you ask.

9.2. Almudio will help you answer requests from your buyers, for example by finding, exporting, correcting or deleting a buyer's records on your instruction. You can export all your data yourself at any time in JSON and CSV. In the owner console you can find a buyer's licences, revoke or restore a licence, free an activated computer and resend a licence email yourself. To correct a buyer's email or name, or to delete a buyer's records, email support@almudio.com.

10. Deletion or return of data

10.1. You can export all your data at any time while your account exists.

10.2. When the Service ends for you, you choose whether your buyers' personal data is returned to you or deleted. You return it to yourself by exporting it in JSON or CSV from the owner console. Export stays available while your account is suspended and until your data is deleted. If you do not export it, Almudio treats that as your choice to have it deleted. Almudio deletes your buyers' personal data automatically 30 days after your account ends, unless the law requires Almudio to keep it. Almudio will confirm the deletion by email if you ask.

10.3. Deleted data may remain in the database's automatic restore history for up to 30 more days, after which it can no longer be restored. Almudio uses that history only to recover from a technical failure, and if it ever restores it, Almudio deletes your buyers' personal data again.

10.4. During the subscription, the Service deletes some records automatically:

11. Personal data breaches

11.1. Almudio will notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting your buyers' data. If not all the information is available at that point, Almudio will send it in stages as it becomes available.

11.2. The notice will include, as far as Almudio knows at the time:

• what happened;
• the types and rough number of buyers and records affected;
• the likely consequences;
• what Almudio has done or will do about it;
• a contact for more information.

11.3. Almudio will take reasonable steps to contain the breach and will keep you updated.

12. Audits and information

12.1. Almudio will give you the information reasonably needed to show that it meets this DPA. You can ask for it at support@almudio.com.

12.2. Almudio will allow for and contribute to audits, including inspections, by you or an independent auditor you appoint who is bound by confidentiality. To keep this practical:

• you first ask in writing, and Almudio answers with documents and written answers;
• if those answers are not enough to show compliance, you may carry out an audit or inspection with at least 30 days' notice, during normal business hours in Israel, at your own cost, no more than once in any 12 months;
• these limits do not apply after a personal data breach affecting your buyers' data, or where a supervisory authority requires an audit;
• an inspection cannot give access to other developers' data or to Cloudflare's facilities. For Cloudflare, Almudio will pass on the audit reports and certifications Cloudflare makes available.

13. International transfers

13.1. Almudio is based in Israel. The European Commission has decided that Israel provides an adequate level of protection for personal data (Decision 2011/61/EU), and the UK recognises Israel as adequate under UK adequacy regulations. Transfers of your buyers' personal data from the EU, EEA or UK to Almudio therefore need no further safeguards while those decisions stay in force. If either decision stops applying, section 13.3 applies.

13.2. The Service runs on Cloudflare. The database (Cloudflare D1) is created in Cloudflare's EU jurisdiction, so its data is stored in the European Union. Other parts of the Service (Workers hosting, R2 file storage and Email Sending) are provided by Cloudflare, Inc., a company based in the United States. Transfers to Cloudflare are covered as described in section 13.4. Workers hosting and Email Sending run on Cloudflare's global network, so a request or an email can be handled in a Cloudflare data centre inside or outside the EU. R2 file storage holds only the product files you upload (such as installers) and no buyer personal data. It was created in Cloudflare's Eastern Europe location.

13.3. If a transfer of your buyers' personal data to Almudio is no longer covered by an adequacy decision, the EU Standard Contractual Clauses adopted by Commission Decision (EU) 2021/914 apply between you and Almudio and are incorporated into this DPA by reference: Module Two if you are a controller, or Module Three if you are a processor for someone else. For transfers under the UK GDPR, the UK International Data Transfer Addendum applies as well. Annexes 1 and 2 of this DPA complete the clauses' annexes, the clauses are governed by the law of Ireland, and disputes under them go to the courts of Ireland. If the clauses conflict with this DPA, the clauses win.

13.4. Almudio has agreed Cloudflare's Data Processing Addendum. Transfers to Cloudflare, Inc. in the United States rely on Cloudflare's certification under the EU-US Data Privacy Framework, its UK Extension and the Swiss-US Data Privacy Framework. If that certification stops applying, they rely on the EU Standard Contractual Clauses (Module Three, processor to processor) and the UK Addendum, which are part of Cloudflare's Data Processing Addendum.

14. Liability

14.1. Between you and Almudio, each party's liability under this DPA is subject to the limits in section 18 of the Terms, and one cap covers the Terms and this DPA together. This does not limit any right your buyers have directly under Data Protection Law.

15. Changes and term

15.1. Almudio may update this DPA when the law or the Service changes. Almudio will email you before a material change takes effect. A change will never reduce the protection this DPA gives your buyers' personal data, unless the law requires it.

15.2. This DPA ends when Almudio no longer holds any of your buyers' personal data.

Annex 1: Security measures

• Each developer's data is kept separate. Automated tests check that one account cannot read another's data.
• Passwords for developer accounts are stored only as hashes.
• Payment service secrets (webhook secrets and API keys) are stored encrypted.
• Licences are signed with Ed25519. Private signing keys are stored encrypted and never leave the server.
• Buyer IP addresses are stored only as salted hashes, only for rate limiting, and deleted after 2 days.
• Machine identifiers are stored as hashed identifiers created by the plugin.
• Records are deleted automatically on the schedule in section 10.4.
• Within Almudio, only Almog Harari has access to the data.

• Owner console sessions are stored only as hashes, and every change made in the console needs a CSRF token.
• Console logins are rate limited per IP address, per email and per device.
• The lost key lookup page is rate limited per IP address and per email.

Annex 2: Sub-processors

Contact

Almudio
Email: support@almudio.com
Website: almudio.com/licensing
Business: Almudio (Almog Harari, Osek Patur), Israel. Registration details are available on request to support@almudio.com.
Privacy contact: Almog Harari, support@almudio.com