11.1 Data Controller and Data Processor Roles

For the purposes of the GDPR and other applicable data protection laws:

(a) The Subscriber (and the Organization it represents, where applicable) acts as the Data Controller with respect to the Personal Data of its employees, contractors, and other individuals whose data is processed through the Platform. The Subscriber determines the purposes and means of processing such Personal Data.

(b) Moshi Software acts as a Data Processor on behalf of the Subscriber with respect to the Personal Data described in paragraph (a) above. Moshi Software processes such Personal Data only on the documented instructions of the Subscriber, unless required to do so by applicable law.

(c) For Subscriber account data (such as the Subscriber's name, email address, billing information, and account preferences), Moshi Software acts as a Data Controller, processing such data for the purposes of account management, service delivery, billing, and communication.

11.2 Legal Basis for Processing

Moshi Software processes Personal Data on the following legal bases, as applicable:

(a) Contract Performance (Article 6(1)(b) GDPR): Processing necessary for the performance of the contract between Moshi Software and the Subscriber;

(b) Legitimate Interest (Article 6(1)(f) GDPR): Processing necessary for the legitimate interests of Moshi Software, including platform security, fraud prevention, service improvement, and analytics;

(c) Legal Obligation (Article 6(1)(c) GDPR): Processing necessary for compliance with legal obligations to which Moshi Software is subject;

(d) Consent (Article 6(1)(a) GDPR): Where specific consent has been obtained from the data subject for a particular processing activity.

11.3 Types of Personal Data Processed

The following categories of Personal Data may be processed through the Platform:

(a) Account Data: Name, email address, password (hashed), phone number, language preference, profile picture, and billing information;

(b) Employee Identification Data: Full name, date of birth, place of birth, nationality, gender, national register number (rijksregisternummer / numéro de registre national), and identity document information;

(c) Contact Data: Residential address, email address, and phone number;

(d) Financial Data: IBAN (International Bank Account Number), bank name, and wage information;

(e) Employment Data: Job title, function description, contract type, contract dates, working hours, shift schedules, hourly wage, and employment status;

(f) Time and Attendance Data: Clock-in and clock-out times, break durations, total working hours, overtime, and attendance records;

(g) Biometric-like Data: Digital signatures captured through the Platform's signature pad functionality;

(h) Communication Data: Messages, notifications, and communication preferences;

(i) Technical Data: IP address, browser type, device information, operating system, and access logs.

11.4 Special Categories of Data

National register numbers (rijksregisternummer / numéro de registre national) are considered sensitive identifiers under Belgian law (Law of 8 August 1983 organising a National Register of natural persons). Subscribers and Users who input or process national register numbers through the Platform represent and warrant that they have a valid legal basis for doing so and that they comply with all applicable Belgian laws and regulations governing the use of national register numbers. Moshi Software processes national register numbers solely on the instructions of the Subscriber and for the purposes specified by the Subscriber.

11.5 Data Storage and Security

Personal Data processed through the Platform is stored on infrastructure provided by Supabase, Inc., with data centers located within the European Union. Moshi Software implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk of processing, including but not limited to: encryption of Personal Data in transit (TLS/SSL) and at rest; access controls and authentication mechanisms; regular security assessments and vulnerability testing; logging and monitoring of access to Personal Data; employee training on data protection and information security; and incident response procedures.

11.6 Data Retention

Moshi Software retains Personal Data for the following periods:

(a) Active Account Data: For the duration of the Subscriber's subscription, plus a period of thirty (30) days following account termination to allow for data export;

(b) Employment Contracts and Documents: For a minimum of five (5) years following the end of the employment relationship, or longer if required by applicable law (including Belgian social legislation which may require retention of certain employment documents for up to ten (10) years);

(c) Timeclock and Attendance Records: For a minimum of five (5) years, in accordance with Belgian social legislation requirements;

(d) Billing and Financial Records: For a minimum of seven (7) years, in accordance with applicable tax and accounting laws;

(e) Technical Logs: For a maximum of twelve (12) months from the date of creation.

After the applicable retention period expires, Personal Data will be securely deleted or anonymized, unless longer retention is required by applicable law or is necessary for the establishment, exercise, or defence of legal claims.

11.7 Sub-Processors

Moshi Software engages the following categories of sub-processors to assist in providing the Services:

(a) Cloud Infrastructure: Supabase, Inc. (database hosting and authentication services, EU data centers);

(b) Hosting and CDN: Vercel, Inc. (application hosting and content delivery);

(c) Email Delivery: Third-party email service providers for transactional and notification emails;

(d) Payment Processing: Third-party payment processors for subscription billing;

(e) Analytics: Third-party analytics providers for platform usage analytics.

Moshi Software ensures that all sub-processors are bound by data processing agreements that provide at least the same level of data protection as these Terms. A current list of sub-processors with their specific identities and locations is available upon request by contacting info@askmoshi.com. Moshi Software will notify Subscribers of any intended changes to sub-processors, giving Subscribers the opportunity to object to such changes.

11.8 International Data Transfers

Personal Data is primarily processed and stored within the European Economic Area (EEA). Where Personal Data is transferred to countries outside the EEA (including to Moshi Software's headquarters in Dubai, United Arab Emirates, for administrative and support purposes), Moshi Software ensures that appropriate safeguards are in place in accordance with Chapter V of the GDPR, including but not limited to: Standard Contractual Clauses (SCCs) as approved by the European Commission; adequacy decisions issued by the European Commission, where applicable; and supplementary measures as recommended by the European Data Protection Board (EDPB) to ensure an essentially equivalent level of data protection. Users may request a copy of the applicable transfer safeguards by contacting info@askmoshi.com.

11.9 Data Subject Rights

Data subjects whose Personal Data is processed through the Platform have the following rights under the GDPR, subject to the conditions and limitations set forth in the GDPR:

(a) Right of Access (Article 15): The right to obtain confirmation as to whether Personal Data is being processed and to access such data;

(b) Right to Rectification (Article 16): The right to have inaccurate Personal Data corrected and incomplete data completed;

(c) Right to Erasure (Article 17): The right to have Personal Data erased ("right to be forgotten") under certain circumstances;

(d) Right to Restriction of Processing (Article 18): The right to restrict the processing of Personal Data under certain circumstances;

(e) Right to Data Portability (Article 20): The right to receive Personal Data in a structured, commonly used, and machine-readable format;

(f) Right to Object (Article 21): The right to object to the processing of Personal Data based on legitimate interests or direct marketing;

(g) Right Not to Be Subject to Automated Decision-Making (Article 22): The right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects the data subject.

For Personal Data for which the Subscriber is the Data Controller, data subjects should direct their requests to the Subscriber in the first instance. Moshi Software will assist the Subscriber in responding to data subject requests to the extent technically feasible and as required by the GDPR. For Personal Data for which Moshi Software is the Data Controller (account data), data subjects may exercise their rights by contacting info@askmoshi.com. Moshi Software will respond to valid data subject requests within thirty (30) days, or within the timeframe required by applicable law.

11.10 Data Breach Notification

In the event of a Personal Data breach (as defined in Article 4(12) of the GDPR), Moshi Software will:

(a) Notify affected Subscribers without undue delay and, in any event, within seventy-two (72) hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons;

(b) Provide Subscribers with sufficient information to enable them to meet their own notification obligations under Articles 33 and 34 of the GDPR, including a description of the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences of the breach, and the measures taken or proposed to be taken to address and mitigate the breach;

(c) Cooperate with Subscribers and supervisory authorities in the investigation and resolution of the breach;

(d) Document all breaches in accordance with Article 33(5) of the GDPR.

11.11 Data Protection Impact Assessments

Where a Subscriber is required to carry out a Data Protection Impact Assessment (DPIA) under Article 35 of the GDPR in relation to its use of the Platform, Moshi Software will provide the Subscriber with reasonable assistance and information necessary to conduct the DPIA, taking into account the nature of the processing and the information available to Moshi Software.

11.12 Data Processing Agreement

Subscribers who require a formal Data Processing Agreement (DPA) in accordance with Article 28 of the GDPR may request one by contacting info@askmoshi.com. The DPA will set forth the subject matter, duration, nature, and purpose of the processing, the types of Personal Data processed, the categories of data subjects, and the obligations and rights of the Data Controller.

11.13 Cookies and Tracking Technologies

The Platform uses cookies and similar tracking technologies for the following purposes:

(a) Essential/Strictly Necessary Cookies: Required for the Platform to function, including session management, authentication, and security. These cookies cannot be disabled.

(b) Preference Cookies: Used to remember User preferences such as language settings and theme preferences.

The Platform does not use advertising or marketing cookies. The Platform does not engage in cross-site tracking or sell Personal Data to third parties. By using the Platform, you consent to the use of essential and preference cookies as described above.

11.14 Supervisory Authority

Data subjects in the European Union have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of their habitual residence, place of work, or place of the alleged infringement, if they consider that the processing of their Personal Data infringes the GDPR. A list of EU supervisory authorities is available on the European Data Protection Board's website.