Data Processing Agreement
For business customers of Muzzle Pro, under Article 28 of the GDPR.
Version 1 · 29 October 2026
1. Parties and effect
This agreement is between aabergkvist AB (Org. no. 559317-4948, Ormastensvägen 9, Halmstad, Sweden), the provider of Muzzle (we, the processor), and the business that buys or uses Muzzle Pro (Customer, the controller). It forms part of our Terms or the order between us, and takes effect when Customer accepts them. No signature is needed. For a countersigned copy, email support@usemuzzle.com.
Terms such as personal data, processing, controller, processor, data subject and personal data breach have the meaning given in Regulation (EU) 2016/679 (GDPR).
2. Scope and roles
This agreement covers the personal data we process on Customer's behalf to provide Muzzle, described in Annex 1 (Customer Personal Data). Muzzle's checks run on Customer's Macs; protected values, secrets, files, code and the event log stay there and are not Customer Personal Data in our hands.
We act as controller, under our privacy policy, for billing and accounting, preventing abuse, securing our service, website analytics, and building the shared Threat Feed rules from contributed signals.
3. Instructions
We process Customer Personal Data only on Customer's documented instructions. Customer's instructions are this agreement, the Terms and Customer's use and configuration of Muzzle. We tell Customer if we believe an instruction breaks data protection law. Where EU or member-state law requires other processing, we tell Customer first unless that law forbids it.
4. Confidentiality
Everyone we authorise to process Customer Personal Data is bound by confidentiality.
5. Security
We keep the technical and organisational measures in Annex 2 in place, as required by Article 32 GDPR. We may change them as long as the level of security does not go down.
6. Sub-processors
Customer authorises the sub-processors listed on our sub-processors page. We give 30 days' notice of a new sub-processor by updating that page. Customer can object on reasonable data protection grounds within that period; if we can't resolve the objection, Customer may end the affected subscription. We bind each sub-processor to data protection obligations no less protective than these and remain responsible to Customer for its performance.
7. Assistance
Taking into account the nature of the processing, we help Customer answer data subject requests, and with security, breach notification, data protection impact assessments and prior consultation (Articles 32 to 36 GDPR). If a data subject contacts us directly about Customer Personal Data, we refer them to Customer.
8. Personal data breaches
We notify Customer without undue delay, and no later than 72 hours after becoming aware of a personal data breach affecting Customer Personal Data. The notice describes, as far as we know them, the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences and the measures taken or proposed. We add information as it becomes available.
9. Transfers outside the EU/EEA
We are established in Sweden. We transfer Customer Personal Data outside the EU/EEA only under an adequacy decision or appropriate safeguards under Chapter V GDPR, such as the standard contractual clauses in Commission Implementing Decision (EU) 2021/914 (SCCs).
If Customer is outside the EU/EEA, Module 4 (processor to controller) of the SCCs applies to our transfers to Customer and is incorporated here: the optional clause 7 is not included, clause 17 is governed by Swedish law, clause 18 courts are those of Sweden, and Annexes 1 to 3 of this agreement complete the SCC annexes. The SCCs prevail over this agreement where they conflict.
10. Audits
We make available the information needed to show compliance with Article 28 GDPR, including our security page and written answers to a reasonable security questionnaire once a year. Where that is not enough, or a supervisory authority requires it, Customer or an auditor bound by confidentiality may audit us on 30 days' written notice, during business hours, at Customer's cost, at most once a year. The audit does not extend to our sub-processors' facilities; for those we provide their available reports.
11. Return and deletion
When the subscription ends, we delete Customer Personal Data within the periods on our security page, or within 30 days of Customer's written request, unless law requires us to keep it (such as accounting records under the Swedish Bookkeeping Act). Data on Customer's Macs is under Customer's control and is removed by uninstalling Muzzle and deleting its folder.
12. Liability and precedence
The limits of liability in the Terms apply to this agreement, except where the GDPR does not allow them. On data protection, this agreement prevails over the Terms.
13. Term and law
This agreement lasts as long as we process Customer Personal Data. It is governed by Swedish law, and disputes go to Swedish courts. We may update it by publishing a new version here; changes that reduce Customer's protection need Customer's agreement.
Annex 1: Description of the processing
| Subject matter and purpose | Providing Muzzle Pro: licence keys and Mac slots, the account page, contact addresses and mail forwarding, Threat Feed registration, and support |
| Nature | Collection, storage, retrieval, transmission (email forwarding), deletion |
| Data subjects | Customer's staff and other users of Muzzle; people who write to a contact address or to support |
| Categories of data |
|
| Special categories | None intended. A forwarded or support email may contain whatever its sender writes. |
| Frequency | Continuous while Muzzle Pro is used |
| Duration and retention | For the subscription, then as on our security page |
Annex 2: Technical and organisational measures
- Data minimisation: Muzzle's checks run on the Mac; protected values, secrets, files and code are not sent to us. Device ids are hashed on the Mac and salted again on our server.
- Encryption in transit: the app and website use HTTPS to reach our services.
- Credentials at rest: sign-in tokens, confirmation tokens and contact-address secrets are stored only as SHA-256 hashes.
- Integrity: licence answers and Threat Feed rules are Ed25519-signed and verified by the app; app updates are signed and verified before install; the app is code-signed and notarized by Apple.
- Access control: admin functions require a secret bearer token; signing and provider keys are held as Cloudflare secrets, outside source code. Account sign-in uses one-time links that expire after 15 minutes and an HttpOnly, Secure session cookie.
- Input validation and abuse limits: strict shape checks on submitted data; per-day rate limits keyed by salted hashes.
- Retention: an automated daily job deletes data when its retention period ends.
- Location: the API database runs in Cloudflare's Western Europe region.
- Vulnerability handling: a published disclosure policy and security.txt.
Annex 3: Sub-processors
As listed on our sub-processors page.
Contact
aabergkvist AB · Org. no. 559317-4948 · VAT SE559317494801Ormastensvägen 9, Halmstad, Sweden
support@usemuzzle.com