Data Processing Agreement (DPA)

Data-processing terms under Art. 28 GDPR between Mayk Biletti · Sportplatzgasse 32b · 2443 Leithaprodersdorf · Österreich as processor and the workspace owner as controller.

Subject matter

Processing of personal data such as contacts, recipients, newsletter subscribers, listing data, and account data within the BLUN platform.

Duration

The processing runs for the duration of the main service agreement.

Sub-processors

• Hetzner Online GmbH for EU hosting.
• Stripe Payments Europe for payment processing.
• Postal on BLUN-managed mail infrastructure.

Technical and organisational measures

Encryption in transit, encrypted storage where applicable, two-factor authentication for admins, daily encrypted backups, annual security reviews, and incident-response procedures.

Data-subject rights

BLUN supports the controller with requests for access, erasure, and rectification. Standard response target: seven business days.

Deletion

After contract end, BLUN provides a 30-day export window and then deletes production data. Backup expiry follows within 90 days.

Workspace: BLUN HQ · Last updated: 2026-07-02