Data Processing Terms (DPA)
Annex to and integral part of the Terms of Use of the MojaDružina service
Last updated: 29 September 2026
1. Purpose and validity of the DPA
These Data Processing Terms (hereinafter: the “DPA”) are an annex to and an integral part of the Terms of Use of the MojaDružina service (hereinafter: the “Terms of Use”). They govern the processing of personal data where the user decides which private family content to enter, for which personal or family purposes to use it and with which invited members to share it, while DATAFLOW processes that content technically on the user’s behalf.
In the event of any inconsistency between the DPA and the Terms of Use regarding the processing of family content, this DPA prevails. By accepting the Terms of Use and this DPA, the user gives DATAFLOW documented instructions for processing to the extent described in this DPA, in the user’s actions and settings in the application and in any additional written instructions accepted by DATAFLOW.
2. Parties and allocation of roles
The provider is DATAFLOW, informacijske in podatkovne rešitve, d. o. o., Krpanova ulica 3, 6310 Izola – Isola, Slovenia, registration number: 7447035000, tax number: 61888630. Contact: info@mojadruzina.si.
DATAFLOW as controller. DATAFLOW itself determines the purposes and essential means of processing data relating to user accounts, login and authentication, security and misuse prevention, technical support, necessary communication, enforcement of the contract, compliance with legal obligations and any future payments and marketing. This processing is described in the Privacy Policy and is not subject to the provisions of this DPA on processing on the user’s instructions.
DATAFLOW as processor. DATAFLOW acts as a processor when, on the user’s instructions, it stores, displays, links, converts, backs up, exports, makes available to authorised members or otherwise technically processes private family content. The user acts as controller to the extent that the GDPR or other data protection legislation applies to them with regard to such processing.
If the user processes family content exclusively in the course of a purely personal or household activity and therefore does not act as controller under applicable law, the provisions of this DPA nevertheless apply as contractual obligations of DATAFLOW regarding purpose limitation, confidentiality, security, sub-processors, assistance to the user and deletion or return of content.
3. Subject matter and duration of processing
The subject matter of processing is the technical provision of the MojaDružina service: creating and editing family trees, GEDCOM import and export, storing and displaying photos, stories, memories and comments, linking persons and content, collaboration of invited members, search, export, backup, restoration and other features requested by the user through use of the application.
Processing lasts from the first entry or import of family content until its deletion or until the service ceases to be provided to the user or family. Confidentiality, protection of backups and the obligation of final deletion apply until all relevant copies have been deleted.
4. Nature and purpose of processing
Processing may include collection, recording, organisation, structuring, storage, adaptation, linking, retrieval, consultation, use, technical conversion, disclosure to authorised users, restriction, backup, restoration, export and erasure. The purpose is exclusively to provide the requested features and to safeguard the availability, integrity and confidentiality of family content.
DATAFLOW does not use family content for advertising, sale of data, profiling or training general-purpose artificial intelligence models. Should it wish to process such content for its own purposes, independent of the user’s purposes, it would have to secure a separate legal basis and provide appropriate notice.
5. Types of personal data
Family content may include first names, surnames, previous surnames and nicknames; dates and places of birth, marriage, death and other events; sex and family status; family and other personal relationships; addresses and places of residence; photos and metadata; stories, memories, biographical notes and comments; GEDCOM data; contact details; data on education, occupation and activities; data on authorship and changes; and other data voluntarily entered by the user.
Content may include special categories of personal data under Article 9 GDPR or data relating to criminal convictions if entered by the user. The user must not enter such data without an appropriate legal basis. DATAFLOW does not encourage the user to enter such data and does not use it for its own inferences or profiling.
6. Categories of data subjects
Processing may relate to the user, other registered and invited family members, living relatives and other persons in the tree, minors, persons in photos or in stories and comments, persons in GEDCOM files and deceased persons, insofar as data about them is protected or reveals information about living individuals.
7. Documented instructions
DATAFLOW processes family content only in accordance with the Terms of Use and this DPA, the features and settings the user chooses in the application and other accepted documented instructions of the user.
If processing is required by European Union or Member State law, DATAFLOW informs the user of that legal requirement before processing, unless the law prohibits such information on important grounds of public interest. If DATAFLOW considers that an instruction of the user infringes data protection legislation, it informs the user immediately and may suspend execution of the instruction until it is confirmed, amended or withdrawn.
8. Obligations of the user
The user is responsible for the lawfulness of instructions and content, for determining the purpose and legal basis where the GDPR applies to them, for the accuracy and proportionality of data, for the necessary notices and permissions, for correctly assigning access to invited members and for particular care with children’s data, special categories of data and photos.
9. Confidentiality
DATAFLOW ensures that family content is processed only by duly authorised persons who need it for their tasks, are bound by contractual or statutory confidentiality and are aware of their data protection obligations. Confidentiality continues after their work or authorisation ends.
Staff access to individual content is permitted only where necessary for support, fixing an error, a security incident, a legal obligation or another agreed purpose, and must be limited to the minimum necessary.
10. Technical and organisational measures
Taking into account the state of the art, the costs, the nature and scope of processing and the risks, DATAFLOW implements measures appropriate to the risk. Where appropriate, these include: an encrypted connection in transit; cryptographic protection of passwords; authentication and access management; restriction of administrative rights; separation of families and their access; logging of security events; protection against unauthorised access and web attacks; security updates; backups and restoration; incident procedures; testing the effectiveness of measures; and secure deletion.
DATAFLOW may adapt the measures to technological developments provided it does not lower the overall level of protection. On request, it provides the user with an appropriate summary, omitting details whose disclosure would compromise security.
11. Sub-processors
The user gives DATAFLOW a general written authorisation to engage sub-processors needed for hosting, infrastructure, security, backups, e-mail functions and support. At the time this DPA takes effect, at least the following are relevant: HITROST.COM for hosting, databases, infrastructure and backups; Defiant, Inc. / Wordfence for website security, insofar as it has access to personal data; and Google Ireland Limited (Google Drive) for storing backups at a separate location.
DATAFLOW notifies the user of the addition of a new or the replacement of an existing sub-processor, as a rule at least 15 days in advance. The user may object to the change on reasonable data protection grounds. If no reasonable solution is found, the user may, before the change, stop using the affected feature or service and request export or deletion of the data.
DATAFLOW imposes on the sub-processor at least the same essential data protection obligations as apply under this DPA and remains responsible for the performance of its obligations in accordance with applicable law and the contract.
12. Transfers outside the EEA
Family content must not be transferred outside the European Economic Area unless the conditions of Chapter V GDPR are met. Where there is no adequacy decision, DATAFLOW ensures appropriate safeguards, such as standard contractual clauses, and adopts supplementary measures where necessary. On request, it informs the user of the mechanism used. With the sub-processor Google Ireland Limited (Google Drive), backup data may also be processed outside the EEA; the transfer is based on the European Commission’s adequacy decision (EU–US Data Privacy Framework) or on standard contractual clauses.
13. Assistance with data subjects’ rights
Taking into account the nature of processing, DATAFLOW assists the user by appropriate measures with requests for access, rectification, erasure, restriction, portability, objection and other rights. If it receives a request concerning family content directly, it forwards it without undue delay to the responsible user or informs them. DATAFLOW does not respond on the user’s behalf unless authorised or required by law.
14. Assistance with compliance
Taking into account the nature of processing and the information available, DATAFLOW assists the user with security of processing, handling of breaches, notification of the supervisory authority and data subjects, impact assessments and prior consultation with the supervisory authority. Additional assistance requiring extensive individual work that does not result from a breach by DATAFLOW may be subject to prior agreement on reasonable costs.
15. Personal data breaches
When DATAFLOW becomes aware of a security breach affecting family content, it notifies the user without undue delay. The notice contains the available description of the nature of the breach, the types of data and data subjects affected, the approximate number of records or data subjects, the likely consequences, the measures taken or proposed and a contact point. Missing information is provided in phases without further undue delay.
DATAFLOW takes reasonable measures to contain the breach, remedy its consequences, preserve relevant evidence and prevent recurrence.
16. Return, export and deletion
During the contract, DATAFLOW provides the available export options, in particular GEDCOM and export of photos and notes in a supported format. When the service ends, or upon an appropriately documented request, it enables the user to export or receive back the family content and deletes it, unless the law requires further storage.
Deleting an individual member’s account does not automatically mean deleting the family’s shared content. Such an instruction is assessed in light of the roles and rights of the responsible members and the rights of the data subjects concerned.
Data is deleted from the active system no later than 30 days after confirmation of the relevant request or the end of processing. Remaining copies are deleted or removed from ordinary use through the rotation of backups, as a rule within a further 30 days. Until deletion, they are not used for any other purpose and remain protected.
17. Demonstrating compliance and audits
DATAFLOW provides the user with the information reasonably necessary to demonstrate compliance with Article 28 GDPR, as a rule through a description of security measures, a list of sub-processors, relevant policies, certificates, summaries of reviews or answers to written questions.
If this is not sufficient, the user or an independent authorised auditor may carry out an audit at most once a year; more often in the event of a breach, a well-founded suspicion of significant non-compliance or at the request of a supervisory authority. The audit must be announced reasonably in advance, carried out during business hours and must not compromise security, the privacy of other users or trade secrets. The auditor must be bound by confidentiality. The user bears its own costs unless a significant breach of the DPA by DATAFLOW is established.
18. Requests from public authorities
If DATAFLOW receives a legally binding request from an authority, it verifies its validity and discloses only the data to the extent requested. It informs the user in advance where the law permits, or afterwards once the prohibition ends and notification is allowed.
19. Liability
Each party is liable for its own obligations and conduct in accordance with the GDPR, other applicable law, the Terms of Use and this DPA. No provision limits the rights of data subjects, the powers of supervisory authorities or liability that cannot be limited by law.
20. Changes to the DPA
DATAFLOW may change the DPA because of changes to the service, sub-processors, security measures or legislation. It informs the user of material changes within a reasonable period before they take effect. If the user does not agree with a material change, they may stop using the service before it takes effect and request export and deletion of the data.
21. Final provisions
The DPA applies for as long as DATAFLOW processes family content on behalf of the user. Matters not governed by it are subject to the Terms of Use, the Privacy Policy, the GDPR and the law of the Republic of Slovenia. This text is a translation of the Slovenian version; in case of any discrepancy, the Slovenian version prevails.
Contact for questions about the processing of personal data: info@mojadruzina.si.