Customers who need a counter-signed copy of this DPA can request one by emailing legal@mobinars.com.
1. Roles
The Processor is MOBINARS.COM Spółka z ograniczoną odpowiedzialnością, ul. Glebowa 46A, 61-312 Poznań, Poland, KRS 0001261884, NIP 7822973531, REGON 545526250.
You ("Customer") are the Controller of personal data of your attendees. Mobinars is the Processor and acts only on Customer's documented instructions, which are deemed to include the use of the service as configured in the dashboard.
2. Subject matter and duration
Mobinars processes Customer's personal data for as long as Customer maintains an active account and until deletion is requested or, in the case of recordings and signups, until the retention windows in § 7 of our Privacy Policy elapse.
3. Categories of data
- Attendee email addresses
- Webinar event logs (joins, leaves, questions, chat messages)
- Audio + video recordings, where Customer has chosen to record
- Optional Meta advertising attribution identifiers (only with attendee consent)
4. Sub-processors
Mobinars engages the sub-processors listed in our Privacy Policy § 5. Customer hereby authorizes their use. We give 30 days' notice before adding or replacing a sub-processor; Customer may object on reasonable grounds, in which case the parties cooperate in good faith to resolve the objection.
5. International transfers
Where personal data is transferred outside the EEA, the EU Standard Contractual Clauses (Decision 2021/914) are incorporated by reference. Module 2 (controller-to-processor) applies between Customer and Mobinars; Module 3 (processor-to-processor) applies between Mobinars and downstream sub-processors.
6. Security measures
Mobinars implements appropriate technical and organisational measures, including:
- TLS 1.2+ encryption in transit on every endpoint
- Encryption at rest for the primary database and object storage
- Role-based access controls and least-privilege service tokens
- Audit logging of administrative actions
- Regular dependency and vulnerability scanning
- Incident response procedures with notification commitments per § 8
7. Personnel
Mobinars personnel with access to Customer personal data are bound by confidentiality obligations and receive privacy and security training appropriate to their role.
8. Breach notification
Mobinars will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer's data, providing the information required by Art. 33(3) GDPR.
9. Data subject requests
Mobinars provides self-service data export and deletion in the dashboard. Where Customer needs to respond to a request that requires Mobinars' assistance, we will support Customer at no additional cost beyond what is necessary to comply.
10. Audit rights
On reasonable request and not more than once per year (except after a breach), Mobinars will provide Customer with information necessary to demonstrate compliance, including any independent audit reports we have produced.
11. Return or deletion at end of services
On termination Mobinars will delete or return all personal data within 30 days, save for any data we are required to retain by law (e.g. invoicing records).